RepoJournal
Go

@golang

Go and the standard library - backend infrastructure at scale

Keep up with Go in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Fri 12 jun
  2. Sat 13 jun
  3. Sun 14 jun
  4. Tue 16 jun
  5. Wed 17 jun
  6. Thu 18 jun
  7. Fri 19 jun
  8. Sat 27 jun
  9. Sun 28 jun
  10. Tue 30 jun
  11. Wed 1 jul
  12. Thu 2 jul
  13. Fri 3 jul
  14. Tue 7 jul
  15. Wed 8 jul
  16. Thu 9 jul
  17. Fri 10 jul
  18. Sat 11 jul
  19. Mon 13 jul
  20. Tue 14 jul
  21. Wed 15 jul
  22. Thu 16 jul
  23. Fri 17 jul
  24. Sat 18 jul
  25. Sun 19 jul
  26. Mon 20 jul
  27. Tue 21 jul
  28. Wed 22 jul
  29. Thu 23 jul
  30. Today 24 jul
Topics: Go Infrastructure Full archive →

The Wire · Showcase

GO REWORKS HTTP/3 REGISTRATION, KILLS GLOBAL STATE IN MODULE LOADER

By RepoJournal · Filed · About Go

Ian Alexander Damien Neil Michael Matloob Meng Zhuo Mehdi Bounya cuishuang Inada Naoki
10 people shipped this
Ian Alexander @jitsu-net 6 cited Damien Neil @neild 2 cited Michael Matloob @matloob 1 cited Meng Zhuo @mengzhuo 1 cited Mehdi Bounya @mehdibo 1 cited cuishuang @cuishuang 1 cited Inada Naoki @methane Peter Weinberger @pjweinbgo Alan Donovan @adonovan qiulaidongfeng @qiulaidongfeng

Damien Neil's paired changes to net/http and x/net/http3 fundamentally reshape how HTTP/3 integrates with the standard library, while Michael Matloob strips out state manipulation functions that no longer belong anywhere.

The HTTP/3 rework [1] [2] lands as two coordinated changes that replace the old linkname mechanism with explicit registration functions (registerServer and registerTransport), allowing tests to use fake networks without touching the production path. Simultaneously, the module loader sheds its global state machinery [3], removing setState, EnterWorkspace, and Reset now that the loader can be instantiated cleanly instead of manipulated at runtime. This is the payoff from months of refactoring to eliminate hidden dependencies [4]. On the crypto front, Go 1.24 adds RISC-V crypto algorithm suites including Zvkg (Vector GCM), Zvkned (NIST AES), and Zvksed (ShangMi SM4) [5], extending hardware acceleration across architectures. The vulndb team continues steady work reviewing and publishing new vulnerability reports [6] [7] [8] [9] [10], while tools/go/analysis tackles determinism in fact encoding [11] and gopls fixes fillswitch to respect renamed package imports [12].

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] net/http: rework HTTP/3 registration to allow using a fake network golang/go
  2. [2] http3: rework registration to allow using a fake network golang/net
  3. [3] cmd/go/internal/modload: remove state manipulation functions golang/go
  4. [4] cmd/go/internal/modload: remove unused parameters golang/go
  5. [5] cmd/asm, cmd/internal/obj: add crypto algorithm suites for riscv64 golang/go
  6. [6] data/reports: review 7 reports golang/vulndb
  7. [7] data/reports: add GO-2026-5987 golang/vulndb
  8. [8] data/reports: add GO-2026-5989 golang/vulndb
  9. [9] data/reports: add GO-2026-5675, review 2 reports golang/vulndb
  10. [10] data/reports: update GO-2026-5746 golang/vulndb
  11. [11] internal/refactor/inline: make fact encoding deterministic golang/tools
  12. [12] gopls/internal/analysis/fillswitch: support renamed package imports golang/tools

Quick answers

What shipped in Go on July 24, 2026?
Damien Neil's paired changes to net/http and x/net/http3 fundamentally reshape how HTTP/3 integrates with the standard library, while Michael Matloob strips out state manipulation functions that no longer belong anywhere. In total, 28 commits landed.
Who contributed to Go on July 24, 2026?
10 developers shipped this update, including Damien Neil, Michael Matloob, Ian Alexander, Inada Naoki, Meng Zhuo, Peter Weinberger, Alan Donovan, and Mehdi Bounya, and 2 more.
What were the notable Go updates?
net/http: rework HTTP/3 registration to allow using a fake network, http3: rework registration to allow using a fake network, and cmd/go/internal/modload: remove state manipulation functions.

More from @golang

Go @golang

GOPLS FIXES COMMENT HANDLING IN COMPOSITE LITERALS, VULNDB ADDS 46 SECURITY REPORTS

A critical gopls bug that corrupted code when comments appeared in composite literals is fixed, while the vulnerability database absorbs a major batch of 46 new security reports across the ecosystem.

Jean Barkhuysen Hana Kim David Chase Sean Liao +7
go 21 shipped 2-min read
Go @golang

COMPILER SHRINKS CODE SIZE WHILE QUIC FIXES BUSY-LOOP HANGS

The Go compiler now frees unused registers at loop headers, cutting generated code size across all architectures, while the net package fixes a critical QUIC keep-alive deadlock that was burning CPU on blocked connections.

Josh Bleecher Snyder Ilya Torbin Jake Bailey Filippo Valsorda +7
go 25 shipped 1-min read
Go @golang

COMPILER CLEANUP AND PROXY BEHAVIOR FIXES SHIP ACROSS THE STACK

Go's compiler gets leaner while net/http fixes a decade-old proxy environment variable ambiguity that's finally caught up with the rest of the ecosystem.

Ilya Torbin Alan Donovan Daniel Morsing Nicholas S. Husin +2
go 19 shipped 1-min read
Go @golang

GO TOOLCHAIN BUILD FLAGS GET PRECISION FIX, CGO PROBE ESCAPES WRAPPER TRAP

The go command's cgo compiler version detection was running under -toolexec when it shouldn't have been, breaking builds for anyone wrapping their toolchain.

harjoth Andreas Bolka
go 2 shipped 1-min read

Daily updates, in your inbox

Follow Go

Keep up with Go in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

LANGCHAIN SHIPS COORDINATED PROVIDER UPDATES WITH LANGSMITH GATEWAY SUPPORT

All four core LangChain packages bumped to 1.5.1 overnight with unified LangSmith gateway routing and provider-specific fixes across OpenAI, Anthropic, and Fireworks.

github-actions[bot] ccurme ak684 tofarr +2
ai-agents 62 shipped 1-min read
Local LLMs Local LLMs

LLAMA.CPP SHIPS FIVE RELEASES IN 24 HOURS, FIXES SPECULATIVE DECODING ACROSS THE STACK

The inference stack is consolidating around speculative decoding, and the bugs surfacing there are getting squashed across three major projects simultaneously.

Jesse Gross github-actions[bot] yuyue0225sc davidjpyu +8
llms 157 shipped 2-min read
CachyOS @CachyOS

INSTALLER REFACTOR TAKES SHAPE, PACKAGE UPDATES ROLL STEADY

CachyOS is modernizing its CLI installer with a comprehensive typed partition system overhaul while maintaining smooth automation across the AUR-derived package repository.

github-actions Vladislav Nepogodin loathingKernel cantosun99 +2
infra 57 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

PHOENIX LIVE VIEW SEALS CRITICAL NODE NAME LEAK IN UPLOAD TOKENS

A reverted encryption fix exposes how Phoenix was leaking BEAM node identities through unencrypted upload tokens, and the core team is pivoting to a cleaner solution using term_to_binary.

AlexGx Eurico Nicacio SteffenDE lukaszsamson +1
elixir 23 shipped 2-min read
Want every project, not just this one?