RepoJournal
Go @golang
118 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-24
stories 28
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

GO REWORKS HTTP/3 REGISTRATION, KILLS GLOBAL STATE IN MODULE LOADER

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

Ian Alexander Damien Neil Michael Matloob Meng Zhuo Mehdi Bounya cuishuang Inada Naoki
10 people shipped this
Ian Alexander @jitsu-net 6 cited Damien Neil @neild 2 cited Michael Matloob @matloob 1 cited Meng Zhuo @mengzhuo 1 cited Mehdi Bounya @mehdibo 1 cited cuishuang @cuishuang 1 cited Inada Naoki @methane Peter Weinberger @pjweinbgo Alan Donovan @adonovan qiulaidongfeng @qiulaidongfeng

Damien Neil's paired changes to net/http and x/net/http3 fundamentally reshape how HTTP/3 integrates with the standard library, while Michael Matloob strips out state manipulation functions that no longer belong anywhere.

The HTTP/3 rework [1] [2] lands as two coordinated changes that replace the old linkname mechanism with explicit registration functions (registerServer and registerTransport), allowing tests to use fake networks without touching the production path. Simultaneously, the module loader sheds its global state machinery [3], removing setState, EnterWorkspace, and Reset now that the loader can be instantiated cleanly instead of manipulated at runtime. This is the payoff from months of refactoring to eliminate hidden dependencies [4]. On the crypto front, Go 1.24 adds RISC-V crypto algorithm suites including Zvkg (Vector GCM), Zvkned (NIST AES), and Zvksed (ShangMi SM4) [5], extending hardware acceleration across architectures. The vulndb team continues steady work reviewing and publishing new vulnerability reports [6] [7] [8] [9] [10], while tools/go/analysis tackles determinism in fact encoding [11] and gopls fixes fillswitch to respect renamed package imports [12].

Action items

References

  1. [1] net/http: rework HTTP/3 registration to allow using a fake network ↗ golang/go
  2. [2] http3: rework registration to allow using a fake network ↗ golang/net
  3. [3] cmd/go/internal/modload: remove state manipulation functions ↗ golang/go
  4. [4] cmd/go/internal/modload: remove unused parameters ↗ golang/go
  5. [5] cmd/asm, cmd/internal/obj: add crypto algorithm suites for riscv64 ↗ golang/go
  6. [6] data/reports: review 7 reports ↗ golang/vulndb
  7. [7] data/reports: add GO-2026-5987 ↗ golang/vulndb
  8. [8] data/reports: add GO-2026-5989 ↗ golang/vulndb
  9. [9] data/reports: add GO-2026-5675, review 2 reports ↗ golang/vulndb
  10. [10] data/reports: update GO-2026-5746 ↗ golang/vulndb
  11. [11] internal/refactor/inline: make fact encoding deterministic ↗ golang/tools
  12. [12] gopls/internal/analysis/fillswitch: support renamed package imports ↗ golang/tools

$ ls golang/reviews/ # the step-back reads

the week in review Go 1.27.1 lands as plan9 early export disabled the month in review Go compiler hardens binaries, crypto tightens SSH safety
Topics: Go Infrastructure Full archive → Weekly reviews →

Quick answers

What shipped in Go on July 24, 2026?
Damien Neil's paired changes to net/http and x/net/http3 fundamentally reshape how HTTP/3 integrates with the standard library, while Michael Matloob strips out state manipulation functions that no longer belong anywhere. In total, 28 commits landed.
Who contributed to Go on July 24, 2026?
10 developers shipped this update, including Damien Neil, Michael Matloob, Ian Alexander, Inada Naoki, Meng Zhuo, Peter Weinberger, Alan Donovan, and Mehdi Bounya, and 2 more.
What were the notable Go updates?
net/http: rework HTTP/3 registration to allow using a fake network, http3: rework registration to allow using a fake network, and cmd/go/internal/modload: remove state manipulation functions.
♥

$ log @golang --recent

Salsa20 gets a loong64 SIMD path 1 shipped LoongArch crypto gets SIMD, RISC-V bit tests slim down 9 shipped Go's QUIC stack learns to tell on-path from off-path, and amd64 gets v2/v3/v4 CPU bits 19 shipped pkgsite drops ctxhttp, tour returns real 404s 7 shipped

$ log --all # elsewhere on the wire

@open-webui Open WebUI 0.11.4 ships a slim image 89% smaller FastAPI & Pydantic SQLModel narrows SQLAlchemy type handling in Field, drops dataclass_transform shim

$ ls showcases/

Rails Django Laravel Node.js Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.