Who contributed to Go on July 29, 2026?

8 developers shipped this update, including Nicholas S. Husin, Jorropo, ArsenySamoylov, Filippo Valsorda, cuishuang, Hongxiang Jiang, David Chase, and Junyang Shao.

What were the notable Go updates?

crypto/tls: do not count handshake messages as state-advancing post-handshake, cmd/compile: fix time traveling proofs in prove, and cmd/compile: generalize staticuint64s sharing to larger integer constant types.

@golang

Go and the standard library - backend infrastructure at scale

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

CRYPTO/TLS PATCHES KEYUPDATE DOS, COMPILER FIXES TIME-TRAVELING PROOFS

By RepoJournal · Filed 06:56 UTC on July 29, 2026 · About Go

8 people shipped this

Nicholas S. Husin @nicholashusin 1 cited

Jorropo @Jorropo 1 cited

Filippo Valsorda @FiloSottile 1 cited

cuishuang @cuishuang 1 cited

Hongxiang Jiang @h9jiang 1 cited

David Chase @dr2chase 1 cited

ArsenySamoylov @ArsenySamoylov

Junyang Shao @JunyangShao

Go shipped a critical fix for a denial-of-service vulnerability in TLS handshake handling that allowed malicious clients to force infinite key derivation operations on servers.

The crypto/tls fix [1] stops counting handshake messages like KeyUpdate as state-advancing after the handshake completes, closing a window where attackers could trigger repeated expensive operations. In the compiler, a subtle bug in the prove pass [2] allowed proofs to be applied before their underlying values executed, leading to incorrect optimizations that have now been retabulated. Integer constant optimization [3] now shares static backing variables across all integer sizes up to 255, letting the linker eliminate redundant symbols in the read-only data segment. Separately, crypto/ecdsa [4] no longer panics when Sign receives an invalid crypto.Hash(0) argument. On the tooling front, gopls [5] now correctly adds missing fmt imports when the fill switch code action generates a default case with fmt.Sprintf, ensuring generated code compiles without manual fixes. The benchmarks suite [7] has been refreshed to latest versions with problematic ones disabled, and the module build version bumped to 1.26, though benchmarks-50 currently runs 387 benchmarks instead of its target. vscode-go [6] upgraded to TypeScript 5 and @types/node 16, fixing breaking changes from the version bump.

Action items

→ Review and apply the crypto/tls KeyUpdate fix to any servers handling untrusted clients golang/go [immediate]
→ Update gopls if you use fill switch code actions to avoid missing import issues golang/tools [plan]
→ Re-run benchmark suites with the refreshed versions to validate against new baselines golang/benchmarks [plan]

References

[1] crypto/tls: do not count handshake messages as state-advancing post-handshake golang/go
[2] cmd/compile: fix time traveling proofs in prove golang/go
[3] cmd/compile: generalize staticuint64s sharing to larger integer constant types golang/go
[4] crypto/ecdsa: avoid panic when Sign is called with crypto.Hash(0) golang/go
[5] gopls/internal/analysis/fillswitch: add missing fmt import golang/tools
[6] extension/package.json: bump to typescript 5 & @types/node 16 golang/vscode-go
[7] cmd/bent: refresh versions of all the bent benchmarks golang/benchmarks

Quick answers

What shipped in Go on July 29, 2026?: Go shipped a critical fix for a denial-of-service vulnerability in TLS handshake handling that allowed malicious clients to force infinite key derivation operations on servers. In total, 10 commits landed.
Who contributed to Go on July 29, 2026?: 8 developers shipped this update, including Nicholas S. Husin, Jorropo, ArsenySamoylov, Filippo Valsorda, cuishuang, Hongxiang Jiang, David Chase, and Junyang Shao.
What were the notable Go updates?: crypto/tls: do not count handshake messages as state-advancing post-handshake, cmd/compile: fix time traveling proofs in prove, and cmd/compile: generalize staticuint64s sharing to larger integer constant types.

ARM64 COMPILER STRIPS REDUNDANT EXTENSIONS, VULNDB ADDS 41 NEW REPORTS

Go's ARM64 compiler now eliminates dead zero-extension instructions, cutting instruction count on tight loops while the vulnerability database absorbs a major backlog of security advisories.

go 20 shipped 2-min read

@golang 2 days ago

COMPILER GETS SMARTER ABOUT FUNCTION ORDERING, BENCHMARK SUITE HITS BUILD SNAGS

Go's compiler now counts IR nodes to order functions more intelligently, while the benchmark harness stumbles on recent upgrades.

go 4 shipped 1-min read

@golang 3 days ago

GO STRIPS MIPS REGISTER ALLOCATOR SUPPORT

Go's compiler is ripping out HI/LO register support for MIPS, closing the door on a decade of architectural complexity that wasn't worth the maintenance tax.

go 2 shipped 1-min read

@golang 4 days ago

PRINTF ANALYZER GETS SMARTER, PLAYGROUND NEEDS GO 1.26

The printf linter stops falsely flagging intentional double newlines, while gotip now requires Go 1.26 to bootstrap.

go 13 shipped 1-min read

Elsewhere on the wire

AI Agents about 4 hours ago

LANGCHAIN CORES SHIP, ANTHROPIC THINKING BLOCKS FIXED, OPENHANDS TIGHTENS WEBSOCKET AUTH

LangChain released two core packages with critical fixes for streaming stability and environment variable handling, while OpenHands closed a security gap that left WebSocket connections unprotected.

ai-agents 119 shipped 1-min read

Local LLMs about 4 hours ago

OLLAMA RIPS OUT IMAGE GENERATION, LLAMA.CPP SHIPS SPECULATIVE DECODING

Ollama removed its entire MLX image generation pipeline overnight, while llama.cpp landed DSpark speculative decoding and fixed a critical SYCL memory bug affecting Arc GPUs.

+11

llms 239 shipped 2-min read

@CachyOS about 4 hours ago

KERNEL SCHEDULER UPDATES ACROSS BORE AND SCX TOOLING

CachyOS shipped BORE 6.8.0 patches across two kernel series while upgrading its sched-ext ecosystem in parallel, signaling major tuning work ahead.

infra 83 shipped 1-min read

Elixir & Phoenix about 4 hours ago

ELIXIR TIGHTENS ERROR HANDLING ACROSS DATE, ECTO, AND IEXHELPERS

Date.range now surfaces ArgumentError instead of Protocol.UndefinedError when passed invalid step values, catching a class of bugs that silently fail in production code.