RepoJournal
Go @golang
118 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-29
stories 10
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

CRYPTO/TLS PATCHES KEYUPDATE DOS, COMPILER FIXES TIME-TRAVELING PROOFS

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

Nicholas S. Husin Jorropo Filippo Valsorda cuishuang Hongxiang Jiang David Chase ArsenySamoylov
8 people shipped this
Nicholas S. Husin @nicholashusin 1 cited Jorropo @Jorropo 1 cited Filippo Valsorda @FiloSottile 1 cited cuishuang @cuishuang 1 cited Hongxiang Jiang @h9jiang 1 cited David Chase @dr2chase 1 cited ArsenySamoylov @ArsenySamoylov Junyang Shao @JunyangShao

Go shipped a critical fix for a denial-of-service vulnerability in TLS handshake handling that allowed malicious clients to force infinite key derivation operations on servers.

The crypto/tls fix [1] stops counting handshake messages like KeyUpdate as state-advancing after the handshake completes, closing a window where attackers could trigger repeated expensive operations. In the compiler, a subtle bug in the prove pass [2] allowed proofs to be applied before their underlying values executed, leading to incorrect optimizations that have now been retabulated. Integer constant optimization [3] now shares static backing variables across all integer sizes up to 255, letting the linker eliminate redundant symbols in the read-only data segment. Separately, crypto/ecdsa [4] no longer panics when Sign receives an invalid crypto.Hash(0) argument. On the tooling front, gopls [5] now correctly adds missing fmt imports when the fill switch code action generates a default case with fmt.Sprintf, ensuring generated code compiles without manual fixes. The benchmarks suite [7] has been refreshed to latest versions with problematic ones disabled, and the module build version bumped to 1.26, though benchmarks-50 currently runs 387 benchmarks instead of its target. vscode-go [6] upgraded to TypeScript 5 and @types/node 16, fixing breaking changes from the version bump.

Action items

References

  1. [1] crypto/tls: do not count handshake messages as state-advancing post-handshake ↗ golang/go
  2. [2] cmd/compile: fix time traveling proofs in prove ↗ golang/go
  3. [3] cmd/compile: generalize staticuint64s sharing to larger integer constant types ↗ golang/go
  4. [4] crypto/ecdsa: avoid panic when Sign is called with crypto.Hash(0) ↗ golang/go
  5. [5] gopls/internal/analysis/fillswitch: add missing fmt import ↗ golang/tools
  6. [6] extension/package.json: bump to typescript 5 & @types/node 16 ↗ golang/vscode-go
  7. [7] cmd/bent: refresh versions of all the bent benchmarks ↗ golang/benchmarks

$ ls golang/reviews/ # the step-back reads

the week in review Go 1.27.1 lands as plan9 early export disabled the month in review Go compiler hardens binaries, crypto tightens SSH safety
Topics: Go Infrastructure Full archive → Weekly reviews →

Quick answers

What shipped in Go on July 29, 2026?
Go shipped a critical fix for a denial-of-service vulnerability in TLS handshake handling that allowed malicious clients to force infinite key derivation operations on servers. In total, 10 commits landed.
Who contributed to Go on July 29, 2026?
8 developers shipped this update, including Nicholas S. Husin, Jorropo, ArsenySamoylov, Filippo Valsorda, cuishuang, Hongxiang Jiang, David Chase, and Junyang Shao.
What were the notable Go updates?
crypto/tls: do not count handshake messages as state-advancing post-handshake, cmd/compile: fix time traveling proofs in prove, and cmd/compile: generalize staticuint64s sharing to larger integer constant types.
♥

$ log @golang --recent

Salsa20 gets a loong64 SIMD path 1 shipped LoongArch crypto gets SIMD, RISC-V bit tests slim down 9 shipped Go's QUIC stack learns to tell on-path from off-path, and amd64 gets v2/v3/v4 CPU bits 19 shipped pkgsite drops ctxhttp, tour returns real 404s 7 shipped

$ log --all # elsewhere on the wire

@open-webui Open WebUI 0.11.4 ships a slim image 89% smaller FastAPI & Pydantic SQLModel narrows SQLAlchemy type handling in Field, drops dataclass_transform shim

$ ls showcases/

Rails Django Laravel Node.js Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.