Who contributed to Go on July 30, 2026?

9 developers shipped this update, including Ian Alexander, Mark Freeman, Filippo Valsorda, Cherry Mui, Brad Fitzpatrick, Hana Kim, Peter Weinberger, and Groot Guo, and 1 more.

What were the notable Go updates?

net/url: avoid quadratic complexity in resolvePath, encoding/xml: fix depth processing in (*Decoder).unmarshal, and http2/hpack: build the table lookup maps lazily, only for encoders.

@golang

Go and the standard library - backend infrastructure at scale

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

GO FIXES QUADRATIC URL PARSING BUG, TIGHTENS XML RECURSION DEPTH

By RepoJournal · Filed 06:56 UTC on July 30, 2026 · About Go

9 people shipped this

Ian Alexander @jitsu-net 2 cited

Brad Fitzpatrick @bradfitz 1 cited

Hana Kim @hyangah 1 cited

Groot Guo @groot-guo 1 cited

Mark Freeman @mrkfrmn

Filippo Valsorda @FiloSottile

Cherry Mui @cherrymui

Peter Weinberger @pjweinbgo

Jonathan Amsterdam @jba

The core library shipped two security-relevant fixes overnight that eliminate algorithmic vulnerabilities in URL resolution and XML decoding that could be exploited to cause denial of service.

A critical performance regression in net/url.resolvePath is now fixed [1]. The function was calling dst.String() and dst.WriteString() inside a loop on deep paths, causing quadratic complexity. The fix switches to index-based backtracking on a byte slice, delivering 23.65% faster simple path resolution and significantly steeper wins on deep paths. In parallel, encoding/xml.Decoder.unmarshal now properly enforces recursion depth limits [2]. Previously, the DecodeElement method bypassed the guard by hardcoding depth to 0, allowing malicious XML documents to bypass depth tracking through custom UnmarshalXML implementations. The fix maintains depth as a stack value adjusted when elements push and pop, eliminating the bypass vector entirely. On the developer tooling front, gopls picked up assembly file support with DocumentHighlight for label scoping [5], while the build team automated stale watchflakes cleanup to keep issue trackers fresh [4]. The http2 implementation also cut memory overhead by building HPACK table lookup maps lazily only for encoders, not decoders [3], a meaningful optimization for servers with idle connections.

Action items

→ Pull latest golang/go - URL and XML fixes address DoS vectors in production code paths golang/go [immediate]
→ Review any custom UnmarshalXML implementations for depth assumptions and redeploy golang/go [plan]
→ Update gopls to get assembly DocumentHighlight and label scoping improvements golang/tools [monitor]

References

[1] net/url: avoid quadratic complexity in resolvePath golang/go
[2] encoding/xml: fix depth processing in (*Decoder).unmarshal golang/go
[3] http2/hpack: build the table lookup maps lazily, only for encoders golang/net
[4] cmd/gopherbot: add task to close stale watchflakes issues golang/build
[5] gopls: add assembly DocumentHighlight, fix label scoping golang/tools

Quick answers

What shipped in Go on July 30, 2026?: The core library shipped two security-relevant fixes overnight that eliminate algorithmic vulnerabilities in URL resolution and XML decoding that could be exploited to cause denial of service. In total, 11 commits landed.
Who contributed to Go on July 30, 2026?: 9 developers shipped this update, including Ian Alexander, Mark Freeman, Filippo Valsorda, Cherry Mui, Brad Fitzpatrick, Hana Kim, Peter Weinberger, and Groot Guo, and 1 more.
What were the notable Go updates?: net/url: avoid quadratic complexity in resolvePath, encoding/xml: fix depth processing in (*Decoder).unmarshal, and http2/hpack: build the table lookup maps lazily, only for encoders.

GO PATCHES TEMPLATE INJECTION FLAW, HTTP/2 GOROUTINE LEAK

Go shipped a security fix for html/template that blocks JavaScript regexp injection attacks, while simultaneously addressing a goroutine accumulation bug in HTTP/2 transports that could exhaust memory on long-lived connections.

go 4 shipped

@golang Aug 5

GO FIXES BREAKING ABI REGRESSION AND LOCKS DOWN REVERSE PROXY COOKIE HANDLING

Go shipped a critical fix for an x86 ABI0 NOFRAME regression that broke existing code, while explicitly documenting that ReverseProxy does not sanitize forwarded cookies.

go 20 shipped

@golang Aug 4

SSH WINDOW CREDIT BUG COULD STALL CHANNELS; COMPILER REFACTORING SPLITS SSA PACKAGE

Go's SSH implementation leaks window credits on discarded extended data, potentially freezing channels, while the compiler team restructures its core SSA package to improve modularity.

go 30 shipped

@golang Aug 3

GO COMPILER TIGHTENS RANGE-CLEAR SAFETY CHECKS

The Go compiler just blocked a subtle optimization that could corrupt memory when loop variables depend on cleared values.

go 2 shipped

Elsewhere on the wire

AI Agents Aug 6

LANGCHAIN HARDENS ANTHROPIC TOOL CALLING AND GIT CREDENTIALS AS OPENHANDS SHIPS 1.10.0

LangChain fixed a critical credential leak in evaluation runs while Anthropic tool schemas get proper fallback handling, as three major agent frameworks push releases across the ecosystem.

ai-agents 54 shipped

Local LLMs Aug 6

OLLAMA FIXES KV CACHE CORRUPTION, LLAMA.CPP HARDENS FILE SEARCH, VLLM KILLS MOE LEGACY CODE

Ollama patched a critical cache corruption bug that corrupts lazy snapshots during multi-request prefills, while llama.cpp hardened Windows junction traversal and vLLM removed 14 hardcoded MoE shards across quantization methods.