RepoJournal
Go @golang
118 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-30
stories 11
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

GO FIXES QUADRATIC URL PARSING BUG, TIGHTENS XML RECURSION DEPTH

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

Ian Alexander Brad Fitzpatrick Hana Kim Groot Guo Mark Freeman Filippo Valsorda Cherry Mui
9 people shipped this
Ian Alexander @jitsu-net 2 cited Brad Fitzpatrick @bradfitz 1 cited Hana Kim @hyangah 1 cited Groot Guo @groot-guo 1 cited Mark Freeman @mrkfrmn Filippo Valsorda @FiloSottile Cherry Mui @cherrymui Peter Weinberger @pjweinbgo Jonathan Amsterdam @jba

The core library shipped two security-relevant fixes overnight that eliminate algorithmic vulnerabilities in URL resolution and XML decoding that could be exploited to cause denial of service.

A critical performance regression in net/url.resolvePath is now fixed [1]. The function was calling dst.String() and dst.WriteString() inside a loop on deep paths, causing quadratic complexity. The fix switches to index-based backtracking on a byte slice, delivering 23.65% faster simple path resolution and significantly steeper wins on deep paths. In parallel, encoding/xml.Decoder.unmarshal now properly enforces recursion depth limits [2]. Previously, the DecodeElement method bypassed the guard by hardcoding depth to 0, allowing malicious XML documents to bypass depth tracking through custom UnmarshalXML implementations. The fix maintains depth as a stack value adjusted when elements push and pop, eliminating the bypass vector entirely. On the developer tooling front, gopls picked up assembly file support with DocumentHighlight for label scoping [5], while the build team automated stale watchflakes cleanup to keep issue trackers fresh [4]. The http2 implementation also cut memory overhead by building HPACK table lookup maps lazily only for encoders, not decoders [3], a meaningful optimization for servers with idle connections.

$ ls golang/reviews/ # the step-back reads

the week in review Go 1.27.1 lands as plan9 early export disabled the month in review Go compiler hardens binaries, crypto tightens SSH safety
Topics: Go Infrastructure Full archive → Weekly reviews →

Quick answers

What shipped in Go on July 30, 2026?
The core library shipped two security-relevant fixes overnight that eliminate algorithmic vulnerabilities in URL resolution and XML decoding that could be exploited to cause denial of service. In total, 11 commits landed.
Who contributed to Go on July 30, 2026?
9 developers shipped this update, including Ian Alexander, Mark Freeman, Filippo Valsorda, Cherry Mui, Brad Fitzpatrick, Hana Kim, Peter Weinberger, and Groot Guo, and 1 more.
What were the notable Go updates?
net/url: avoid quadratic complexity in resolvePath, encoding/xml: fix depth processing in (*Decoder).unmarshal, and http2/hpack: build the table lookup maps lazily, only for encoders.
♥

$ log @golang --recent

Salsa20 gets a loong64 SIMD path 1 shipped LoongArch crypto gets SIMD, RISC-V bit tests slim down 9 shipped Go's QUIC stack learns to tell on-path from off-path, and amd64 gets v2/v3/v4 CPU bits 19 shipped pkgsite drops ctxhttp, tour returns real 404s 7 shipped

$ log --all # elsewhere on the wire

@open-webui Open WebUI 0.11.4 ships a slim image 89% smaller FastAPI & Pydantic SQLModel narrows SQLAlchemy type handling in Field, drops dataclass_transform shim

$ ls showcases/

Rails Django Laravel Node.js Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.