Who contributed to Go on July 31, 2026?

7 developers shipped this update, including Jorropo, Egon Elbre, Mauri de Souza Meneguzzo, Erik Staab, Daniel Morsing, cuishuang, and Jonathan Amsterdam.

What were the notable Go updates?

cmd/compile: do not elide riscv64 sign extension of unsigned values, cmd/compile/internal/ssa: complete ZeroUpper*Bits opcode coverage, and runtime: remove stackcheck from openbsd/riscv64.

@golang

Go and the standard library - backend infrastructure at scale

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

RISCV64 COMPILER BUG BREAKS UNSIGNED VALUE HANDLING

By RepoJournal · Filed 06:56 UTC on July 31, 2026 · About Go

7 people shipped this

cuishuang @cuishuang 3 cited

Jonathan Amsterdam @jba 2 cited

Jorropo @Jorropo 1 cited

Egon Elbre @egonelbre 1 cited

Mauri de Souza Meneguzzo @mauri870 1 cited

Erik Staab @erikus 1 cited

Daniel Morsing @DanielMorsing

Go's compiler is silently corrupting unsigned integer sign extensions on RISCV64, a critical correctness issue that requires immediate attention across the platform.

The riscv64 lowering rules remove sign extensions after 32-bit instructions, but regalloc restores spilled values with an extension chosen from their type: unsigned 4-byte values are restored zero-extended, losing the sign extension the rules removed [1]. This cascades across multiple fronts. The compiler is also missing opcode coverage in ZeroUpper32Bits, letting redundant zero-extensions slip through on amd64 and arm64 [2]. A separate OpenBSD/RISCV64 breakage from a recent stack check addition needs removal [3]. Beyond core compiler fixes, the release covers quality-of-life improvements: dark mode support for net/http directory listings [4], iOS version parsing that handles three-component versions like 13.1.1 [5], and test infrastructure cleanup across pkgsite [6], [7]. The present tool got two fixes for directive validation and documentation accuracy [8], [9]. 18 commits across 4 repos shipped in this period.

Action items

→ Test RISCV64 codegen immediately - unsigned value corruption is a silent data corruption risk golang/go [immediate]
→ If building for OpenBSD/RISCV64, apply the stackcheck removal before next deployment golang/go [immediate]
→ Monitor amd64 and arm64 builds for zero-extension regressions as ZeroUpper32Bits coverage improves golang/go [monitor]

References

[1] cmd/compile: do not elide riscv64 sign extension of unsigned values golang/go
[2] cmd/compile/internal/ssa: complete ZeroUpper*Bits opcode coverage golang/go
[3] runtime: remove stackcheck from openbsd/riscv64 golang/go
[4] net/http: support dark mode in dir listing golang/go
[5] cmd/gomobile: support three-component iOS versions golang/mobile
[6] internal/frontend: doc signal: clean up tests golang/pkgsite
[7] internal/frontend: doc signal: more test reorg golang/pkgsite
[8] present: validate background directive arguments golang/tools
[9] present: correct documented time for dates golang/tools

Quick answers

What shipped in Go on July 31, 2026?: Go's compiler is silently corrupting unsigned integer sign extensions on RISCV64, a critical correctness issue that requires immediate attention across the platform. In total, 18 commits landed.
Who contributed to Go on July 31, 2026?: 7 developers shipped this update, including Jorropo, Egon Elbre, Mauri de Souza Meneguzzo, Erik Staab, Daniel Morsing, cuishuang, and Jonathan Amsterdam.
What were the notable Go updates?: cmd/compile: do not elide riscv64 sign extension of unsigned values, cmd/compile/internal/ssa: complete ZeroUpper*Bits opcode coverage, and runtime: remove stackcheck from openbsd/riscv64.

GO PATCHES TEMPLATE INJECTION FLAW, HTTP/2 GOROUTINE LEAK

Go shipped a security fix for html/template that blocks JavaScript regexp injection attacks, while simultaneously addressing a goroutine accumulation bug in HTTP/2 transports that could exhaust memory on long-lived connections.

go 4 shipped

@golang Aug 5

GO FIXES BREAKING ABI REGRESSION AND LOCKS DOWN REVERSE PROXY COOKIE HANDLING

Go shipped a critical fix for an x86 ABI0 NOFRAME regression that broke existing code, while explicitly documenting that ReverseProxy does not sanitize forwarded cookies.

go 20 shipped

@golang Aug 4

SSH WINDOW CREDIT BUG COULD STALL CHANNELS; COMPILER REFACTORING SPLITS SSA PACKAGE

Go's SSH implementation leaks window credits on discarded extended data, potentially freezing channels, while the compiler team restructures its core SSA package to improve modularity.

go 30 shipped

@golang Aug 3

GO COMPILER TIGHTENS RANGE-CLEAR SAFETY CHECKS

The Go compiler just blocked a subtle optimization that could corrupt memory when loop variables depend on cleared values.

go 2 shipped

Elsewhere on the wire

AI Agents Aug 6

LANGCHAIN HARDENS ANTHROPIC TOOL CALLING AND GIT CREDENTIALS AS OPENHANDS SHIPS 1.10.0

LangChain fixed a critical credential leak in evaluation runs while Anthropic tool schemas get proper fallback handling, as three major agent frameworks push releases across the ecosystem.

ai-agents 54 shipped

Local LLMs Aug 6

OLLAMA FIXES KV CACHE CORRUPTION, LLAMA.CPP HARDENS FILE SEARCH, VLLM KILLS MOE LEGACY CODE

Ollama patched a critical cache corruption bug that corrupts lazy snapshots during multi-request prefills, while llama.cpp hardened Windows junction traversal and vLLM removed 14 hardcoded MoE shards across quantization methods.