RepoJournal
Go @golang
118 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-08-04
stories 30
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

SSH WINDOW CREDIT BUG COULD STALL CHANNELS; COMPILER REFACTORING SPLITS SSA PACKAGE

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

Michael Matloob cuishuang Nicola Murino Julian Zhu Nick Ripley dorbmon Jonathan Amsterdam
9 people shipped this
Michael Matloob @matloob 2 cited cuishuang @cuishuang 2 cited Nicola Murino @drakkan 1 cited Julian Zhu @HeliC829 1 cited Nick Ripley @nsrip-dd 1 cited dorbmon @Dorbmon 1 cited Jonathan Amsterdam @jba Ethan Lee @ethanalee-work racequite @racequite

Go's SSH implementation leaks window credits on discarded extended data, potentially freezing channels, while the compiler team restructures its core SSA package to improve modularity.

The SSH window credit bug [1] is the critical fix: handleData subtracts packet lengths from the receive window but silently discards extended data with unknown type codes without returning credits, allowing a peer to permanently shrink the channel window down to a complete stall. Applications using golang.org/x/crypto/ssh for channel operations should review affected code paths. On the compiler front, Michael Matloob landed two foundational changes [2] [3] preparing to split ssa.Compile into a separate package (issue golang/go#80409), removing the Func type's dependency on HTMLWriter and adding test helpers that run SSA passes without full compilation. Poly1305 assembly optimization for RISC-V64 [4] delivers 26-48% speedups across key sizes, with the 2M benchmark dropping from 3.6ms to 1.9ms. Cleanup work across the standard library continues: net/rpc removed obsolete sort.Interface methods [5] after switching to slices.SortFunc, and bytes/strings dropped redundant DecodeRune fast paths [6] that became redundant when utf8.DecodeRune itself became inlineable. Runtime stack frame pointer handling around injected calls [7] has been corrected to prevent corruption during asynchronous preemption and sigpanic scenarios.

Action items

References

  1. [1] ssh: return window credit for discarded extended data ↗ golang/crypto
  2. [2] cmd/compile/internal/ssa: remove HTMLWriter from Func ↗ golang/go
  3. [3] cmd/compile/internal/ssa: remove test dependence on Compile ↗ golang/go
  4. [4] crypto/internal/poly1305: provide optimised assembly for riscv64 ↗ golang/crypto
  5. [5] net/rpc: remove unused sort.Interface methods ↗ golang/go
  6. [6] bytes, strings: remove redundant DecodeRune fast paths ↗ golang/go
  7. [7] runtime: fix frame pointer adjustment around injected calls ↗ golang/go
  8. [8] cmd/present: fix obsolete flag in security warning ↗ golang/tools

$ ls golang/reviews/ # the step-back reads

the week in review Go 1.27.1 lands as plan9 early export disabled the month in review Go compiler hardens binaries, crypto tightens SSH safety
Topics: Go Infrastructure Full archive → Weekly reviews →

Quick answers

What shipped in Go on August 4, 2026?
Go's SSH implementation leaks window credits on discarded extended data, potentially freezing channels, while the compiler team restructures its core SSA package to improve modularity. In total, 30 commits landed.
Who contributed to Go on August 4, 2026?
9 developers shipped this update, including Nicola Murino, Julian Zhu, Nick Ripley, Michael Matloob, cuishuang, dorbmon, Jonathan Amsterdam, and Ethan Lee, and 1 more.
What were the notable Go updates?
ssh: return window credit for discarded extended data, cmd/compile/internal/ssa: remove HTMLWriter from Func, and cmd/compile/internal/ssa: remove test dependence on Compile.
♥

$ log @golang --recent

Salsa20 gets a loong64 SIMD path 1 shipped LoongArch crypto gets SIMD, RISC-V bit tests slim down 9 shipped Go's QUIC stack learns to tell on-path from off-path, and amd64 gets v2/v3/v4 CPU bits 19 shipped pkgsite drops ctxhttp, tour returns real 404s 7 shipped

$ log --all # elsewhere on the wire

@open-webui Open WebUI 0.11.4 ships a slim image 89% smaller FastAPI & Pydantic SQLModel narrows SQLAlchemy type handling in Field, drops dataclass_transform shim

$ ls showcases/

Rails Django Laravel Node.js Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.