Who contributed to Go on August 4, 2026?

9 developers shipped this update, including Nicola Murino, Julian Zhu, Nick Ripley, Michael Matloob, cuishuang, dorbmon, Jonathan Amsterdam, and Ethan Lee, and 1 more.

What were the notable Go updates?

ssh: return window credit for discarded extended data, cmd/compile/internal/ssa: remove HTMLWriter from Func, and cmd/compile/internal/ssa: remove test dependence on Compile.

@golang

Go and the standard library - backend infrastructure at scale

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

SSH WINDOW CREDIT BUG COULD STALL CHANNELS; COMPILER REFACTORING SPLITS SSA PACKAGE

By RepoJournal · Filed 06:56 UTC on August 4, 2026 · About Go

9 people shipped this

Michael Matloob @matloob 2 cited

cuishuang @cuishuang 2 cited

Nicola Murino @drakkan 1 cited

Julian Zhu @HeliC829 1 cited

Nick Ripley @nsrip-dd 1 cited

dorbmon @Dorbmon 1 cited

Jonathan Amsterdam @jba

Ethan Lee @ethanalee-work

racequite @racequite

Go's SSH implementation leaks window credits on discarded extended data, potentially freezing channels, while the compiler team restructures its core SSA package to improve modularity.

The SSH window credit bug [1] is the critical fix: handleData subtracts packet lengths from the receive window but silently discards extended data with unknown type codes without returning credits, allowing a peer to permanently shrink the channel window down to a complete stall. Applications using golang.org/x/crypto/ssh for channel operations should review affected code paths. On the compiler front, Michael Matloob landed two foundational changes [2] [3] preparing to split ssa.Compile into a separate package (issue golang/go#80409), removing the Func type's dependency on HTMLWriter and adding test helpers that run SSA passes without full compilation. Poly1305 assembly optimization for RISC-V64 [4] delivers 26-48% speedups across key sizes, with the 2M benchmark dropping from 3.6ms to 1.9ms. Cleanup work across the standard library continues: net/rpc removed obsolete sort.Interface methods [5] after switching to slices.SortFunc, and bytes/strings dropped redundant DecodeRune fast paths [6] that became redundant when utf8.DecodeRune itself became inlineable. Runtime stack frame pointer handling around injected calls [7] has been corrected to prevent corruption during asynchronous preemption and sigpanic scenarios.

Action items

→ Review SSH channel usage if you receive extended data with non-standard type codes golang/crypto [plan]
→ Monitor golang/go#80409 for SSA package split timeline and API changes golang/go [monitor]
→ Update to RISC-V64 builds with Poly1305 assembly for crypto performance gains golang/crypto [plan]
→ Check golang/tools for present security flag updates if running local code golang/tools [monitor]

References

[1] ssh: return window credit for discarded extended data golang/crypto
[2] cmd/compile/internal/ssa: remove HTMLWriter from Func golang/go
[3] cmd/compile/internal/ssa: remove test dependence on Compile golang/go
[4] crypto/internal/poly1305: provide optimised assembly for riscv64 golang/crypto
[5] net/rpc: remove unused sort.Interface methods golang/go
[6] bytes, strings: remove redundant DecodeRune fast paths golang/go
[7] runtime: fix frame pointer adjustment around injected calls golang/go
[8] cmd/present: fix obsolete flag in security warning golang/tools

Quick answers

What shipped in Go on August 4, 2026?: Go's SSH implementation leaks window credits on discarded extended data, potentially freezing channels, while the compiler team restructures its core SSA package to improve modularity. In total, 30 commits landed.
Who contributed to Go on August 4, 2026?: 9 developers shipped this update, including Nicola Murino, Julian Zhu, Nick Ripley, Michael Matloob, cuishuang, dorbmon, Jonathan Amsterdam, and Ethan Lee, and 1 more.
What were the notable Go updates?: ssh: return window credit for discarded extended data, cmd/compile/internal/ssa: remove HTMLWriter from Func, and cmd/compile/internal/ssa: remove test dependence on Compile.

GO PATCHES TEMPLATE INJECTION FLAW, HTTP/2 GOROUTINE LEAK

Go shipped a security fix for html/template that blocks JavaScript regexp injection attacks, while simultaneously addressing a goroutine accumulation bug in HTTP/2 transports that could exhaust memory on long-lived connections.

go 4 shipped

@golang Aug 5

GO FIXES BREAKING ABI REGRESSION AND LOCKS DOWN REVERSE PROXY COOKIE HANDLING

Go shipped a critical fix for an x86 ABI0 NOFRAME regression that broke existing code, while explicitly documenting that ReverseProxy does not sanitize forwarded cookies.

go 20 shipped

@golang Aug 3

GO COMPILER TIGHTENS RANGE-CLEAR SAFETY CHECKS

The Go compiler just blocked a subtle optimization that could corrupt memory when loop variables depend on cleared values.

go 2 shipped

@golang Aug 1

GO COMPILER FIXES MIPS64 POINTER BUGS, SHRINKS BINARIES ON AMD64

Brad Fitzpatrick landed a stack object alignment fix that uncovers and fixes a latent mips64le pointer offset bug while accidentally making amd64 and arm64 binaries smaller.

go 11 shipped

Elsewhere on the wire

AI Agents Aug 6

LANGCHAIN HARDENS ANTHROPIC TOOL CALLING AND GIT CREDENTIALS AS OPENHANDS SHIPS 1.10.0

LangChain fixed a critical credential leak in evaluation runs while Anthropic tool schemas get proper fallback handling, as three major agent frameworks push releases across the ecosystem.

ai-agents 54 shipped

Local LLMs Aug 6

OLLAMA FIXES KV CACHE CORRUPTION, LLAMA.CPP HARDENS FILE SEARCH, VLLM KILLS MOE LEGACY CODE

Ollama patched a critical cache corruption bug that corrupts lazy snapshots during multi-request prefills, while llama.cpp hardened Windows junction traversal and vLLM removed 14 hardcoded MoE shards across quantization methods.