Who contributed to Go on August 5, 2026?

10 developers shipped this update, including Damien Neil, Jorropo, Jonathan Amsterdam, Cherry Mui, XiaolinZhao, Carlos Amedee, Hongxiang Jiang, and Nicholas S. Husin, and 2 more.

What were the notable Go updates?

cmd/internal/obj/x86: fix breaking change in ABI0 NOFRAME BP expectations, net/http/httputil: document ReverseProxy cookie security considerations, and runtime/cgo: add back indirections to C functions.

@golang

Go and the standard library - backend infrastructure at scale

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

GO FIXES BREAKING ABI REGRESSION AND LOCKS DOWN REVERSE PROXY COOKIE HANDLING

By RepoJournal · Filed 06:56 UTC on August 5, 2026 · About Go

10 people shipped this

Damien Neil @neild 1 cited

Jorropo @Jorropo 1 cited

Cherry Mui @cherrymui 1 cited

XiaolinZhao @sophie-zhao 1 cited

Peter Weinberger @pjweinbgo 1 cited

Jonathan Amsterdam @jba

Carlos Amedee @cagedmantis

Hongxiang Jiang @h9jiang

Nicholas S. Husin @nicholashusin

Gopher Robot @gopherbot

Go shipped a critical fix for an x86 ABI0 NOFRAME regression that broke existing code, while explicitly documenting that ReverseProxy does not sanitize forwarded cookies.

The x86 toolchain broke ABI0 NOFRAME functions by removing BP as a scratch register, causing failures in production builds [1]. That fix restores BP indirection and closes two open issues. In parallel, the core Go team documented a long-standing security gotcha: ReverseProxy does not sanitize or filter Cookie headers when proxying requests, which means cookies from upstream services flow directly to clients without filtering [2]. This is not a new vulnerability but an explicit documentation push to prevent misuse. The runtime/cgo layer added back indirection to C function calls after a recent refactor caused text segment relocations that broke c-shared builds on Linux [3]. On the tools side, gopls fixed unsafe package resolution in definition lookup [5], ensuring the correct unsafe package is referenced across different build systems. Meanwhile, LoongArch support gained two new bitsel vector instructions for the instruction set [4].

Action items

→ Test your x86 ABI0 NOFRAME builds immediately if you hit #80710 or #80709 golang/go [immediate]
→ Review ReverseProxy usage in your HTTP middleware and explicitly filter cookies if needed golang/go [plan]
→ Update gopls to pick up unsafe package resolution fix if you work across multiple build systems golang/tools [plan]

References

[1] cmd/internal/obj/x86: fix breaking change in ABI0 NOFRAME BP expectations golang/go
[2] net/http/httputil: document ReverseProxy cookie security considerations golang/go
[3] runtime/cgo: add back indirections to C functions golang/go
[4] cmd/internal/obj/loong64: add [X]VBITSELV and [X]VBITSELB instructions support golang/go
[5] gopls/internal/golang/definition: find the right unsafe golang/tools

Quick answers

What shipped in Go on August 5, 2026?: Go shipped a critical fix for an x86 ABI0 NOFRAME regression that broke existing code, while explicitly documenting that ReverseProxy does not sanitize forwarded cookies. In total, 20 commits landed.
Who contributed to Go on August 5, 2026?: 10 developers shipped this update, including Damien Neil, Jorropo, Jonathan Amsterdam, Cherry Mui, XiaolinZhao, Carlos Amedee, Hongxiang Jiang, and Nicholas S. Husin, and 2 more.
What were the notable Go updates?: cmd/internal/obj/x86: fix breaking change in ABI0 NOFRAME BP expectations, net/http/httputil: document ReverseProxy cookie security considerations, and runtime/cgo: add back indirections to C functions.

GO PATCHES TEMPLATE INJECTION FLAW, HTTP/2 GOROUTINE LEAK

Go shipped a security fix for html/template that blocks JavaScript regexp injection attacks, while simultaneously addressing a goroutine accumulation bug in HTTP/2 transports that could exhaust memory on long-lived connections.

go 4 shipped

@golang Aug 4

SSH WINDOW CREDIT BUG COULD STALL CHANNELS; COMPILER REFACTORING SPLITS SSA PACKAGE

Go's SSH implementation leaks window credits on discarded extended data, potentially freezing channels, while the compiler team restructures its core SSA package to improve modularity.

go 30 shipped

@golang Aug 3

GO COMPILER TIGHTENS RANGE-CLEAR SAFETY CHECKS

The Go compiler just blocked a subtle optimization that could corrupt memory when loop variables depend on cleared values.

go 2 shipped

@golang Aug 1

GO COMPILER FIXES MIPS64 POINTER BUGS, SHRINKS BINARIES ON AMD64

Brad Fitzpatrick landed a stack object alignment fix that uncovers and fixes a latent mips64le pointer offset bug while accidentally making amd64 and arm64 binaries smaller.

go 11 shipped

Elsewhere on the wire

AI Agents Aug 6

LANGCHAIN HARDENS ANTHROPIC TOOL CALLING AND GIT CREDENTIALS AS OPENHANDS SHIPS 1.10.0

LangChain fixed a critical credential leak in evaluation runs while Anthropic tool schemas get proper fallback handling, as three major agent frameworks push releases across the ecosystem.

ai-agents 54 shipped

Local LLMs Aug 6

OLLAMA FIXES KV CACHE CORRUPTION, LLAMA.CPP HARDENS FILE SEARCH, VLLM KILLS MOE LEGACY CODE

Ollama patched a critical cache corruption bug that corrupts lazy snapshots during multi-request prefills, while llama.cpp hardened Windows junction traversal and vLLM removed 14 hardcoded MoE shards across quantization methods.