RepoJournal
Go @golang
118 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-08-05
stories 20
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

GO FIXES BREAKING ABI REGRESSION AND LOCKS DOWN REVERSE PROXY COOKIE HANDLING

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

Damien Neil Jorropo Cherry Mui XiaolinZhao Peter Weinberger Jonathan Amsterdam Carlos Amedee
10 people shipped this
Damien Neil @neild 1 cited Jorropo @Jorropo 1 cited Cherry Mui @cherrymui 1 cited XiaolinZhao @sophie-zhao 1 cited Peter Weinberger @pjweinbgo 1 cited Jonathan Amsterdam @jba Carlos Amedee @cagedmantis Hongxiang Jiang @h9jiang Nicholas S. Husin @nicholashusin Gopher Robot @gopherbot

Go shipped a critical fix for an x86 ABI0 NOFRAME regression that broke existing code, while explicitly documenting that ReverseProxy does not sanitize forwarded cookies.

The x86 toolchain broke ABI0 NOFRAME functions by removing BP as a scratch register, causing failures in production builds [1]. That fix restores BP indirection and closes two open issues. In parallel, the core Go team documented a long-standing security gotcha: ReverseProxy does not sanitize or filter Cookie headers when proxying requests, which means cookies from upstream services flow directly to clients without filtering [2]. This is not a new vulnerability but an explicit documentation push to prevent misuse. The runtime/cgo layer added back indirection to C function calls after a recent refactor caused text segment relocations that broke c-shared builds on Linux [3]. On the tools side, gopls fixed unsafe package resolution in definition lookup [5], ensuring the correct unsafe package is referenced across different build systems. Meanwhile, LoongArch support gained two new bitsel vector instructions for the instruction set [4].

$ ls golang/reviews/ # the step-back reads

the week in review Go 1.27.1 lands as plan9 early export disabled the month in review Go compiler hardens binaries, crypto tightens SSH safety
Topics: Go Infrastructure Full archive → Weekly reviews →

Quick answers

What shipped in Go on August 5, 2026?
Go shipped a critical fix for an x86 ABI0 NOFRAME regression that broke existing code, while explicitly documenting that ReverseProxy does not sanitize forwarded cookies. In total, 20 commits landed.
Who contributed to Go on August 5, 2026?
10 developers shipped this update, including Damien Neil, Jorropo, Jonathan Amsterdam, Cherry Mui, XiaolinZhao, Carlos Amedee, Hongxiang Jiang, and Nicholas S. Husin, and 2 more.
What were the notable Go updates?
cmd/internal/obj/x86: fix breaking change in ABI0 NOFRAME BP expectations, net/http/httputil: document ReverseProxy cookie security considerations, and runtime/cgo: add back indirections to C functions.
♥

$ log @golang --recent

Salsa20 gets a loong64 SIMD path 1 shipped LoongArch crypto gets SIMD, RISC-V bit tests slim down 9 shipped Go's QUIC stack learns to tell on-path from off-path, and amd64 gets v2/v3/v4 CPU bits 19 shipped pkgsite drops ctxhttp, tour returns real 404s 7 shipped

$ log --all # elsewhere on the wire

FastAPI & Pydantic SQLModel narrows SQLAlchemy type handling in Field, drops dataclass_transform shim Shopify Shopify CLI recovers from storage permission errors and versions in JSON

$ ls showcases/

Rails Django Laravel Node.js Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.