Who contributed to Go on August 6, 2026?

4 developers shipped this update, including Neal Patel, Brad Fitzpatrick, Jonathan Amsterdam, and Ian Alexander.

What were the notable Go updates?

html/template: fix JavaScript regexp tracking, net/http/internal/http2: let Transport's request-write goroutine exit early, and encoding/json/v2: modify documentation.

@golang

Go and the standard library - backend infrastructure at scale

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

GO PATCHES TEMPLATE INJECTION FLAW, HTTP/2 GOROUTINE LEAK

By RepoJournal · Filed 06:56 UTC on August 6, 2026 · About Go

4 people shipped this

Neal Patel @thatnealpatel 1 cited

Brad Fitzpatrick @bradfitz 1 cited

Jonathan Amsterdam @jba 1 cited

Ian Alexander @jitsu-net 1 cited

Go shipped a security fix for html/template that blocks JavaScript regexp injection attacks, while simultaneously addressing a goroutine accumulation bug in HTTP/2 transports that could exhaust memory on long-lived connections.

The template injection fix [1] prevents attackers from closing unescaped forward slashes early, a pathological input that previously allowed arbitrary content injection. This tracks the invariant first hinted at in related work [3]. Separately, Brad Fitzpatrick landed a critical fix [2] that lets HTTP/2 Transport request-write goroutines exit immediately after sending the request, rather than parking until stream end. For clients with many concurrent long-lived response streams like event subscriptions or long polls, that fix eliminates a parked goroutine and its stack per stream. The golang/text team also patched a buffer overflow in the PRECIS Nickname profile [4], which was writing interior spaces without checking destination capacity first, now properly returning ErrShortDst on overflow. Across both repos, 4 commits landed overnight addressing memory efficiency and injection hardening.

Action items

→ Update Go immediately for CVE-2026-56858 template injection fix golang/go [immediate]
→ Redeploy services with long-lived HTTP/2 streams to capture goroutine leak fix golang/go [plan]
→ Test text/precis Nickname profile handling with short buffers if in use golang/text [monitor]

References

[1] html/template: fix JavaScript regexp tracking golang/go
[2] net/http/internal/http2: let Transport's request-write goroutine exit early golang/go
[3] encoding/json/v2: modify documentation golang/go
[4] secure/precis: fix short destination buffer handling in Nickname profile golang/text

Quick answers

What shipped in Go on August 6, 2026?: Go shipped a security fix for html/template that blocks JavaScript regexp injection attacks, while simultaneously addressing a goroutine accumulation bug in HTTP/2 transports that could exhaust memory on long-lived connections. In total, 4 commits landed.
Who contributed to Go on August 6, 2026?: 4 developers shipped this update, including Neal Patel, Brad Fitzpatrick, Jonathan Amsterdam, and Ian Alexander.
What were the notable Go updates?: html/template: fix JavaScript regexp tracking, net/http/internal/http2: let Transport's request-write goroutine exit early, and encoding/json/v2: modify documentation.

GO FIXES BREAKING ABI REGRESSION AND LOCKS DOWN REVERSE PROXY COOKIE HANDLING

Go shipped a critical fix for an x86 ABI0 NOFRAME regression that broke existing code, while explicitly documenting that ReverseProxy does not sanitize forwarded cookies.

go 20 shipped

@golang Aug 4

SSH WINDOW CREDIT BUG COULD STALL CHANNELS; COMPILER REFACTORING SPLITS SSA PACKAGE

Go's SSH implementation leaks window credits on discarded extended data, potentially freezing channels, while the compiler team restructures its core SSA package to improve modularity.

go 30 shipped

@golang Aug 3

GO COMPILER TIGHTENS RANGE-CLEAR SAFETY CHECKS

The Go compiler just blocked a subtle optimization that could corrupt memory when loop variables depend on cleared values.

go 2 shipped

@golang Aug 1

GO COMPILER FIXES MIPS64 POINTER BUGS, SHRINKS BINARIES ON AMD64

Brad Fitzpatrick landed a stack object alignment fix that uncovers and fixes a latent mips64le pointer offset bug while accidentally making amd64 and arm64 binaries smaller.

go 11 shipped

Elsewhere on the wire

AI Agents Aug 6

LANGCHAIN HARDENS ANTHROPIC TOOL CALLING AND GIT CREDENTIALS AS OPENHANDS SHIPS 1.10.0

LangChain fixed a critical credential leak in evaluation runs while Anthropic tool schemas get proper fallback handling, as three major agent frameworks push releases across the ecosystem.

ai-agents 54 shipped

Local LLMs Aug 6

OLLAMA FIXES KV CACHE CORRUPTION, LLAMA.CPP HARDENS FILE SEARCH, VLLM KILLS MOE LEGACY CODE

Ollama patched a critical cache corruption bug that corrupts lazy snapshots during multi-request prefills, while llama.cpp hardened Windows junction traversal and vLLM removed 14 hardcoded MoE shards across quantization methods.