RepoJournal
Go @golang
118 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-08-06
stories 4
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

GO PATCHES TEMPLATE INJECTION FLAW, HTTP/2 GOROUTINE LEAK

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

Neal Patel Brad Fitzpatrick Jonathan Amsterdam Ian Alexander
4 people shipped this
Neal Patel @thatnealpatel 1 cited Brad Fitzpatrick @bradfitz 1 cited Jonathan Amsterdam @jba 1 cited Ian Alexander @jitsu-net 1 cited

Go shipped a security fix for html/template that blocks JavaScript regexp injection attacks, while simultaneously addressing a goroutine accumulation bug in HTTP/2 transports that could exhaust memory on long-lived connections.

The template injection fix [1] prevents attackers from closing unescaped forward slashes early, a pathological input that previously allowed arbitrary content injection. This tracks the invariant first hinted at in related work [3]. Separately, Brad Fitzpatrick landed a critical fix [2] that lets HTTP/2 Transport request-write goroutines exit immediately after sending the request, rather than parking until stream end. For clients with many concurrent long-lived response streams like event subscriptions or long polls, that fix eliminates a parked goroutine and its stack per stream. The golang/text team also patched a buffer overflow in the PRECIS Nickname profile [4], which was writing interior spaces without checking destination capacity first, now properly returning ErrShortDst on overflow. Across both repos, 4 commits landed overnight addressing memory efficiency and injection hardening.

$ ls golang/reviews/ # the step-back reads

the week in review Go 1.27.1 lands as plan9 early export disabled the month in review Go compiler hardens binaries, crypto tightens SSH safety
Topics: Go Infrastructure Full archive → Weekly reviews →

Quick answers

What shipped in Go on August 6, 2026?
Go shipped a security fix for html/template that blocks JavaScript regexp injection attacks, while simultaneously addressing a goroutine accumulation bug in HTTP/2 transports that could exhaust memory on long-lived connections. In total, 4 commits landed.
Who contributed to Go on August 6, 2026?
4 developers shipped this update, including Neal Patel, Brad Fitzpatrick, Jonathan Amsterdam, and Ian Alexander.
What were the notable Go updates?
html/template: fix JavaScript regexp tracking, net/http/internal/http2: let Transport's request-write goroutine exit early, and encoding/json/v2: modify documentation.
♥

$ log @golang --recent

Salsa20 gets a loong64 SIMD path 1 shipped LoongArch crypto gets SIMD, RISC-V bit tests slim down 9 shipped Go's QUIC stack learns to tell on-path from off-path, and amd64 gets v2/v3/v4 CPU bits 19 shipped pkgsite drops ctxhttp, tour returns real 404s 7 shipped

$ log --all # elsewhere on the wire

@open-webui Open WebUI 0.11.4 ships a slim image 89% smaller FastAPI & Pydantic SQLModel narrows SQLAlchemy type handling in Field, drops dataclass_transform shim

$ ls showcases/

Rails Django Laravel Node.js Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.