Who contributed to Go on August 12, 2026?

11 developers shipped this update, including cuishuang, Ilya Torbin, Michael Pratt, Michael Matloob, Guoqi Chen, Damien Neil, Gopher Robot, and Neal Patel, and 3 more.

What were the notable Go updates?

cmd/go: match GOAUTH credentials for URLs with queries, cmd/compile/internal/liveness: use built-in min and max functions, and encoding/json/v2: remove cycle detection guarantee.

@golang

Go and the standard library - backend infrastructure at scale

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

GO AUTH CREDENTIALS FIXED, JSON V2 DROPS CYCLE GUARANTEE

By RepoJournal · Filed 06:56 UTC on August 12, 2026 · About Go

11 people shipped this

cuishuang @cuishuang 1 cited

Ilya Torbin @bontail 1 cited

Michael Pratt @prattmic 1 cited

Michael Matloob @matloob 1 cited

Damien Neil @neild 1 cited

Neal Patel @thatnealpatel 1 cited

Keith Randall @randall77 1 cited

Guoqi Chen @abner-chenc

Gopher Robot @gopherbot

Ian Alexander @jitsu-net

Sanghyuk Jung @benelog

A URL query parsing bug in cmd/go's credential matching gets fixed [ref:1], while the JSON encoder removes its cycle detection guarantee in v2 [ref:3].

The most critical change lands in cmd/go, where loadCredential now properly parses URLs before matching auth credentials [1]. Previously, requests to example.com/api?version=1 were skipped entirely because the query string was stripped during path hierarchy walks. The compiler also cleans up legacy workarounds by using Go 1.21's built-in min and max functions instead of custom helpers [2], dropping support for older bootstrap toolchains. On the JSON front, encoding/json/v2 removes its guarantee that cyclic inputs cause an error, giving the team flexibility to potentially optimize cycle detection later without breaking v2 contracts [3]. The build system gets leaner too, with cmd/go/internal/work dropping the now-redundant check cache action [4], which was only needed to signal cover and cgo whether to run. The tooling team documents that the present package assumes presentation authors are trusted and lacks security hardening [6], preventing surprises for users deploying it in untrusted environments. Across vulndb, five new vulnerability reports land alongside a test timeout reduction from 20 minutes to 10 minutes [5], and NetBSD users get a critical fix disabling AVX+ registers on amd64 due to signal handler corruption [7].

Action items

→ Review cmd/go credential matching changes if you use GOAUTH for private module fetching golang/go [plan]
→ Plan JSON v2 migration if you rely on cycle detection guarantees golang/go [monitor]
→ Disable present package in untrusted environments or audit for injection risks golang/tools [plan]

References

[1] cmd/go: match GOAUTH credentials for URLs with queries golang/go
[2] cmd/compile/internal/liveness: use built-in min and max functions golang/go
[3] encoding/json/v2: remove cycle detection guarantee golang/go
[4] cmd/go/internal/work: remove check cache action golang/go
[5] all: cut test timeout from 20m -> 10m golang/vulndb
[6] present, cmd/present, cmd/present2md: document lack of security hardening golang/tools
[7] cpu: disable AVX+ on netbsd/amd64 golang/sys

Quick answers

What shipped in Go on August 12, 2026?: A URL query parsing bug in cmd/go's credential matching gets fixed [ref:1], while the JSON encoder removes its cycle detection guarantee in v2 [ref:3]. In total, 39 commits landed.
Who contributed to Go on August 12, 2026?: 11 developers shipped this update, including cuishuang, Ilya Torbin, Michael Pratt, Michael Matloob, Guoqi Chen, Damien Neil, Gopher Robot, and Neal Patel, and 3 more.
What were the notable Go updates?: cmd/go: match GOAUTH credentials for URLs with queries, cmd/compile/internal/liveness: use built-in min and max functions, and encoding/json/v2: remove cycle detection guarantee.

GO COMMAND GETS PARALLEL TEST PARSING, COMPILER OPTIMIZATIONS CUT BINARY SIZE BY 10K INSTRUCTIONS

The Go team shipped three heavyweight optimizations overnight that speed up module loading for gopls and shrink binaries across every platform.

go 19 shipped

@golang Aug 11

GO 1.26 MINIMUM BOOTSTRAP UNLOCKS NETBSD SIMPLIFICATION

The Go compiler is shedding version-dependent code paths now that Go 1.26 is the floor, and pkgsite is building infrastructure to detect breaking changes across the ecosystem.

go 31 shipped

@golang Aug 9

GO COMPRESSES RISCV RETURNS, SHAVES 2,700 INSTRUCTIONS

The Go compiler just cut another 2,700 instructions from binaries on linux/riscv64 by compressing bare function returns.

go 2 shipped

@golang Aug 8

VSCODE-GO TIGHTENS LINTING, REVIVE JUMPS 11 VERSIONS

The Go extension for VS Code is enforcing stricter TypeScript rules across the codebase while shipping a major update to its revive linter.

go 6 shipped

Elsewhere on the wire

AI Agents Aug 13

ANTHROPIC INTEGRATION FIXES TOOL BLOCKS, OPENHANDS UNBLOCKS CI, CLINE PATCHES COMPOSER WEDGE

LangChain's Anthropic integration corrected tool result handling and model profiles [ref:1], while OpenHands fixed a critical test infrastructure failure blocking all PRs and shipped 1.13.0 with conversation archives [ref:6][ref:9].