$ the-wire · showcase
GO AUTH CREDENTIALS FIXED, JSON V2 DROPS CYCLE GUARANTEE
By RepoJournal · Filed · About Go · Composed from the cited sources · methodology
11 people shipped this
cuishuang
@cuishuang
1 cited
Ilya Torbin
@bontail
1 cited
Michael Pratt
@prattmic
1 cited
Michael Matloob
@matloob
1 cited
Damien Neil
@neild
1 cited
Neal Patel
@thatnealpatel
1 cited
Keith Randall
@randall77
1 cited
Guoqi Chen
@abner-chenc
Gopher Robot
@gopherbot
Ian Alexander
@jitsu-net
Sanghyuk Jung
@benelog
A URL query parsing bug in cmd/go's credential matching gets fixed [ref:1], while the JSON encoder removes its cycle detection guarantee in v2 [ref:3].
The most critical change lands in cmd/go, where loadCredential now properly parses URLs before matching auth credentials [1]. Previously, requests to example.com/api?version=1 were skipped entirely because the query string was stripped during path hierarchy walks. The compiler also cleans up legacy workarounds by using Go 1.21's built-in min and max functions instead of custom helpers [2], dropping support for older bootstrap toolchains. On the JSON front, encoding/json/v2 removes its guarantee that cyclic inputs cause an error, giving the team flexibility to potentially optimize cycle detection later without breaking v2 contracts [3]. The build system gets leaner too, with cmd/go/internal/work dropping the now-redundant check cache action [4], which was only needed to signal cover and cgo whether to run. The tooling team documents that the present package assumes presentation authors are trusted and lacks security hardening [6], preventing surprises for users deploying it in untrusted environments. Across vulndb, five new vulnerability reports land alongside a test timeout reduction from 20 minutes to 10 minutes [5], and NetBSD users get a critical fix disabling AVX+ registers on amd64 due to signal handler corruption [7].
Action items
- → Review cmd/go credential matching changes if you use GOAUTH for private module fetching golang/go [plan]
- → Plan JSON v2 migration if you rely on cycle detection guarantees golang/go [monitor]
- → Disable present package in untrusted environments or audit for injection risks golang/tools [plan]
References
- [1] cmd/go: match GOAUTH credentials for URLs with queries ↗ golang/go
- [2] cmd/compile/internal/liveness: use built-in min and max functions ↗ golang/go
- [3] encoding/json/v2: remove cycle detection guarantee ↗ golang/go
- [4] cmd/go/internal/work: remove check cache action ↗ golang/go
- [5] all: cut test timeout from 20m -> 10m ↗ golang/vulndb
- [6] present, cmd/present, cmd/present2md: document lack of security hardening ↗ golang/tools
- [7] cpu: disable AVX+ on netbsd/amd64 ↗ golang/sys
