Who contributed to Go on August 14, 2026?

10 developers shipped this update, including Dmitri Shuralyov, Ian Alexander, Michael Pratt, Carlos Amedee, Gopher Robot, Jonathan Amsterdam, Neal Patel, and Roland Shoemaker, and 2 more.

What were the notable Go updates?

all: update vendored x/mod, encoding/asn1: enforce maximum recursion depth, and cmd/go/internal/doc: fix pkgsite psuedo-version.

@golang

Go and the standard library - backend infrastructure at scale

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

GO PATCHES TWO CRITICAL SUMDB VULNERABILITIES OVERNIGHT

By RepoJournal · Filed 06:56 UTC on August 14, 2026 · About Go

10 people shipped this

Gopher Robot @gopherbot 5 cited

Dmitri Shuralyov @dmitshur 1 cited

Ian Alexander @jitsu-net 1 cited

Michael Pratt @prattmic 1 cited

Neal Patel @thatnealpatel 1 cited

Roland Shoemaker @rolandshoemaker 1 cited

Filippo Valsorda @FiloSottile 1 cited

Carlos Amedee @cagedmantis

Jonathan Amsterdam @jba

Brad Moylan @bmoylan

The core team pulled in emergency fixes for authentication bypasses in module sum verification that could let attackers inject malicious hashes into the dependency chain.

golang/go updated its vendored x/mod to include two critical fixes: a TileHashReader authentication bypass in sumdb/tlog [1] and a hash validation gap in sumdb Lookup [1] that together address CVE-2026-56864 and CVE-2026-56865. The same fixes landed upstream in golang/mod [7] [8], where Filippo Valsorda fixed a deduplication logic flaw that could skip authentication of certain tiles entirely. In parallel, encoding/asn1 now enforces a maximum recursion depth to prevent stack exhaustion on deeply nested structures [2], closing CVE-2026-33818. The vulndb team added release reports for go1.25.13, go1.26.6, and go1.27rc3 [5], signaling patch versions are rolling. Tools updated its stdlib index for 1.27rc3 [10], and a lingering pseudo-version bug in go doc -http got fixed [3]. All five repos synced their x dependency graphs overnight [4] [6] [9] [11].

Action items

→ Rebuild binaries against latest golang/go to get sumdb fixes in place immediately golang/go [immediate]
→ If you run a module proxy or use go get with sum checking, verify your x/mod is at v0.39.1-0.20260813190000-57549bfb0d25 or later golang/mod [immediate]
→ Test ASN.1 parsing paths with recursive inputs before upgrading golang/go [plan]

References

[1] all: update vendored x/mod golang/go
[2] encoding/asn1: enforce maximum recursion depth golang/go
[3] cmd/go/internal/doc: fix pkgsite psuedo-version golang/go
[4] go.mod: update golang.org/x dependencies golang/pkgsite
[5] data/reports: add go1.25.13/go1.26.6/go1.27rc3 release reports golang/vulndb
[6] go.mod: update golang.org/x dependencies golang/vulndb
[7] sumdb: ignore unrelated hashes in Lookup golang/mod
[8] sumdb/tlog: fix TileHashReader authentication bypass golang/mod
[9] go.mod: update golang.org/x dependencies golang/mod
[10] internal/stdlib: update stdlib index for Go 1.27 Release Candidate 3 golang/tools
[11] go.mod: update golang.org/x dependencies golang/tools

Quick answers

What shipped in Go on August 14, 2026?: The core team pulled in emergency fixes for authentication bypasses in module sum verification that could let attackers inject malicious hashes into the dependency chain. In total, 22 commits landed.
Who contributed to Go on August 14, 2026?: 10 developers shipped this update, including Dmitri Shuralyov, Ian Alexander, Michael Pratt, Carlos Amedee, Gopher Robot, Jonathan Amsterdam, Neal Patel, and Roland Shoemaker, and 2 more.
What were the notable Go updates?: all: update vendored x/mod, encoding/asn1: enforce maximum recursion depth, and cmd/go/internal/doc: fix pkgsite psuedo-version.

GO STRIPS LEGACY CODE.GOOGLE.COM PATHS, HTTP/2 HOST HEADER FIX LANDS

The Go toolchain removed an unreachable staleness check dating to Google Code's 2016 shutdown, while the HTTP/2 implementation now correctly strips Host headers from request maps to match documented behavior.

go 23 shipped

@golang Aug 13

GO COMMAND GETS PARALLEL TEST PARSING, COMPILER OPTIMIZATIONS CUT BINARY SIZE BY 10K INSTRUCTIONS

The Go team shipped three heavyweight optimizations overnight that speed up module loading for gopls and shrink binaries across every platform.

go 19 shipped

@golang Aug 12

GO AUTH CREDENTIALS FIXED, JSON V2 DROPS CYCLE GUARANTEE

A URL query parsing bug in cmd/go's credential matching gets fixed [ref:1], while the JSON encoder removes its cycle detection guarantee in v2 [ref:3].

go 39 shipped

@golang Aug 11

GO 1.26 MINIMUM BOOTSTRAP UNLOCKS NETBSD SIMPLIFICATION

The Go compiler is shedding version-dependent code paths now that Go 1.26 is the floor, and pkgsite is building infrastructure to detect breaking changes across the ecosystem.

go 31 shipped

Elsewhere on the wire

AI Agents Aug 15

LANGCHAIN SHIPS ENCRYPTED REASONING FIX, CLINE ADDS WEB SEARCH AND VOICE

ChatOpenAI now preserves OpenAI's encrypted reasoning from streamed responses, while Cline releases three versions with provider-executed web search and microphone transcription.

ai-agents 55 shipped

Local LLMs Aug 15

QWEN3.8 LANDS IN OLLAMA WITH DEVELOPER INSTRUCTION SUPPORT

Ollama shipped full Qwen3.8 support overnight, adding reasoning-effort semantics and a critical fix for coding agents that send developer instructions before user messages.

+12

llms 208 shipped

@CachyOS Aug 15

FIRMWARE AND INIT SYNC LANDS AS AUTOS ROLL FORWARD

CachyOS synced linux-firmware with Arch and bumped mkinitcpio to 41.1-1, while the package automation pipeline keeps qview and qtscrcpy current across the AUR-derived repo.

infra 41 shipped

Elixir & Phoenix Aug 15

PHOENIX LIVE VIEW SHIPS UPLOAD OVERHAUL, ELIXIR TUNES CORE PERFORMANCE

SteffenDE landed five critical fixes for LiveView's upload handler in one sweep, while the Elixir core team optimized Version comparison and regex operations.