RepoJournal
Go @golang
127 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-08-14
stories 22
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

GO PATCHES TWO CRITICAL SUMDB VULNERABILITIES OVERNIGHT

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

Gopher Robot Dmitri Shuralyov Ian Alexander Michael Pratt Neal Patel Roland Shoemaker Filippo Valsorda
10 people shipped this
Gopher Robot @gopherbot 5 cited Dmitri Shuralyov @dmitshur 1 cited Ian Alexander @jitsu-net 1 cited Michael Pratt @prattmic 1 cited Neal Patel @thatnealpatel 1 cited Roland Shoemaker @rolandshoemaker 1 cited Filippo Valsorda @FiloSottile 1 cited Carlos Amedee @cagedmantis Jonathan Amsterdam @jba Brad Moylan @bmoylan

The core team pulled in emergency fixes for authentication bypasses in module sum verification that could let attackers inject malicious hashes into the dependency chain.

golang/go updated its vendored x/mod to include two critical fixes: a TileHashReader authentication bypass in sumdb/tlog [1] and a hash validation gap in sumdb Lookup [1] that together address CVE-2026-56864 and CVE-2026-56865. The same fixes landed upstream in golang/mod [7] [8], where Filippo Valsorda fixed a deduplication logic flaw that could skip authentication of certain tiles entirely. In parallel, encoding/asn1 now enforces a maximum recursion depth to prevent stack exhaustion on deeply nested structures [2], closing CVE-2026-33818. The vulndb team added release reports for go1.25.13, go1.26.6, and go1.27rc3 [5], signaling patch versions are rolling. Tools updated its stdlib index for 1.27rc3 [10], and a lingering pseudo-version bug in go doc -http got fixed [3]. All five repos synced their x dependency graphs overnight [4] [6] [9] [11].

Action items

References

  1. [1] all: update vendored x/mod ↗ golang/go
  2. [2] encoding/asn1: enforce maximum recursion depth ↗ golang/go
  3. [3] cmd/go/internal/doc: fix pkgsite psuedo-version ↗ golang/go
  4. [4] go.mod: update golang.org/x dependencies ↗ golang/pkgsite
  5. [5] data/reports: add go1.25.13/go1.26.6/go1.27rc3 release reports ↗ golang/vulndb
  6. [6] go.mod: update golang.org/x dependencies ↗ golang/vulndb
  7. [7] sumdb: ignore unrelated hashes in Lookup ↗ golang/mod
  8. [8] sumdb/tlog: fix TileHashReader authentication bypass ↗ golang/mod
  9. [9] go.mod: update golang.org/x dependencies ↗ golang/mod
  10. [10] internal/stdlib: update stdlib index for Go 1.27 Release Candidate 3 ↗ golang/tools
  11. [11] go.mod: update golang.org/x dependencies ↗ golang/tools

$ ls golang/reviews/ # the step-back reads

the week in review Go strips malformed HTTP/2 headers, moves HTTP/3 into std the month in review Go inliner learns to fold recover calls
Topics: Go Infrastructure Full archive → Weekly reviews →

Quick answers

What shipped in Go on August 14, 2026?
The core team pulled in emergency fixes for authentication bypasses in module sum verification that could let attackers inject malicious hashes into the dependency chain. In total, 22 commits landed.
Who contributed to Go on August 14, 2026?
10 developers shipped this update, including Dmitri Shuralyov, Ian Alexander, Michael Pratt, Carlos Amedee, Gopher Robot, Jonathan Amsterdam, Neal Patel, and Roland Shoemaker, and 2 more.
What were the notable Go updates?
all: update vendored x/mod, encoding/asn1: enforce maximum recursion depth, and cmd/go/internal/doc: fix pkgsite psuedo-version.
♥

$ log @golang --recent

Windows thread stack corruption fix, json v1 field restored in Go 1.27 shim 35 shipped HTTP/2 framing header fix lands in x/net, compiler and PGO changes across Go 25 shipped Loong64 MOVW/MOVV immediate fix, Windows ad-hoc package errors 2 shipped Compiler gains mem2reg and stats passes 3 shipped

$ log --all # elsewhere on the wire

@openclaw openclaw 2026.9.7 hardens update rollback, and Peekaboo ships GPT-6.1 Sol Agentic Coding Enterprise permission defaults get teeth as Codex, Gemini CLI and Goose ship fixes

$ ls showcases/

Rails Django Laravel Node.js Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.