$ the-wire · showcase
GOPLS FIXES AST POSITION BUG THAT BREAKS EDITS
By RepoJournal · Filed · About Go · Composed from the cited sources · methodology
10 people shipped this
Nicholas S. Husin
@nicholashusin
3 cited
Cuong Manh Le
@cuonglm
2 cited
Luka Perkov
@lperkov
1 cited
Jorropo
@Jorropo
1 cited
Hongxiang Jiang
@h9jiang
1 cited
Gopher Robot
@gopherbot
1 cited
Ian Alexander
@jitsu-net
1 cited
Peter Weinberger
@pjweinbgo
1 cited
Michael Newman
@michaelbnewman
Mark Freeman
@mrkfrmn
A gopls parser bug that could corrupt edits to large AST nodes is finally patched, and the vscode-go extension ships a pre-release with LSP 3.18 support.
The most significant fix lands in gopls: the position computation in parsego was clamping values incorrectly, causing issues when an AST edit appends a node with length greater than 1 at the end [1]. That fix pairs with a compiler change that splits large synthetic init functions to avoid duplicate registration panics, with a regression test now guarding the path for CockroachDB [2][3]. Meanwhile, vscode-go released v0.57.2, a pre-release of v0.58.0 that adds support for LSP 3.18 [4], plus a diagnostics de-duplication fix that now considers column position to match how all major linters report issues [5]. On the security front, the vulndb team tightened its intake process, announcing "We now only accept reports that have existing GHSA / CVE associated with them" [6], and added 4 new vulnerability reports while reviewing 8 others [7][8]. The compile team also optimized conditional select rewrites for powers of two, which should speed up accumulation chains on all architectures [9]. Worth noting: the AArch64 assembler now supports five new ID system registers, useful for kernel and low-level tooling [10], and a build_bypass workflow was added to unstick vulndb deploys when a dependency lacks a fix [11].
Action items
- → Update gopls to the latest build to pick up the parsego position fix and avoid edit corruption golang/tools [immediate]
- → Try vscode-go v0.57.2 pre-release for LSP 3.18 support and test your linter diagnostics deduplication golang/vscode-go [plan]
- → Adjust your vuln reporting to include a GHSA or CVE identifier, as unassociated reports are no longer accepted golang/vulndb [monitor]
- → Watch the cmd/compile init splitting work if you build packages with many global initializers; it's not merged yet golang/go [monitor]
References
- [1] gopls/cache/parsego: fix pos computation ↗ golang/tools
- [2] cmd/compile: speedup large synthetic init function compile time ↗ golang/go
- [3] test: add regression test for issue 80423 ↗ golang/go
- [4] Release v0.57.2 ↗ golang/vscode-go
- [5] extension/src/diagnostics: consider column upon de-duplication ↗ golang/vscode-go
- [6] .github/ISSUE_TEMPLATE: remove new_third_party_vuln.yml ↗ golang/vulndb
- [7] data/reports: review 8 reports ↗ golang/vulndb
- [8] data/reports: add 4 reports ↗ golang/vulndb
- [9] cmd/compile: always do rewriteCondSelectIntoMath for powers of two ↗ golang/go
- [10] cmd/asm: add newer AArch64 ID system registers ↗ golang/go
- [11] deploy: add build_bypass.yaml ↗ golang/vulndb
