$ the-wire · showcase
GO'S SYNC.ONCE PANIC TRAP
By RepoJournal · Filed · About Go · Composed from the cited sources · methodology
A panic in go/parser's ResolveFile can leave the compiler silently skipping type resolution, and Damien Neil is closing a request smuggling hole in net/http.
The go/parser bug [1] turns a panic into silent success: sync.Once marks the resolution done even when it panics, so later calls return normally without resolving the file. This is the kind of subtle correctness trap that bites in production, so watch for it in your code review. Meanwhile, net/http now closes connections when both Transfer-Encoding and Content-Length are present [2], following RFC 9112 to prevent request smuggling. That's a good reason to patch your servers. Peter Weinberger fixed a panic in gcimporter when writing export data for generic constant types [3], which could crash tools like go/packages. For your next Go upgrade, golang.org now runs Go 1.27 on App Engine [4], so plan accordingly.
Action items
- → Review go/parser ResolveFile changes for panics in your tooling golang/go [immediate]
- → Update net/http to fix request smuggling when TE and CL are both present golang/go [immediate]
- → Check your gcimporter dependency for the export data panic fix golang/tools [plan]
- → Budget for Go 1.27 runtime on App Engine golang/website [monitor]
References
- [1] go/parser: preserve ResolveFile failure state after panic ↗ golang/go
- [2] net/http: close connection after handling req with TE and CL ↗ golang/go
- [3] internal/gcimporter: fix panic writing export data ↗ golang/tools
- [4] cmd/golangorg: update App Engine runtime to Go 1.27 ↗ golang/website
