Who contributed to Go on August 24, 2026?

1 developer shipped this update, including Nicola Murino.

What were the notable Go updates?

ssh/knownhosts: compare only public key portions for revocation.

@golang

Go and the standard library - backend infrastructure at scale

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

KNOWNHOSTS REVOCATION GAP PATCHED

By RepoJournal · Filed 06:56 UTC on August 24, 2026 · About Go

1 person shipped this

Nicola Murino @drakkan 1 cited

A revocation check in Go's crypto library silently let revoked host keys pass, and the fix is now in.

golang/crypto closed a security gap in ssh/knownhosts: revocation matching compared full marshaled key blobs, so a @revoked line with a plain host key failed to revoke a certificate certifying that key. The fix aligns with OpenSSH's check_key_not_revoked, which compares only public key portions. This matters for any SSH client that relies on certificate-based host key verification. The one-line functional change makes IsRevoked match the underlying public key instead of the entire certificate blob. That means a revoked host key now properly blocks certificates chaining to it. If you vendor golang/crypto, update before your next deployment. It's a subtle fix with a real security impact.

Action items

→ Update golang/crypto to the revision containing this patch before your next deploy golang/crypto [immediate]

References

[1] ssh/knownhosts: compare only public key portions for revocation golang/crypto

Quick answers

What shipped in Go on August 24, 2026?: A revocation check in Go's crypto library silently let revoked host keys pass, and the fix is now in. In total, 1 commits landed.
Who contributed to Go on August 24, 2026?: 1 developer shipped this update, including Nicola Murino.
What were the notable Go updates?: ssh/knownhosts: compare only public key portions for revocation.

GO RUNTIME FIXES A SUBTLE BODY-CLOSE BUG

The net/http change you didn't know you needed just landed, and it could save you from chasing a phantom io.EOF.

go 3 shipped

@golang Aug 22

GO CLEANUP: SPLITPHASE GONE, RISCV64 FASTER

Austin Clements tore out the last splitPhase scaffolding in Go's SIMD generators, and Joel Sing shaved 300 instructions off riscv64 binaries, all in a morning's work.

go 38 shipped

@golang Aug 21

GO'S SYNC.ONCE PANIC TRAP

A panic in go/parser's ResolveFile can leave the compiler silently skipping type resolution, and Damien Neil is closing a request smuggling hole in net/http.

go 13 shipped

@golang Aug 20

Go 1.28 release notes go live as database/sql doubles down on speed

Go 1.28 is officially on the horizon, and database/sql just got a serious performance upgrade that will make every scanner faster.

go 43 shipped

Elsewhere on the wire

AI Agents Aug 24

CLINE SHIPS V4.1.15 AS TELEMETRY BUGS SURFACE ACROSS THE AGENT STACK

Cline's long-awaited auto-approve fix landed overnight, but it's the telemetry drop in 4.1.11 that should have you checking your session metrics.

ai-agents 44 shipped

Local LLMs Aug 24

VLLM'S P2P WEIGHT SYNC CUTS RL MOE TRANSFER COSTS

Forget all-gathering experts during RL rollout: vLLM's new sharded_rdt backend lets each worker pull only the slice it needs, turning a total_bytes transfer into a total_bytes divided by num_workers one.