The Wire · Showcase
Go's crypto/tls session cache leak fixed
By RepoJournal · Filed · About Go
12 people shipped this
tomoikey
@tomoikey
1 cited
davidteather
@davidteather
1 cited
cuishuang
@cuishuang
1 cited
Nicholas S. Husin
@nicholashusin
1 cited
nnnkkk7
@nnnkkk7
1 cited
Alan Donovan
@adonovan
1 cited
Viacheslav Rostovtsev
@viacheslav-rostovtsev
1 cited
Ethan Lee
@ethanalee-work
1 cited
Ilya Torbin
@bontail
Alex Gaynor
@alex
Tobias Klauser
@tklauser
Madeline Kalil
@madelinekalil
A one-line fix in crypto/tls quietly patches a memory leak that inflated session caches and evicted live entries.
The Go team shipped a patch [1] to crypto/tls where deleting a missing session cache key is now a no-op, fixing a bug where a nil cs could insert an empty entry and evict the least recently used cache slot. Meanwhile, the fmt package is getting faster [2]: printValue now skips the interface conversion for method-less types, eliminating up to eight heap allocations per slice element in Sprintf("%v", []int{1..8}). encoding/gob also returns encoderState to the free list after nil interfaces, cutting allocations in arrays, slices, and maps [3]. On the tooling side, gopls updates staticcheck to 2026.2.1 (v0.8.1) [5], and the embedlit modernizer fixes a comment-scanning bug that could generate uncompilable code [4]. In oauth2, the Google endpoint switches from snake_case to kebab-case [6]. And pkgsite improves vector search by incorporating package popularity into the ranking CTE, preventing low-import packages from dominating results [7]. The net/http3 fix [8] resolves lingering goroutine failures in std longtests.
One email a day. Unsubscribe in one click.
Keep up with Go in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
One email a day. Unsubscribe in one click. Read a past issue →
Action items
- → Review crypto/tls session cache usage for the nil-state eviction fix golang/go [immediate]
- → Update gopls to pick up staticcheck 2026.2.1 golang/tools [plan]
- → Check any code relying on the google oauth2 endpoint name for the kebab-case change golang/oauth2 [monitor]
References
- [1] crypto/tls: make deleting a missing session cache key a no-op golang/go
- [2] fmt: skip the interface conversion in printValue for method-less types golang/go
- [3] encoding/gob: return encoderState after encoding nil interfaces golang/go
- [4] go/analysis/passes/modernize: ignore comments in embedlit's comma check golang/tools
- [5] gopls/go.mod: update staticcheck to 2026.2.1 (v0.8.1) golang/tools
- [6] google: change the snake case endpoint to kebab-case golang/oauth2
- [7] internal/postgres: improve vector search quality golang/pkgsite
- [8] internal/http3: wait until clientConn is unregistered when closing it golang/net
