RepoJournal
Go @golang
103 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-08-31
stories 7
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

ssh CheckCert now enforces source-address, semaphore rejects negative capacity

By RepoJournal · Filed · About Go

ZhouGuangyuan kovan davidteather nnnkkk7 David Chase Nicola Murino racequite
7 people shipped this
ZhouGuangyuan @zhouguangyuan0718 1 cited kovan @kovan 1 cited davidteather @davidteather 1 cited nnnkkk7 @nnnkkk7 1 cited David Chase @dr2chase 1 cited Nicola Murino @drakkan 1 cited racequite @racequite 1 cited

Go's crypto and sync libraries shipped fixes that close a host-key verification gap and reject misconfigured semaphores.

golang/crypto's ssh package now enforces the source-address critical option in CheckCert [1], closing a gap where CA-signed host certificates with source-address were accepted regardless of the server's address in the host key path or direct CheckCert calls. This is a breaking change for applications relying on the old permissive behavior. golang/sync's semaphore now panics on negative capacity in NewWeighted [2], preventing semaphores where even a zero-weight acquisition cannot succeed. In golang/tools, go/ssa propagates receiver instantiation to nested functions [3], fixing nil package instances in nested closures of generic methods and preventing SSA sanity check failures. golang/go's math/big fixes DivMod when the modulus aliases the divisor [4], returning (-2, 1) instead of (0, 0) for DivMod(-5, 3); code aliasing outputs should be reviewed. The bufio fast path for WriteString [5] handles strings that fit in the buffer first, making it comparable to Write for common cases. The os package examples now use errors.Is instead of deprecated helpers [6], and cmd/compile's simd ops generation now merges from separate files [7].

Action items

References

  1. [1] ssh: don't skip the source-address critical option in CheckCert ↗ golang/crypto
  2. [2] semaphore: panic on negative capacity ↗ golang/sync
  3. [3] go/ssa: propagate receiver instantiation to nested functions ↗ golang/tools
  4. [4] math/big: fix DivMod when the modulus aliases the divisor ↗ golang/go
  5. [5] bufio: add fast path to WriteString for strings that fit in the buffer ↗ golang/go
  6. [6] os: update examples to use errors.Is instead of deprecated helpers ↗ golang/go
  7. [7] cmd/compile: change how ssa/_gen processes generic simd ops ↗ golang/go

$ ls golang/reviews/ # the step-back reads

the week in review crypto/ssh CheckCert enforces source address the month in review Go compiler hardens binaries, crypto tightens SSH safety
Topics: Go Infrastructure Full archive →

Quick answers

What shipped in Go on August 31, 2026?
Go's crypto and sync libraries shipped fixes that close a host-key verification gap and reject misconfigured semaphores. In total, 7 commits landed.
Who contributed to Go on August 31, 2026?
7 developers shipped this update, including ZhouGuangyuan, kovan, davidteather, nnnkkk7, David Chase, Nicola Murino, and racequite.
What were the notable Go updates?
ssh: don't skip the source-address critical option in CheckCert, semaphore: panic on negative capacity, and go/ssa: propagate receiver instantiation to nested functions.
♥

$ log @golang --recent

crypto/x509 tightens URI and email name constraint matching 5 shipped crypto/tls frees pinned buffers, compiler tail call DCE fix lands 26 shipped Plugin itabs double-inserted; symbol insertion skips large modules 12 shipped x/tools protocol shift, masked heap prefix fix 31 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Node.js Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.