RepoJournal
Go @golang
103 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-03
stories 31
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

x/tools protocol shift, masked heap prefix fix

By RepoJournal · Filed · About Go

Alan Donovan Derek Parker Nicholas S. Husin Vlad Saioc Madeline Kalil Junyang Shao Peter Weinberger
7 people shipped this
Alan Donovan @adonovan 2 cited Derek Parker @derekparker 1 cited Nicholas S. Husin @nicholashusin 1 cited Vlad Saioc @VladSaiocUber 1 cited Madeline Kalil @madelinekalil 1 cited Junyang Shao @JunyangShao Peter Weinberger @pjweinbgo

A runtime memory layout bug and a coordinated export-data protocol change landed today, the latter breaking changes that ripple across Go tools and analysis.

The Go runtime fixed a misalignment in randomized heap base prefix masking [1]: randHeapBasePrefixMask clears the top byte at heapAddrBits-8 (bit 40 on amd64), but hint generation places the randomized prefix byte at randHeapAddrBits-8 (bit 38). Because randHeapAddrBits is heapAddrBits-1 on most platforms (heapAddrBits-2 on amd64), stray randHeapBase bits survive the mask and leak into the prefix's low bits via `p = prefix | (randHeapBase & randHeapBasePrefixMask)`. This is a correctness bug in heap layout randomization; the change corrects the mask to match the prefix placement.

In x/tools, unitchecker no longer wraps export data in the gcexportdata framing that prepends an 'i' byte and forces a bulk copy [2]. Since unitchecker both produces and consumes the files, it now uses the lower-level i-format routines directly. Separately, gcimporter supports V5 unified encoding (method indices) [3]: Go 1.27.0's V4 encoding reordered nongeneric before generic methods, losing source order and breaking objectpath (go.dev/issue/81188); V5 explicitly encodes method indices to restore it. These are tight-knit changes: the framing removal assumes i-format, and V5 support is a protocol update.

The Go security policy in x/website now contains "a note on LLM-generated reports" [4]. The blog also gained a post on goroutine leak profiles, covering usage, examples, implementation details, limitations, and performance penalties [5]. A gopls integration test that used to run staticcheck for a simplify-composite-literal diagnostic now targets the gopls analyzer simplifycompositelit directly, avoiding a reportedly flaky race caused by enabling staticcheck [6].

Action items

References

  1. [1] runtime: fix randomized heap base prefix mask misalignment ↗ golang/go
  2. [2] go/analysis/unitchecker: remove export data framing ↗ golang/tools
  3. [3] internal/gcimporter: support V5 unified encoding (method indices) ↗ golang/tools
  4. [4] _content/doc/security: add a note on LLM-generated reports in our policy ↗ golang/website
  5. [5] _content/blog: add blog post explaining goroutine leak profiles ↗ golang/website
  6. [6] gopls/internal/test/integration: fix TestSimplifyCompositeLitDiagnostic ↗ golang/tools

$ ls golang/reviews/ # the step-back reads

the week in review crypto/ssh CheckCert enforces source address the month in review Go compiler hardens binaries, crypto tightens SSH safety
Topics: Go Infrastructure Full archive →

Quick answers

What shipped in Go on September 3, 2026?
A runtime memory layout bug and a coordinated export-data protocol change landed today, the latter breaking changes that ripple across Go tools and analysis. In total, 31 commits landed.
Who contributed to Go on September 3, 2026?
7 developers shipped this update, including Derek Parker, Junyang Shao, Nicholas S. Husin, Vlad Saioc, Alan Donovan, Peter Weinberger, and Madeline Kalil.
What were the notable Go updates?
runtime: fix randomized heap base prefix mask misalignment, go/analysis/unitchecker: remove export data framing, and internal/gcimporter: support V5 unified encoding (method indices).
♥

$ log @golang --recent

crypto/x509 tightens URI and email name constraint matching 5 shipped crypto/tls frees pinned buffers, compiler tail call DCE fix lands 26 shipped Plugin itabs double-inserted; symbol insertion skips large modules 12 shipped Go compiler drops unnecessary riscv64 masking and hardens SIMD codegen 25 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Node.js Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.