$ the-wire · showcase
gopls fixes 2019-era import scan bug and a CVE lands in pkgsite's gRPC
By RepoJournal · Filed · About Go · Composed from the cited sources · methodology
10 people shipped this
Two long-lived bugs get closed today, one in gopls's import scanning that has discarded dependency module directories since a 2019 change, and one in pkgsite's gRPC dependency, which now carries CVE-2026-33186.
internal/imports: fix scanning of dependencies' module directories golang/tools
Since CL 212857 in 2019, newModuleResolver added each dependency's module directory as a RootModuleCache root ahead of the module cache, but scanDirForPackage computed subdirs relative to that root, dropping the module@version component modCacheRegexp requires. Every such directory was discarded as an "invalid module cache path", so dependency packages were scanned unreliably for years; this re...
all: update google.golang.org/grpc and google.golang.org/api dependencies golang/pkgsite
google.golang.org/grpc moves up to remediate CVE-2026-33186 and GHSA-m425-mq94-257g, which forces google.golang.org/api up too: newer gRPC adds a field to credentials.DefaultCredentialsOptions and an unkeyed struct literal fails to compile. The api bump pulls cloud.google.com/go modules along via minimal version selection, so if you build against pkgsite's modules, bump both together.
simd: add missing ARM64 NEON 8-bit ConcatAddPairs intrinsics golang/go
The 8-bit Int8x16 and Uint8x16 ConcatAddPairs variants were missed when the intrinsic landed, and NEON's VADDP handles the 16B arrangement natively. The element-size constraint relaxes to 8|16|32: amd64 is unchanged, arm64 gets VADDP.16B lowering.
gopls/internal/golang: refactor moving set computation golang/tools
The refactor collapses explicit and implicit dependency exploration into one plain BFS, but implicitDependencies now runs once per constant instead of once per iota group and rescans the enclosing block each time. Hongxiang Jiang's numbers for an n-constant iota block: 7.0µs to 333µs at n=100, 77µs to 28.9ms at n=1000.
unix/linux/Dockerfile: update to Go 1.26.8 golang/sys
The Linux builder moves to Go 1.26.8 for the fix behind golang/go#81112; several smaller cleanups also landed, including the removal of the SSA generator split phase, which produces no changes in generated output, and corrections to the simd tofrom_xxx variant path for arm64.
Action items
