$ the-wire · showcase
html/template escapes JS context, gopls fixes inline call analysis
By RepoJournal · Filed · About Go · Composed from the cited sources · methodology
A CVE fix lands in html/template's JS context handling while gopls fixes a telemetry-distorting bug in ChangeSignature and the export-data decoupling experiment ripples through cmd/go and toolstash.
html/template: reset JS context for template expressions golang/go
Regular expressions at the start of each template expression now receive regular expression escaping, closing CVE-2026-94448. If you render untrusted data into JS contexts through html/template, this is the one to take.
cmd/compile/internal/pkginit: remove tconv alias golang/go
The tconv alias, a shorter name for typecheck.ConvNop, is gone so that rf's inject can follow the call tree; that is groundwork for the refactoring work tracked under #19683.
gopls/internal/golang: call arguments mistreated in inlineAllCalls golang/tools
inlineAllCalls used to treat any directly enclosing ast.CallExpr as a call to the referenced function, so references passed as arguments (s.M(f), use(f)) were miscounted as call sites during ChangeSignature rewrites. The commit flags this as a telemetry bug.
cmd/toolstash: check -linkobj files to support early export golang/tools
cmd/go now passes a -linkobj flag with a separate archive: the -o file holds export data and -linkobj holds object code. toolstash -cmp previously missed changes in that file, so 'go build -toolexec "toolstash -cmp" -a std' could pass over real SSA differences; it now compares the -linkobj file.
cmd/go: split build_pgo test based on "go list -export" experiment golang/go
The build_pgo test assumed build IDs from 'go list -export' and 'go build' match, which the export data decoupling experiment explicitly drops. The test is split and the failing portion removed for the duration; one of the two files goes away when the experiment concludes.
data/reports: add 2 reports golang/vulndb
vulndb added GO-2026-6615 and GO-2026-6616, reviewed GO-2024-2584, and moved GO-2026-6551 into data/excluded.
Action items
