RepoJournal
Go @golang
167 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-10-20
stories 34
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

Go distrusts a set of x509 intermediates, shift type-checking tightened

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

Robert Griesemer Roland Shoemaker qmuntal David Chase Archana Ravindar Gopher Robot Ian Alexander
8 people shipped this
Robert Griesemer @griesemer 2 cited Roland Shoemaker @rolandshoemaker 1 cited qmuntal @qmuntal 1 cited David Chase @dr2chase 1 cited Archana Ravindar @archanaravindar Gopher Robot @gopherbot Ian Alexander @jitsu-net Dmitri Shuralyov @dmitshur

crypto/x509 now filters intermediate certificates out of chains returned by Verify to address CVE-2026-111943, alongside a set of shift-checking fixes in go/types and types2.

crypto/x509: distrust a handful of intermediates golang/go

by Roland Shoemaker

Chains returned by Verify are now filtered against a set of intermediates identified by their SHA-256 SPKI hashes, fixing CVE-2026-111943. If you pin or inspect intermediates out of a verification chain, expect those entries to be gone.

go/types, types2: fix shift checking for LHS operands involving shifted floats golang/go

by Robert Griesemer

The type checker was rejecting shifts whose left operand is untyped but not constant, as in (1.0 << s1) << s2, because it required an integer type too early; that check is gone and the untyped-LHS path plus updateExprType now handles the case. The commented-out tests in internal/types/testdata were re-enabled.

go/types, types2: report error for oversized non-constant shift counts golang/go

by Robert Griesemer

Companion fix from the same author: for x << (c << s) with a non-constant count, an untyped constant c must now fit in a register, otherwise the checker reports an error, since the inner shift has to be executable at run time.

internal/poll: fix synchronous WSASendMsg byte counts on Windows golang/go

by qmuntal

WSASendMsg lost its byte-count output pointer in an earlier CL, so a send completing synchronously without a completion-port notification returned no count; the pointer is restored and execIO reports bytes sent again. Windows-only, and it fixes #82335.

internal/history: document Go 1.27.3 and Go 1.26.10 golang/website

by David Chase

Quiet tail: the website's history page now documents Go 1.27.3 and Go 1.26.10, golang/dl carries the go1.27.3 download entry, vulndb added GO-2026-6651, GO-2026-6671, GO-2026-6672 and GO-2026-6673, and cmd/relui turned off the race detector after it found no races in production workflows.

$ ls golang/reviews/ # the step-back reads

the week in review FIPS 140 crypto fixes land across SHA-3, TLS 1.2, HKDF the month in review Go toolchain patches three CVEs as gopls hits v0.24.0
Full archive → Weekly reviews →

Quick answers

What shipped in Go on October 20, 2026?
crypto/x509 now filters intermediate certificates out of chains returned by Verify to address CVE-2026-111943, alongside a set of shift-checking fixes in go/types and types2. In total, 34 commits landed.
Who contributed to Go on October 20, 2026?
8 developers shipped this update, including Roland Shoemaker, Robert Griesemer, qmuntal, Archana Ravindar, David Chase, Gopher Robot, Ian Alexander, and Dmitri Shuralyov.
What were the notable Go updates?
crypto/x509: distrust a handful of intermediates, go/types, types2: fix shift checking for LHS operands involving shifted floats, and go/types, types2: report error for oversized non-constant shift counts.
♥

$ log @golang --recent

RISC-V Zfa assembly support, and a faster archsimd unifier 9 shipped Plan 9 Mkdir race fixed, riscv64 gets clobberdead mode 7 shipped gopls closes a CVE on dash-prefixed module paths, and the exp collections get a Set 52 shipped Compiler stops lifting unsafe.Pointer arithmetic 35 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.