167 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-10-24
stories 19

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

Go test cache hits get 100x faster, as three net/http and mime parser changes land

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

Damien Neil's batch of URL and MIME parsing fixes closes several parser differentials in net/http, mime, and net/http/cgi, while cmd/go reworks what it stores from test logs and the build images pick up podman.

cmd/go: store only the test log entries that the inputs ID uses golang/go

by vshulcz

cmd/go now stores only the test log entries that computeTestInputsID actually uses, so a cache hit no longer re-checks entries outside the module, GOPATH, or GOROOT roots. On the 1,000,000 os.Stat benchmark on darwin/arm64, cached runs dropped from 10.7s to 0.09s (median of 5), against 5.0s uncached.

mime: don't *-decode multipart/*, boundary, or charset in ParseMediaType golang/go

by Damien Neil

ParseMediaType no longer *-decodes parameters in multipart/*, in any parameter named boundary, or in charset, closing parser differentials between Go and other MIME parsers. If you were relying on RFC 2231 encoding in those positions, the decoded value is no longer what you get.

net/http: always use target Host on scheme-relative redirects golang/go

by Damien Neil

Client used to preserve the original request's host when following a scheme-relative redirect like "//example/com/" if Request.Host differed from Request.URL; it now always uses the target Host. A relative Location of "//example.tld/path" in net/http/cgi likewise becomes a protocol-relative non-local redirect rather than a local one parsed with a hostname.

internal/postgres: disable popularSearch golang/pkgsite

by Nicholas S. Husin

pkgsite stopped hedging its search between popularSearch and deepSearch: metrics showed deepSearch wins the race for roughly 99.5% of queries. Popular-term searches still take 1 to 3 seconds when they miss the Redis cache, but that path is now the only one.

internal/vulndbreqs: reduce mutex contention golang/pkgsite-metrics

by Hongxiang Jiang

Background: vulndbreqs goroutines now fill a local map before taking the lock and touching global state, instead of locking on every observed log entry, and IP obfuscation was moved after de-duplication so dedup keys stay on raw addresses until the work is done.

Quick answers

What shipped in Go on October 24, 2026?
Damien Neil's batch of URL and MIME parsing fixes closes several parser differentials in net/http, mime, and net/http/cgi, while cmd/go reworks what it stores from test logs and the build images pick up podman. In total, 19 commits landed.
Who contributed to Go on October 24, 2026?
7 developers shipped this update, including Ashwin Sarswat, Nicholas S. Husin, Michael Matloob, Ethan Lee, Hongxiang Jiang, vshulcz, and Damien Neil.
What were the notable Go updates?
cmd/go: store only the test log entries that the inputs ID uses, mime: don't *-decode multipart/*, boundary, or charset in ParseMediaType, and net/http: always use target Host on scheme-relative redirects.