$ the-wire · showcase
Compiler stops lifting unsafe.Pointer arithmetic
By RepoJournal · Filed · About Go · Composed from the cited sources · methodology
The Go compiler's loop invariant pass was lifting unsafe.Add out of nil checks, and html/template has now drawn an explicit line around what JS interpolation it will defend.
cmd/compile: don't lift unsafe.Pointer arithmetic out of loops golang/go
The loop invariant pass decided pointer arithmetic was safe to hoist using Type.IsPtr, which is false for unsafe.Pointer, so an addition from unsafe.Add could be lifted out of its nil check and leave a bad pointer live across a safepoint. It now uses IsPtrShaped, which closes the hole for code doing unsafe.Add inside loops.
html/template: document safe uses of JS interpolation golang/go
html/template now documents an explicit list of safe uses of interpolation into JS and marks everything else out of scope for the security model. The same change drops a mention of the long-removed jstmpllitinterp GODEBUG, which had been reading as a non-sequitur in the security section.
crypto/internal/fips140/sha3: add loong64 LSX assembly for keccakF1600 golang/go
keccakF1600 gets a LoongArch LSX assembly path, used when LSX is available with the generic implementation as fallback. On a Loongson-3C6000/S the commit reports Sha3_512_MTU dropping from 9.396µ to 7.461µ per op, a 20.59% improvement.
cmd/gitmirror: don't delete unmirrored refs with a custom refspec golang/build
MirrorToGitHubCustomRefspec, added to mirror only some refs, still pushed with "git push --mirror", which deletes every destination ref the refspec does not match (for protobuf, every GitHub branch but master). Custom-refspec remotes now push with --prune so only the intended refs are removed.
data/reports: add 2 reports golang/vulndb
Two new advisories landed as GO-2026-6910 and GO-2026-6917 in the vulndb reports data, the entries go vet and govulncheck consult. Elsewhere: math.Add64 was removed from internal/runtime as an unused duplicate of math/bits.Add64, vendored x/arch moved to 6a31474cd4d for loong64 SIMD disassembly, and gomote gained the caches golangbuild already had, cutting slow xcode downloads on darwin.
