$ the-wire · showcase
gopls closes a CVE on dash-prefixed module paths, and the exp collections get a Set
By RepoJournal · Filed · About Go · Composed from the cited sources · methodology
10 people shipped this
The day's load-bearing change is a security fix in gopls: a module path in go.mod that begins with a dash could be read as a flag by the go commands gopls shells out to, and the fix is to insert "--" before positional arguments.
gopls/internal: pass "--" before positional arguments to go commands golang/tools
modfile.Parse permits require directives whose module paths begin with a leading dash, and when gopls passed those paths (or package paths) positionally to "go list", "go get", or "go mod why", the argument could be consumed as a command-line flag. gopls now inserts "--" before positional module and package arguments; the change is filed against CVE-2026 and golang/go#82891.
collection/set: Set, a canonical representation for map-based sets golang/exp
Alan Donovan added Set[E], transparently a map[E]struct{}, intended to become the canonical way to express a set of comparable elements in Go APIs. The mapset code is inlined and a simplified copy of internal/fmtsort stands in for the go repo package; updates golang/go#69230.
collection/hashed: Set, a hash-table based set golang/exp
The companion collection/hashed package carries a hash-based Set for the cases a built-in map cannot serve, namely when a custom element hash and equivalence relation is required. It wraps Map[E, struct{}] and offers set algebra as pure binary functions (Union, Intersection, Difference, SymmetricDifference) plus in-place -With variants.
unix: don't skip directory entries with zero inodes on Linux golang/sys
ParseDirent treated a directory entry with a zero inode as absent and silently dropped it on all platforms; some Linux filesystems (old XFS, FUSE) return such entries as valid, and glibc permits it. The unix package now keeps those entries on Linux, following the exception already added to syscall.ParseDirent.
oauth2: prevent NewTicker panic golang/oauth2
The oauth2 package guards against a panic in NewTicker, described in the commit as hardening against the edge case "wherein a trusted server acts adversarially towards a client." Elsewhere: the assembler now rejects a base register on global symbol references such as sym(SB)(AX), the enormous auto-generated simd/internal/simdref package stops being generated, and x/exp apidiff learned to detect...
Action items
