RepoJournal
Go @golang

Go — full archive

167 daily briefings · 14 reviews.

$ ls golang/reviews/ # the step-back reads

  1. week FIPS 140 crypto fixes land across SHA-3, TLS 1.2, HKDF
  2. week x509 distrust rationale documented, prove compiler pass speeds up
  3. week Go x509 stops trusting a set of intermediates
  4. week gopls v0.24.0 ships, MoveType code action deleted
  5. week Go 1.28 string(int) ban gets migration tooling
  6. month Go toolchain patches three CVEs as gopls hits v0.24.0
  7. week Go toolchain patches three CVEs in module and template verification
  8. week Go strips malformed HTTP/2 headers, moves HTTP/3 into std
  9. week Go 1.27.1 lands as plan9 early export disabled
  10. week Go unified V5 export data lands, then reverts
  11. month Go inliner learns to fold recover calls
  12. week crypto/ssh CheckCert enforces source address
  13. week Go tightens crypto, shrinks loong64, narrows HTTP/2
  14. month Go compiler hardens binaries, crypto tightens SSH safety
  1. RISC-V Zfa assembly support, and a faster archsimd unifier
  2. Plan 9 Mkdir race fixed, riscv64 gets clobberdead mode
  3. gopls closes a CVE on dash-prefixed module paths, and the exp collections get a Set
  4. Compiler stops lifting unsafe.Pointer arithmetic
  5. gcimporter var kinds regress in Go 1.28, net/http drops serverHandler
  6. HTTP/2 retry loop collapse, RemoveAll stops swallowing errors
  7. ShiftAll* constants become immediate shifts on arm64
  8. FIPS 140 crypto fixes land across SHA-3, TLS 1.2, and HKDF
  9. encoding/json/v2 trims redundant buffer stores
  10. Compiler speedups land as prove's jump-table scan goes
  11. Windows SendFile was reporting partial 2 GiB+ transfers as success
  12. Linker fix for over-aligned text sections, simd internal refactor
  13. Raw text rendering fix in golang/net, and faster darwin builders
  14. Compiler prove pass gets 43x faster on huge switches
  15. Compiler tightens limits propagation as x509 distrust rationale lands
  16. Windows CPU profiler timer fallback, plus vet cache race fix
  17. Go test cache hits get 100x faster, as three net/http and mime parser changes land
  18. Compiler fixes land for escaping slices and arm64 constants, golang/net hardens ipv4 and ipv6 parsing
  19. UUID.Compare goes constant-time, synctest gets out of WaitGroup's way
  20. gopls enables MoveDeclaration and cuts cold-check I/O
  21. Go distrusts a set of x509 intermediates, shift type-checking tightened
  22. ppc64le compiler preps for SIMD with F31 and vector registers
  23. Pethost joins the Go wiki's GoUsers list
  24. Mach-O linking fix on Darwin ARM64, and a 2.7x SGEMM baseline
  25. gopls v0.24.0 lands, with pinning and filepath fixes behind it
  26. x/crypto ssh/terminal gets go fix inlines, riscv64 jumps corrected
  27. Go tooling gets lossless float constants, split DWARF lands on Darwin
  28. gopls deletes MoveType, Go telemetry hardens paths and dates
  29. golang/crypto ssh accepts trailing banner data
  30. golang.org/x dependency bumps land across build, pkgsite, vuln, and mobile
  31. Deprecations land in net and go/build, gopls fixes shadowing and overlay handling
  32. Go's HTTP stack gets a hardening wave, x/crypto fixes a LoongArch keystream bug
  33. gopls boots one daemon for every subcommand, and the compiler learns to see NUL bytes
  34. Windows async preemption paused during exception handling
  35. Go 1.28's string(int) ban gets migration tooling; x509 macOS crash fixed
  36. SVE mask predicates land in archsimd; crypto audits ssh for Unicode string calls
  37. vscode-go drops VS Code engines older than v1.110
  38. Go toolchain patches three CVEs in module and template verification
  39. html/template escapes JS context, gopls fixes inline call analysis
  40. net/http splits HTTP/2 build tags, SSA stops leaking type info
  41. Windows thread stack corruption fix, json v1 field restored in Go 1.27 shim
  42. HTTP/2 framing header fix lands in x/net, compiler and PGO changes across Go
  43. Loong64 MOVW/MOVV immediate fix, Windows ad-hoc package errors
  44. Compiler gains mem2reg and stats passes
  45. gopls fixes 2019-era import scan bug and a CVE lands in pkgsite's gRPC
  46. Playground locks down user input, Go SIMD loads stop reading past the slice
  47. Nil-safety in go/types, faster flate, AES decrypt on loong64
  48. Overflowing constants invalidated, cgo's `any` rewrite reverted
  49. Go deletes malformed HTTP/2 headers to close response smuggling, and lifts HTTP/3 into std
  50. Salsa20 gets a loong64 SIMD path
  51. LoongArch crypto gets SIMD, RISC-V bit tests slim down
  52. Go's QUIC stack learns to tell on-path from off-path, and amd64 gets v2/v3/v4 CPU bits
  53. pkgsite drops ctxhttp, tour returns real 404s
  54. math/big zero-sign panic fixed, go mod why now exits non-zero
  55. Unencrypted HTTP/2 stops canceling request contexts; localhost resolves to loopback
  56. Windows NewFile stops blocking, riscv64 disassembly gets fixed
  57. Go turns off early export on plan9 to unbreak its builders
  58. Go's log/slog MultiHandler stops sharing attrs slices
  59. Go's build chain sheds its own-stdlib dependency, compiler walk state removed
  60. Compiler #-names removed from b.Loop keepalives, bootstrap flags dropped

Never miss a Go briefing.

Get Go's week in review every Monday - and security advisories the day they land. Free, unsubscribe in one click.

One click. Every Monday: what mattered across the projects you've been reading (or our AI picks) — security news same-day. You refine anytime. Choose specific journals · Read a sample issue →