RepoJournal

$ cat golang/month/2026-08-01.log

Go

Go

the month in review · August 2026

Go compiler hardens binaries, crypto tightens SSH safety

The Go project spent August fixing pointer-offset bugs that inflated binaries and threatened correctness, then shored up SSH, HTTP/2, and TLS across the ecosystem.

556 commits 2 releases 29 briefings covered

The month's most consequential work landed in the compiler, where stack object records now use pointer-size alignment [1] and mips64le pointer offsets beyond 32 bits are corrected [2]. These fixes shrink binaries on AMD64 and eliminate subtle miscompilations on MIPS64, changes that matter for anyone shipping to exotic architectures or watching binary size creep.

A second compiler thread tightened correctness around range-clear safety [3] and load merging, which now tracks visited values instead of iterations to avoid missing merge opportunities [4]. The inliner's disjointness check also shifted to use types recorded in Store operations [5], improving optimization precision. Meanwhile, internal SSA refactoring added an HTML debug flag [6] and removed the HTMLWriter from Func [7], laying groundwork for future debug tooling.

The crypto and net stack saw targeted fixes. The SSH implementation now returns window credit for discarded extended data [8], preventing stalls in channels. Poly1305 gained optimized assembly for riscv64 [9], and so does x86 ABI0 NOFRAME BP expectations [10]—a breaking fix for code relying on the prior behavior. A fixed frame pointer adjustment around injected calls [11] closes a subtle runtime bug.

On the tooling side, vscode-go updated impl to v1.5.0 [12]. The pkgsite frontend improved documentation signals by checking local interfaces [13] and accepting group comments [14], making generated docs more accurate. Benchmarks shifted from benchmarks-50 to benchmarks-100 [15], which should give larger, more stable sample sets for regression detection.

Cleanups continued steadily: net/rpc dropped unused sort.Interface methods [16], and bytes/strings removed redundant DecodeRune fast paths [17]. The latter is a small but real simplification of hot-path code.

References

  1. [1] cmd/compile: use pointer-size alignment for stack object records ↗ golang/go
  2. [2] cmd/compile: fix mips64le bigger than 32bits pointer offsets ↗ golang/go
  3. [3] cmd/compile: avoid range clear when target depends on index ↗ golang/go
  4. [4] cmd/compile: track visited values, not iterations, in canMergeLoad ↗ golang/go
  5. [5] cmd/compile: change disjoint to use types recorded in the Store operations ↗ golang/go
  6. [6] cmd/compile/internal/ssa: add html debug flag ↗ golang/go
  7. [7] cmd/compile/internal/ssa: remove HTMLWriter from Func ↗ golang/go
  8. [8] ssh: return window credit for discarded extended data ↗ golang/crypto
  9. [9] crypto/internal/poly1305: provide optimised assembly for riscv64 ↗ golang/crypto
  10. [10] cmd/internal/obj/x86: fix breaking change in ABI0 NOFRAME BP expectations ↗ golang/go
  11. [11] runtime: fix frame pointer adjustment around injected calls ↗ golang/go
  12. [12] src/goInstallTools: update impl to v1.5.0 ↗ golang/vscode-go
  13. [13] internal/frontend: doc signal: check local ifaces ↗ golang/pkgsite
  14. [14] internal/frontend: doc signal: accept group comments ↗ golang/pkgsite
  15. [15] cmd/bench: replace benchmarks-50 with benchmarks-100 ↗ golang/benchmarks
  16. [16] net/rpc: remove unused sort.Interface methods ↗ golang/go
  17. [17] bytes, strings: remove redundant DecodeRune fast paths ↗ golang/go

$ ls golang/month/ # the briefings behind this review

Sat Aug 1 GO COMPILER FIXES MIPS64 POINTER BUGS, SHRINKS BINARIES ON AMD64 Mon Aug 3 GO COMPILER TIGHTENS RANGE-CLEAR SAFETY CHECKS Tue Aug 4 SSH WINDOW CREDIT BUG COULD STALL CHANNELS; COMPILER REFACTORING SPLITS SSA PACKAGE Wed Aug 5 GO FIXES BREAKING ABI REGRESSION AND LOCKS DOWN REVERSE PROXY COOKIE HANDLING Thu Aug 6 GO PATCHES TEMPLATE INJECTION FLAW, HTTP/2 GOROUTINE LEAK Fri Aug 7 COMPILER OPTIMIZATIONS AND TLS HARDENING PUSH THROUGH GOLANG ECOSYSTEM Sat Aug 8 VSCODE-GO TIGHTENS LINTING, REVIVE JUMPS 11 VERSIONS Sun Aug 9 GO COMPRESSES RISCV RETURNS, SHAVES 2,700 INSTRUCTIONS Tue Aug 11 GO 1.26 MINIMUM BOOTSTRAP UNLOCKS NETBSD SIMPLIFICATION Wed Aug 12 GO AUTH CREDENTIALS FIXED, JSON V2 DROPS CYCLE GUARANTEE Thu Aug 13 GO COMMAND GETS PARALLEL TEST PARSING, COMPILER OPTIMIZATIONS CUT BINARY SIZE BY 10K INSTRUCTIONS Fri Aug 14 GO PATCHES TWO CRITICAL SUMDB VULNERABILITIES OVERNIGHT Sat Aug 15 GO STRIPS LEGACY CODE.GOOGLE.COM PATHS, HTTP/2 HOST HEADER FIX LANDS Sun Aug 16 REFACTOR TOOL CRASH FIX SHIPS AS COMPILER INTERNALS SHUFFLE Mon Aug 17 GOPLS FIXES WINDOWS CRLF OFFSET DRIFT, REVIEW REPO CATCHES UP ON FORMATTING Tue Aug 18 GO COMPILER REWRITES SPLIT FOR PARALLEL BUILDS Wed Aug 19 GOPLS FIXES AST POSITION BUG THAT BREAKS EDITS Thu Aug 20 Go 1.28 release notes go live as database/sql doubles down on speed Fri Aug 21 GO'S SYNC.ONCE PANIC TRAP Sat Aug 22 GO CLEANUP: SPLITPHASE GONE, RISCV64 FASTER Sun Aug 23 GO RUNTIME FIXES A SUBTLE BODY-CLOSE BUG Mon Aug 24 KNOWNHOSTS REVOCATION GAP PATCHED Tue Aug 25 LOONG64 WINS BIG: GO SHRINKS BY 7128 INSTRUCTIONS Wed Aug 26 Go's crypto/tls session cache leak fixed Thu Aug 27 Go Deprecates HTTP/2 Transport Direct Use Fri Aug 28 unicode/norm composition bugs shake the foundation Sat Aug 29 net/http aborts writes on dead connections, breaks solaris fuzz test Sun Aug 30 cmd/goimports skips an lstat per file Mon Aug 31 ssh CheckCert now enforces source-address, semaphore rejects negative capacity