Go toolchain patches three CVEs as gopls hits v0.24.0

By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology

♥

Template context escaping and toolchain checksum verification both changed behavior, so rebuilds that previously passed may not.

757 commits 5 PRs merged 1 releases 31 briefings covered

all golang reviews →

← previous month golang wire →

cmd/go: always verify toolchain downloads with sumdb golang/go

by Neal Patel

Instead of accepting a matching sumdb entry that names golang.org/toolchain, cmd/go now goes to the network for the canonical checksum. If your CI pins toolchains behind a mirror or proxy that blocks that fetch, expect it to fail until you allow it.

html/template: reset JS context for template expressions golang/go

by Neal Patel

Regular expressions at the start of template expressions now get regexp escaping, closing a JS context leak tracked as CVE-2026-94448. Templates that emit regex literals in script contexts should be re-checked against rendered output.

html/template: recognize `yield` as regexp preceder keyword golang/go

by Neal Patel

The companion fix treats `yield` as a regexp preceder keyword while leaving non-keyword uses unescaped. The template package now escapes a category of expression it previously let through, which is the kind of change that shows up as a diff in golden files.

net/http: add nethttpomithttp2server and nethttpomithttp2client build tags golang/go

by Brad Fitzpatrick

Two new build tags, nethttpomithttp2server and nethttpomithttp2client, let a binary drop one half of HTTP/2; previously the all-or-nothing nethttpomithttp2 tag was the only option. Binary-size-sensitive services using http.Server can now shed the server side without losing the client.

gopls v0.24.0 golang/tools

by gopherbot

The language server cut a minor release in mid-October, with pinning and filepath fixes behind it, then enabled MoveDeclaration and reduced cold-check I/O later in the month. MoveType was deleted. The release notes are the reference for editor config changes.

go/ssa, cmd/deadcode: release type information once functions are built golang/tools

by hw

Function values no longer hold their package's types.Info alive for the lifetime of the Program, so long-running analysis tools like cmd/deadcode keep less in memory. The change targets generic origins that never released their info.

internal/postgres: refine trigger for symbol search golang/pkgsite

by Jonathan Amsterdam

The trigger updating symbol_search_documents.imported_by_count now fires only when that column actually changes. The result is over 100x speedup for updating module import counts, a pkgsite backend change you feel only as faster search indexing.

cmd/compile/internal/syntax: return string rather than []byte from source.segment golang/go

by Robert Griesemer

source.segment switched from []byte to string after the team found every call but the keyword case converted anyway, and the compiler separately learned to handle NUL bytes and tightened shift type-checking. Alongside these: UUID.Compare went constant-time, a golang/net change ensures raw text rendering, and Windows SendFile stopped reporting partial 2 GiB+ transfers as success.

$ ls golang/month/ # the briefings behind this review

Thu Oct 1 net/http splits HTTP/2 build tags, SSA stops leaking type info Fri Oct 2 html/template escapes JS context, gopls fixes inline call analysis Sat Oct 3 Go toolchain patches three CVEs in module and template verification Sun Oct 4 vscode-go drops VS Code engines older than v1.110 Mon Oct 5 SVE mask predicates land in archsimd; crypto audits ssh for Unicode string calls Tue Oct 6 Go 1.28's string(int) ban gets migration tooling; x509 macOS crash fixed Wed Oct 7 Windows async preemption paused during exception handling Thu Oct 8 gopls boots one daemon for every subcommand, and the compiler learns to see NUL bytes Fri Oct 9 Go's HTTP stack gets a hardening wave, x/crypto fixes a LoongArch keystream bug Sat Oct 10 Deprecations land in net and go/build, gopls fixes shadowing and overlay handling Sun Oct 11 golang.org/x dependency bumps land across build, pkgsite, vuln, and mobile Mon Oct 12 golang/crypto ssh accepts trailing banner data Tue Oct 13 gopls deletes MoveType, Go telemetry hardens paths and dates Wed Oct 14 Go tooling gets lossless float constants, split DWARF lands on Darwin Thu Oct 15 x/crypto ssh/terminal gets go fix inlines, riscv64 jumps corrected Fri Oct 16 gopls v0.24.0 lands, with pinning and filepath fixes behind it Sat Oct 17 Mach-O linking fix on Darwin ARM64, and a 2.7x SGEMM baseline Sun Oct 18 Pethost joins the Go wiki's GoUsers list Mon Oct 19 ppc64le compiler preps for SIMD with F31 and vector registers Tue Oct 20 Go distrusts a set of x509 intermediates, shift type-checking tightened Wed Oct 21 gopls enables MoveDeclaration and cuts cold-check I/O Thu Oct 22 UUID.Compare goes constant-time, synctest gets out of WaitGroup's way Fri Oct 23 Compiler fixes land for escaping slices and arm64 constants, golang/net hardens ipv4 and ipv6 parsing Sat Oct 24 Go test cache hits get 100x faster, as three net/http and mime parser changes land Sun Oct 25 Windows CPU profiler timer fallback, plus vet cache race fix Mon Oct 26 Compiler tightens limits propagation as x509 distrust rationale lands Tue Oct 27 Compiler prove pass gets 43x faster on huge switches Wed Oct 28 Raw text rendering fix in golang/net, and faster darwin builders Thu Oct 29 Linker fix for over-aligned text sections, simd internal refactor Fri Oct 30 Windows SendFile was reporting partial 2 GiB+ transfers as success Sat Oct 31 Compiler speedups land as prove's jump-table scan goes

all golang reviews →

← previous month golang wire →