$ ls golang/reviews/ # the step-back reads
Go in review
One review per week (and month): what shipped, what broke, what to act on.
Nov 2–8, 2026 weekly [act] 8 stories
FIPS 140 crypto fixes land across SHA-3, TLS 1.2, HKDF
Three separate approvals bugs: legacy Keccak and SHA-384 extended master secrets recorded as non-approved, plus an HKDF-Expand HMAC key l...
Oct 26–Nov 1, 2026 weekly 8 stories
x509 distrust rationale documented, prove compiler pass speeds up
Two net-adjacent behavior fixes, one in Resolver.LookupNetIP and one in golang/net's raw text rendering, ship alongside a leak fix in run...
Oct 19–25, 2026 weekly [act] 8 stories
Go x509 stops trusting a set of intermediates
CVE-2026-111943 filters chains by SHA-256 SPKI hash, while the type checker tightens shift rules for untyped and non-constant operands.
Oct 12–18, 2026 weekly [plan] 8 stories
gopls v0.24.0 ships, MoveType code action deleted
The same week brought an SSH handshake fix for intermittent failures against non-OpenSSH servers, and a lossless float protocol bump in g...
Oct 5–11, 2026 weekly [act] 8 stories
Go 1.28 string(int) ban gets migration tooling
gopls and the stringintconv analyzer now offer behavior-preserving fixes so modules can migrate before raising their go directive.
Oct 1–31, 2026 monthly [act] 8 stories
Go toolchain patches three CVEs as gopls hits v0.24.0
Template context escaping and toolchain checksum verification both changed behavior, so rebuilds that previously passed may not.
Sep 28–Oct 4, 2026 weekly [act] 8 stories
Go toolchain patches three CVEs in module and template verification
html/template and x/net/http2 both ship breaking security fixes, while Go 1.27's JSON v1 shim restores a field callers depend on.
Sep 21–27, 2026 weekly [act] 8 stories
Go strips malformed HTTP/2 headers, moves HTTP/3 into std
The header deletion closes a response-smuggling path; HTTP/3 now lives in an internal std package, cutting repeated vendoring.
Sep 14–20, 2026 weekly [plan] 8 stories
Go 1.27.1 lands as plan9 early export disabled
The week's fixes span Windows handle adoption, math/big correctness, and a real localhost resolution change in the Go resolver.
Sep 7–13, 2026 weekly [plan] 8 stories
Go unified V5 export data lands, then reverts
Compiler fixes for interface hashing, an HTTP/1 deadlock, and a net/http TLS gap also shipped this period.
Sep 1–30, 2026 monthly [act] 8 stories
Go inliner learns to fold recover calls
September also brought a no-op Transport.CancelRequest, a signed-integer comparison fix in pkgsite, and a newly documented LLM-report pol...
Aug 31–Sep 6, 2026 weekly [plan]
crypto/ssh CheckCert enforces source address
Toolchain internals dominate: recover inlining, riscv64 codegen cuts, and net/http cancellation deprecation all landed.
Aug 24–30, 2026 weekly
Go tightens crypto, shrinks loong64, narrows HTTP/2
The week in Go was defined by a crypto fix that closes a knownhosts revocation gap, a wave of loong64 optimizations that cut 7,128 instru...
Aug 1–31, 2026 monthly
Go compiler hardens binaries, crypto tightens SSH safety
The Go project spent August fixing pointer-offset bugs that inflated binaries and threatened correctness, then shored up SSH, HTTP/2, and...
Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.