Go tightens crypto, shrinks loong64, narrows HTTP/2

The most consequential change of the week: ssh/knownhosts now compares only the public key portions when checking a host key against a revocation list [1]. Previously, the full key (including comment and options) was matched, so a valid host key with a different comment could bypass revocation. ssh/knownhosts also now handles the case where a key has no comment, tightening the gap that allowed revoked keys to pass.

loong64 received a substantial performance push across several packages. cmd/compile fixed sign/zero-extension removal on loong64 [2], and crypto/internal/fips140/aes added LSX assembly for AES block operations and CTR mode [3][4]. hash/crc32 unrolled its CRC32 update loops to process 32 bytes per iteration [5]. Combined, these changes shrink the loong64 Go binary by 7,128 instructions, a notable win for a relatively young architecture.

In the standard library, crypto/tls made deleting a missing session cache key a no-op [6], fixing a session cache leak that could occur when a key was deleted twice. This is a subtle but real fix for long-running TLS servers. Meanwhile, net/http now aborts writes when it detects a dead connection, which broke a Solaris fuzz test during the week, a reminder that connection handling changes can have platform-specific fallout.

The week also saw a deprecation of direct HTTP/2 transport use, with the release notes documenting the change. The Go team also documented the retroactive removal of the tlkskyber GODEBUG flag [7], and flag gained All iterators and Flag.IsSet [8], giving developers a cleaner way to enumerate and query flags. The release notes also mention changes to GOEXPERIMENT=jsonv2 [9].

Finally, tooling and infrastructure work continued. cmd/goimports now skips an lstat per file, a small but welcome speedup for large trees. gopls updated staticcheck to 2026.2.1 (v0.8.1) [10], and internal/breakings work added type strings for functions, structs, and generic functions [11], improving how pkgsite reports breaking changes. encoding/gob now returns encoderState after encoding nil interfaces [12], and fmt skips an interface conversion for method-less types [13], both micro-optimizations that reduce allocations in hot paths.

For most readers, the actionable items are to review any code that relies on ssh/knownhosts revocation matching (upgrade to the latest golang/crypto) and to re-run benchmarks on loong64 if you deploy there, since the binary size and AES/CRC32 performance changed materially.