RepoJournal

$ cat golang/week/2026-08-31.log

Go

Go

the week in review · Aug 31 – Sep 6, 2026

crypto/ssh CheckCert enforces source address

♥

Toolchain internals dominate: recover inlining, riscv64 codegen cuts, and net/http cancellation deprecation all landed.

131 commits 7 briefings covered
← previous week golang wire →

What shipped: The crypto/ssh source-address critical option is now enforced in CheckCert [1], and semaphore panics on negative capacity [2]. The compiler now inlines functions that call recover [3], and net/http's Transport.CancelRequest became a no-op [4], deprecated in favor of context-based cancellation.

Why it matters: The CancelRequest change [4] should prompt code review today: any code still calling that method now does nothing, which can leave requests running. The recover inlining [3] and riscv64 masking removal [5] offer small performance gains in specific paths, but the ssh fix [1] closes a real security check gap.

Under the hood: The compiler also hardened SIMD codegen by not letting no-code SIMD values imply CPU features [6], and added a tail call DCE fix [7]. The net/quic API added Stream.StopSending [8], while os examples now use errors.Is instead of deprecated helpers [9]. Also: crypto/tls frees pinned buffers earlier, crypto/x509 tightens URI matching [1], and go/ssa now propagates receiver instantiation to nested functions .

References

  1. [1] ssh: don't skip the source-address critical option in CheckCert ↗ golang/crypto
  2. [2] semaphore: panic on negative capacity ↗ golang/sync
  3. [3] cmd/compile: allow inlining of functions that call recover ↗ golang/go
  4. [4] net/http: make Transport.CancelRequest into a no-op ↗ golang/go
  5. [5] cmd/compile/internal/ssa: remove unnecessary masking with shifts on riscv64 ↗ golang/go
  6. [6] cmd/compile: don't let no-code SIMD values imply CPU features ↗ golang/go
  7. [7] cmd/compile: make indvar min limit visible in its block ↗ golang/go
  8. [8] quic: add Stream.StopSending, and rework stream/application errors ↗ golang/net
  9. [9] os: update examples to use errors.Is instead of deprecated helpers ↗ golang/go

$ ls golang/week/ # the briefings behind this review

Mon Aug 31 ssh CheckCert now enforces source-address, semaphore rejects negative capacity Tue Sep 1 Compiler inlines recover, http.Transport.CancelRequest becomes a no-op Wed Sep 2 Go compiler drops unnecessary riscv64 masking and hardens SIMD codegen Thu Sep 3 x/tools protocol shift, masked heap prefix fix Fri Sep 4 Plugin itabs double-inserted; symbol insertion skips large modules Sat Sep 5 crypto/tls frees pinned buffers, compiler tail call DCE fix lands Sun Sep 6 crypto/x509 tightens URI and email name constraint matching
← previous week golang wire →