$ cat golang/week/2026-10-05.log
the week in review · Oct 5 – Oct 11, 2026
Go 1.28 string(int) ban gets migration tooling
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
gopls and the stringintconv analyzer now offer behavior-preserving fixes so modules can migrate before raising their go directive.
crypto/x509: fix crash on invalid UTF-8 DNSName in macOS verifier golang/go
Under the macOS verifier, CFStringCreateWithBytes fails on non-UTF-8 input and SecPolicyCreateSSL passed that failed result straight to CFRelease, crashing the process. It now returns an error for such hostnames, so certificate verification of a malformed DNSName is a failure you can handle rather than a dead process.
go/analysis/passes/stringintconv: make first fix behavior-preserving golang/tools
The analyzer's first suggested fix now preserves behavior, which matters because it has to be safe to apply before a module's go directive is raised to go1.28. That is what makes go fix usable as the migration path rather than a source of silent semantic changes.
gopls/internal/golang: quick fixes for go1.28 string(int) error golang/tools
The same two fixes the analyzer offers now appear as quick fixes on the type error itself, and this path exists because the stringintconv analyzer does not run on code that already fails to type-check. If you are sitting on a module full of string(int) conversions, this is the tooling that unblocks the upgrade.
runtime: skip async preemption during Windows exception handling golang/go
Injecting asyncPreempt into a thread in kernel mode, during exception handling or a page fault or a system call, could crash the process because the thread's context is not safe to modify there. The runtime now requests exception-stack-walking information and skips preemption in that state.
net/http: on Transport body write error, wait briefly for a response golang/go
When a server rejects a request and sends a response before closing the connection, the client saw two racing events: the response and its own body write error. Transport now waits briefly for the response instead of failing on the write error, which means error reporting from misbehaving servers lands on the response side.
log/slog: restore handler state when dropping an empty group golang/go
When ReplaceAttr removed every attribute in a group, appendAttr backed the buffer up to before the group name but left the rest of openGroup applied, so JSONHandler wrote subsequent attributes in the wrong place. Any handler that drops empty groups was exposed; the handler state is now restored.
ssh: check that no Unicode-aware string function is used golang/crypto
The SSH protocol and its file formats are byte oriented, and folding case or trimming space by Unicode rules can make a parser accept an entry its peers reject or end a field where they do not, the class of bug behind known CVE-grade flaws. The crypto tree now checks that no Unicode-aware string function is used there.
gopls/internal/cmd: start a daemon with -remote=auto golang/tools
Only serve could start a daemon with -remote=auto; remoteArgs now let any subcommand do it, and server notifications are handled sequentially so diagnostics stop getting dropped. gopls also got its integration tests off the serial queue with the Default and Forwarded dual modes and redundant server sessions cut.
$ ls golang/week/ # the briefings behind this review
Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.