$ cat golang/week/2026-10-19.log
the week in review · Oct 19 – Oct 25, 2026
Go x509 stops trusting a set of intermediates
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
CVE-2026-111943 filters chains by SHA-256 SPKI hash, while the type checker tightens shift rules for untyped and non-constant operands.
crypto/x509: distrust a handful of intermediates golang/go
Verify now drops a listed set of intermediates from returned chains, matched by SHA-256 SPKI hash, under CVE-2026-111943. Verify goes through CVE-2026-111943 whether or not your code touches certificates, so re-run any chain-building tests against pinned intermediates before the next rollout.
go/types, types2: fix shift checking for LHS operands involving shifted floats golang/go
The checker was rejecting shifts like (1.0 << s1) << s2, where the left operand is untyped but not constant, because it insisted too early that the LHS be something specific. Programs that already type-checked are unaffected; previously rejected code now compiles, and a companion change reports errors for oversized non-constant shift counts.
cmd/compile: utilize regMask to use F31, vector regs golang/go
A 64-entry regMask cap kept F31 out of the allocator, so the compiler now encodes F31 and the vector registers, including VS32 to VS63 and their aliases, ahead of ppc64le SIMD work. Nothing changes for amd64 or arm64 builds.
gopls/internal/filecache: reduce I/O parallelism golang/tools
Write parallelism in the file cache drops from 128 to 8. On a cold "gopls check" of k8s kubelet the change moved wall time from 22.2s to 20.0s and sys from 46.9s to 42.6s across three runs, with set and get accounting for 20% of CPU on macOS, mostly in open(2).
internal/poll: fix synchronous WSASendMsg byte counts on Windows golang/go
A dropped byte-count output pointer meant synchronous sends that complete without a completion-port notification reported no bytes written. Restoring it makes execIO return the real count on Windows, so callers reading that value no longer see zero.
gopls/internal: turn on MoveDeclaration codeaction by default golang/tools
The experimental setting gating MoveDeclaration is gone, so the code action is always available in gopls. The release notes say nothing about changing editor config; the capability simply appears.
uuid: use bytes.Compare in UUID.Compare golang/go
Compare walked UUIDs byte by byte, so cost scaled with the length of the shared prefix. bytes.Compare keeps the RFC 9562 lexicographic ordering and on arm64 compares the 16 bytes as two 64-bit words, which matters if you sort or compare UUIDs in hot paths.
internal/task: replace gcr.io/cloud-builders/npm with node:24.15.0 golang/build
The deprecated gcr.io/cloud-builders/npm image, frozen since 2022-10-25 at node-19.0.0 and node-18.12.0, gives way to node:24.15.0. This touches Go's own build pipeline only, not user code.
$ ls golang/week/ # the briefings behind this review
Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.