$ cat golang/week/2026-10-26.log
the week in review · Oct 26 – Nov 1, 2026
x509 distrust rationale documented, prove compiler pass speeds up
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Two net-adjacent behavior fixes, one in Resolver.LookupNetIP and one in golang/net's raw text rendering, ship alongside a leak fix in runtime/cgo.
crypto/x509: document reason for custom distrust golang/go
The x509 maintainers have gone public with why a set of certificates was distrusted, now that the fix for the trivially exploitable vulnerability is out. The commit message says they deliberately stayed vague while preparing remediation so as not to tip their hand. Worth reading if you maintain trust stores or vendored roots.
cmd/compile: avoid scanning direct jump-table branches golang/go
prove now uses the predecessor edge's index when a jump-table successor has a single incoming edge, skipping the per-case scan of table successors. The dominance checks stay in place for other blocks.
cmd/compile: improve signed <-> unsigned limits propagation golang/go
The compiler tracks signed-to-unsigned range limits more precisely, which means better folding in prove. The contributor notes the change forced one test out of testdir into the ssa framework because prove now folds the case, an edge case they call out as easy to get wrong.
net: preserve IPv6 zone in Resolver.LookupNetIP golang/go
LookupNetIP was dropping the zone identifier on IPv6 addresses, so a link-local result came back without its interface. Fixed for anyone resolving addresses that carry zones.
html: check all ancestor namespace transitions when rendering raw text golang/net
The raw-text rendering check in golang/net now walks every ancestor namespace transition rather than stopping at the nearest foreign ancestor, which could itself sit under a foster-parented element. This is flagged as breaking, so pin your version if you parse untrusted HTML through this package.
runtime/cgo: destroy pthread attributes after use golang/go
The cgo thread creation paths initialized a fresh pthread attribute object per thread and never destroyed it. On OpenBSD that leaked about 50 bytes per thread; long-lived programs that spawn cgo threads now stop accumulating them.
regexp: fix Split with a positive count and an empty first match golang/go
Split returned fewer than n substrings when the expression could match the empty string at the start of the input, a regression from the earlier change that stops after n-1 matches. The fix counts substrings instead of matches.
simd: move sliceToString to simd/internal/simdfmt golang/go
sliceToString existed in three copies across simd, archsimd, and internal/bridge; it now lives in one package as SliceToString and runs in O(n) rather than O(n^2). Alongside: relnote checks now always run, syscall on Windows standardizes on SyscallN, the linker aligns split text sections for over-aligned functions, and pkgsite's vulndbreqs worker stops collecting per-IP request counts.
$ ls golang/week/ # the briefings behind this review
Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.