$ cat golang/week/2026-11-02.log
the week in review · Nov 2 – Nov 8, 2026
FIPS 140 crypto fixes land across SHA-3, TLS 1.2, HKDF
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Three separate approvals bugs: legacy Keccak and SHA-384 extended master secrets recorded as non-approved, plus an HKDF-Expand HMAC key length allowance removed.
crypto/internal/fips140/sha3: record legacy Keccak as non-approved golang/go
Legacy Keccak shares the Digest type with SHA-3 and Digest.Sum marked it approved, so HMAC and RSA-PSS/OAEP, which accept any *sha3.Digest and trust the hash's own indicator, recorded Keccak as approved too. If your FIPS path touches Keccak-derived HMAC or OAEP keys, that indicator was wrong.
crypto/internal/fips140/tls12: record SHA-384 as approved in MasterSecret golang/go
The extended master secret derivation recorded SHA-384 as non-approved because the output size was checked as 46 bytes instead of 48. Fixes an approval-record bug on any TLS 1.2 connection negotiated with SHA-384.
crypto/hkdf: remove unnecessary HMAC key length allowance for HKDF-Expand golang/go
HKDF-Expand drops an HMAC key length allowance that the change calls unnecessary, cleaning up the surrounding FIPS plumbing. Work under the same tracking issue as the SHA-3 and TLS 1.2 fixes.
net/rpc: document security policy explicitly golang/go
The security policy now states plainly that net/rpc is in scope, rather than leaving the implication that default encoding/gob use put it outside it. If you expose net/rpc on any untrusted network, treat it as you would any other RPC surface.
net/http: remove serverHandler golang/go
serverHandler had already been reduced to a thin wrapper after its OPTIONS *, DefaultServeMux fallback, and MultipartForm cleanup work moved elsewhere; this removes it. External packages that reached it via linkname are the ones to check.
simd/archsimd/_gen/simdgen: lower arm64 Neon ShiftAll* by a constant to immediate shifts golang/go
On arm64, ShiftAllLeft and ShiftAllRight by a constant now lower to immediate shifts, replacing the vector-shift with a scalar count inserted into lane 0 and broadcast. That broadcast was needed for variable counts; constants stop paying for it.
os: don't drop errors in RemoveAll on js/wasm and plan9 golang/go
The noat RemoveAll implementation redeclared err inside the loop, so errors from removing directory entries were collected in the loop-local variable and dropped. Affects js/wasm and plan9 only.
go/types, types2: refactor builtins.go (step 1 of 2) golang/go
Checker.builtins had grown past 1000 lines with a giant switch over every built-in; step one factors the cases out, and step two removes the old implementation's vestiges. No behavior change intended, but type-checker internals move.
$ ls golang/week/ # the briefings behind this review
Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.