$ tail -f topics/go.log
Daily updates from Go and the cloud-native infrastructure written in it - Kubernetes, HashiCorp's stack, and the Go standard library.
21 updates across 3 projects this week.
One calm review of what shipped across Go - the commits, releases, and security advisories that matter. Every Monday, with security advisories same-day. Free, unsubscribe in one click.
We'll start you on the top Go projects - refine anytime. · Read a sample issue →
Kubernetes
The cloud-provider-gcp team reverted a critical library update after discovering it broke node lifecycle permissions, leaving orphaned GCE instances stranded in clusters.
read --wire →
Go
The Go ecosystem's documentation and tooling infrastructure jumped a major version overnight, trading deprecated patterns for stdlib-native approaches.
read --wire →
HashiCorp
Vault's JWT auth plugin is shipping a toolchain upgrade while HashiCorp audits its entire plugin ecosystem for licensing compliance.
read --wire →
Kubernetes
Kops shipped critical version gating for a CSI feature that was breaking cluster validation on older Kubernetes releases, while the vSphere cloud provider decoupled itself from API versioning to support multiple VM Operator versions simultaneously.
read --wire →
Go
Gopls shipped interactive refactoring capabilities while the Go runtime rewrote its hash functions to leverage SIMD intrinsics for measurable throughput gains.
read --wire →
HashiCorp
Nomad Autoscaler now properly excludes out-of-window checks from scaling decisions, preventing phantom participants from skewing autoscaling logic.
read --wire →
Kubernetes
The core Kubernetes project is hardening its declarative validation test suite while simultaneously rolling out a fresh kube-openapi build across the scheduler, endpoint slice, and dynamic resource allocation components.
read --wire →
Go
Go's package discovery API just got faster and more informative—hardcoded constraints are gone, and clients can now read version timestamps directly from module metadata.
read --wire →
HashiCorp
Consul-K8s shipped an emergency security fix overnight for a cookie attribute injection vulnerability in Tornado that could expose your gateway API layer.
read --wire →
Kubernetes
The core Kubernetes project reversed a nine-year deprecation on enable-logs-handler while simultaneously purging locked GA feature gates from the API machinery, signaling a shift toward pragmatism over rigid deprecation timelines.
read --wire →
Go
Go's http2 package accidentally dropped critical symbols in the 1.27 build — they're back now, preserving compatibility for applications relying on ErrNoCachedConn, ErrPushLimitReached, and friends.
read --wire →
HashiCorp
Terraform azurerm reaches v4.72.0 with a new list resource for subnets and Go 1.25.10 bump, while vault-provider hardens its AWS/GCP integration layer across the stack.
read --wire →
Kubernetes
Kops migrated the kubelet away from CLI flags to config files [ref:14], while test infrastructure dropped unnecessary source checkouts that were slowing every periodic job by a minute.
read --wire →
Go
Go just patched a panic in Windows syscalls that could crash net.Dial and LookupPort, and tightened sumdb validation to block a proxy attack vector that could slip corrupted modules past verification.
read --wire →
HashiCorp
HashiCorp shipped emergency security upgrades to Jinja2 and pymdown-extensions across Consul Kubernetes, closing HTML attribute injection and Markdown processing vulnerabilities that could enable XSS attacks.
read --wire →
Kubernetes
Kubernetes is gutting seven-year-old containerized mounter code and streaming images directly into containerd—a two-part nodeup overhaul that cuts disk I/O and hardens image verification.
read --wire →
Go
Go shipped a critical fix for a denial-of-service vulnerability in the mime package's WordDecoder that could consume unbounded CPU on malformed headers [ref:1], while the security team locked down FIPS 140-3 cryptographic module documentation across the ecosystem.
read --wire →
HashiCorp
HashiCorp's Terraform Enterprise client library now manages SCIM group mappings at scale, while Nomad's UI completes its migration to the latest Ember LTS with stability improvements across the stack.
read --wire →
Kubernetes
kOps just dropped two massive dependency chains it barely used — cutting 43k lines of vendored code and simplifying its cloud provider story.
read --wire →
Go
gopls just closed a security gap that could have exposed your debug server to the network, while the standard library gates the new JSON format tag behind an experiment flag.
read --wire →
