Go 1.26.3 and Go 1.25.10 Released with 11 Security Fixes — The headline issue is a module-proxy checksum bypass that lets untrusted proxies serve altered modules and Go toolchains, but areas as diverse as net/mail, go bug, net/http and html/template also get fixes. The proxy bug was found by an LLM, and over on Bluesky, Russ Cox apologized for its long-term presence.

Go Security Team

THREE GO PROPOSALS:

• Felix Geisendörfer has proposed adding an rss profile type to runtime/pprof to broaden the view of overall physical memory usage.

• Cherry Mui proposed enabling AMD64 architecture-specific SIMD intrinsics by default. There's still work to do, though, so it's not going to happen till Go 1.28.

• Neal Patel has suggested go doc gets a -test option to include symbols from test files in documentation, such as may be useful for LLM agents.

Notes From Optimizing CPU-Bound Go Hot Paths — Lessons learned from optimizing CPU-bound hot paths while porting Brotli to pure Go, including how Go’s abstractions can impact performance in hot loops, what does and doesn’t get inlined, and some workarounds.

Andrii Berezhynskyi

📄 Hoisting Wire Plumbing Out of Your Go Handlers – Write your Go handler plumbing once, not once per endpoint. Redowan Delowar

📄 A Gopher Meets a Crab – A Go developer's tale of spending time trying to "fit Rust into a Go-shaped brain." Paul Hinze

Solod v0.1: Go Ergonomics, Practical Stdlib, Native C Interop — For the past few months, Anton has been working on this system-level language with a Go syntax and no runtime. v0.1 has ports of key parts of the stdlib like io, bytes, fmt, os, time, and strings. This post includes benchmarks and examples, including how Solod can interface with SQLite.

Anton Zhiyanov

💡 There are some parallels in the Ruby world, where Ruby's creator, Matz, is working on Spinel, a compiler that similarly compiles a subset of Ruby to C.

Boring: A Single-Binary SSH Tunnel Manager — An SSH tunnel manager that "just works": single binary, TOML config, ssh_config compatibility, automatic reconnects, and a TUI for starting/stopping tunnels on demand.

Florian Becker

mvm: A Fresh Take on an 'Interpreter' for Go — Six years ago we first featured yaegi (Yaegi is Another Elegant Go Interpreter), a Go interpreter suitable for embedding into other apps. mvm, from the creator of yaegi, is a new take on the idea, instead compiling Go to bytecode for a VM to run.

Marc Vertes

💡 There's a web-based playground where you can give mvm a spin.

• 📷 imagemeta v1.0 – Extract EXIF and XMP metadata from JPEG, HEIC, AVIF, TIFF and RAW camera images.

• gotreesitter 0.16 – Pure-Go tree-sitter runtime (no Cgo). v0.16 adds native UTF-16 parsing/editing.

• postgresparser 1.2 – ANTLR-based pure-Go PostgreSQL-dialect SQL parser.

• go-github 86.0 – Go client library for GitHub's REST API (v3).