Go: Root Security Fix and a Network-Free Test Suite
A security fix closes a symlink escape bug in the os package's Root sandboxing, tracked as CVE-2026-39822, while a separate multi-commit effort strips network dependencies out of the command line tool's test suite for more reliable builds.
Duration: PT2M16S
Episode overview
This episode is a short developer briefing from Go.
It explains recent repository work in plain language.
- Show: Go
- Published: 2026-07-08T13:07:07Z
- Audio duration: PT2M16S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning. It's July 8th, 2026, and this is Go.
Today's top story is a security fix. The rest of the activity is one coordinated cleanup effort around testing reliability.
Start with the security issue. Damien Neil landed a fix, commit 82215dc, for a flaw in the os package's Root sandboxing feature. The bug: when a path ends in a trailing slash, the underlying system call was silently resolving symlinks anyway, even though Root's whole job is to prevent exactly that. A symlink…
The second theme is Michael Matloob's push to remove network access from the command line tool's script test suite, tracked under issue 80243. Nearly a dozen commits touch this. Tests like mod prefer compatible, mod gonoproxy, and gotoolchain version were quietly reaching out to real servers and real Git…
One more fix worth flagging: Mark Freeman's change in the type checker, commit 183e201, resolves a deadlock that could occur when importing generic methods with recursive bounds. Small fix, but it removes a real hang.
Looking ahead: expect the verylongtest tier to keep absorbing network-dependent tests as they get triaged, and expect Root's test matrix to keep expanding around symlink edge cases.
Nearby episodes from Go
- Tooling Fixes Tighten Edge Cases
- Regex Engine's Stale Flag Bug
- Weekly Recap - Correctness Fixes and Developer Ergonomics
- Making the Toolchain Do More Heavy Lifting
- Clearer Errors, Honest Documentation
- Standard Library Enhancement and Contribution Guidelines
- Weekly Recap - ARM64 & SIMD Performance Focus
- Compiler Fixes and Tool Improvements