Go: Security Hardening Across the Build and Runtime
Today's activity centers on closing security gaps — a JavaScript template injection fix, a cgo linker flag restriction, and a GCM buffer overrun — alongside a steady stream of compiler correctness work in the SSA backend.
Duration: PT2M32S
Episode overview
This episode is a short developer briefing from Go.
It explains recent repository work in plain language.
- Show: Go
- Published: 2026-07-21T13:07:49Z
- Audio duration: PT2M32S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
This is Go, your developer briefing for July 21st, 2026.
The clearest thread today is security hardening, touching three very different corners of the toolchain.
In html/template, PR 80485 fixes a JavaScript context-tracking bug where regular expression literals following certain control statements got misclassified, letting untrusted input inject a slash that terminates the literal and runs attacker JavaScript. That's a real cross-site scripting risk for anyone serving…
Right behind it, PR 80491 closes a build-time hole: the Darwin linker's section-create flag could be smuggled in through cgo LDFLAGS, letting a dependency force the Go build to read arbitrary files off disk. Going forward, that flag is rejected by default, with an explicit opt-in for teams that need it.
And in the crypto tree, Filippo Valsorda's commit e36c20c fixes a real memory-safety bug in the AES-GCM assembly: short authentication tags broke an assumption about how much data follows the ciphertext, risking out-of-bounds reads and writes. New boundary tests now wrap buffers in guard pages so any future…
The second theme is compiler correctness, mostly in the SSA layer. Keith Randall's mergelocals fix, commit…
Nearby episodes from Go
- Enum Proposals and Toolchain Edge Cases
- Weekly Recap - Compiler Precision and a Rocky Road to Optimization
- A Small Fix to a Long-Standing Doc Link
- Compiler Speed Gains, and Two Reverts Worth Remembering
- Hardware Atomics and Generic Inference Advance Together
- Closing the Gaps Between Intent and Implementation
- Go 1.28 Opens as Edge Cases Get Cleaned Up
- Tightening the Compiler, Documenting the Edges