Hooking into the Go toolchain

#​620 — October 9, 2026

Read the Web Version

ℹ️ We're back, but we're taking another break next week, so we'll see you again on Friday, October 23! :-)
__
Your editor, Peter Cooper

Go Weekly

The Data Race That Wasn't a Bug (and the One That Was) — Client.Do can return before net/http has finished reading your request body, so reusing the buffer can trigger a data race. A walk through the transport’s goroutines and why VictoriaMetrics kept one such race but fixed another.

Jesús Espino

Nail Your Complex Go Backend — Adding a feature shouldn't break three other things. Learn advanced backend patterns by building a food delivery platform, by hand or with your coding agent. Enrollment opens in two weeks. Join the waitlist so you don’t miss it!

Three Dots Labs sponsor

Hooking into the Go Toolchain — A deep tour of go build -toolexec for wrapping compiler and linker runs, starting with a simple timer and moving on to rewriting code mid-build, patching importcfg to add new imports, and more.

Kemal Akkoyun

IN BRIEF:

• 🔐 Go 1.27.2 and 1.26.9 have been released with 15 security fixes, mostly in net/http, plus a fix for a compiler bug that could corrupt values.
• 📊 Every Go release since 2013, benchmarked. The same benchmark programs took 11.5% less time on Go 1.27 than on 1.23, and ~41% less than on 1.2.
• 🔒 Google has paused bounties for product vulnerabilities in Go and its other open source projects after a flood of mostly invalid automated reports.
• 🇯🇵 GopherCon Japan 2027's CFP is open until October 25 if you fancy speaking at the (bilingual) event in Tokyo next February.

Hacking the Go Compiler to Efficiently Map IPv4 to IPv6 — A small IPv4-to-IPv6 conversion led Vincent through noder hacks, SSA rewrite rules, and compiler pass ordering to close a ~8x performance gap.

Vincent Bernat

Arch-Specific SIMD in Go — A follow-up to the Go team’s look at platform-independent SIMD in Go covering the experimental archsimd package, which now supports arm64 and wasm, plus tips for writing SIMD code that compiles well.

Junyang Shao and David Chase (Go Team)

Don't Couple Your Go Code to GitHub — Is putting github.com in import paths a problem? Iain thinks so, and makes the case for using your own domain instead, but it kicked off a lively debate on Hacker News.

Iain Cambridge

Ship Go Features, Not Data Pipelines — TimescaleDB extends Postgres so your Go service gets fast analytics without a second system. Get $1000 credit.

Tiger Data (creators of TimescaleDB) sponsor

📄 Poisoning a Go Build Cache – A hands-on look at how $GOCACHE works and why sharing it in CI can be risky. Lukas Schwab

📄 Go 1.27 Detects Goroutine Leaks: I Tested It on Mine – With three caught, but one notable miss. Jules Robineau

📄 Logs in Parallel Go Tests and Where to Find Them – Hint: Go 1.25’s t.Output() is your friend. Artur Dryomov

🛠 Code & Tools

Francis: Durable Actors, Jobs and Workflows for Go — Durable actors, cron jobs, background jobs with retries, rate limiting and saga-style workflows, embedded in your app and backed by SQLite or Postgres, with an optional standalone runtime for larger clusters.

Alessandro Segala

connect-go v2 Arrives with Simpler, gRPC-Go-Style Handlers — Buf's Go RPC library drops its generic request and response wrappers, splits HTTP out from the core, and no longer sends plain Go error messages to clients. There's a migration tool, and v1/v2 can coexist in one module.

Buf

fx 40: Interactive Terminal JSON Viewer and Processor — We've linked fx a few times over the years, but v40 is a huge release: write queries inside the viewer and watch results update as you type, plus XML, HTML, EDN and MAML input, and vim-style commands.

Anton Medvedev

• gopls 0.24 Prerelease – Now with LSP 3.18 support, better Go assembly handling, and a new analyzer for inconsistent E/*E error use.
• Echo 5.4 – The web framework fixes several security issues (some fixes change behavior). 4.16 gets them too.
• 🤖 GitHub MCP Server 2.0 – GitHub's official, Go-powered MCP server adds structured outputs for agents.
• Rill 0.9 – Composable, channel-based concurrency toolkit, now with first-class context support. v1.0 is not far away.
• gomponents 1.4 – Build HTML views as plain Go functions. Now with faster rendering and an official agent skill.

📰 Classifieds

POKE (Publish Once, Kickoff Everywhere) is a free agent skill that audits your Go code and helps you add events, SSE and Standard Webhooks.

🐘 Many Go backends end up talking to Postgres, so you may also like our other newsletter: Postgres Weekly.

📢 Elsewhere in the ecosystem

• ✨ GoNIX is a UNIX-like OS that boots a Linux kernel and hands off to a Go init, with coreutils, networking, and an SSH server, all written in Go too. After some teething problems, which I reported to its creator, the instructions to boot it on Apple silicon now work well (as above). A neat experiment!
• From the same author, James Mills, also comes Parley, a "federated, decentralised chat that speaks plain IRC".
• Neki, PlanetScale's new sharded Postgres offering, sits behind a Go-powered proxy, and this look at its design shows how it avoids decoding Postgres wire data it doesn't need to touch.
• Mitchell Hashimoto has proposed OSC 7501, a terminal protocol that lets programs report their status to the terminal. Bubble Tea 2.1 (released this week) already supports it.
• 🕹️ Fancy some late '90s real-time strategy? Nanolathe reimplements Total Annihilation's engine in Go, and you can play a demo in your browser.