Golang Weekly Issue 600: May 8, 2026

#600 — May 8, 2026

Together with

Go 1.26.3 and Go 1.25.10 Released with 11 Security Fixes — The headline issue is a module-proxy checksum bypass that lets untrusted proxies serve altered modules and Go toolchains, but areas as diverse as net/mail, go bug, net/http and html/template also get fixes. The proxy bug was found by an LLM, and over on Bluesky, Russ Cox apologized for its long-term presence.

Go Security Team

Azure HorizonDB at POSETTE: An Event for Postgres 2026 — Explore 44 talks about Azure HorizonDB, PostgreSQL-backed app development, Postgres performance & AI, Postgres 19 and more at POSETTE 2026, a free & virtual developer event, happening 16-18 Jun. Don’t miss your favorites - use Add to Calendar.

Microsoft | AMD sponsor

How Figma Built the Bouncer It Needed for Postgres in Go — Figma’s database team built their own Postgres connection pooler in Go on top of jackc/pgx and backpressure. It’s not open source (yet) but they go deep into the design here, complete with plentiful illustrations.

He, Goh, and Baid (Figma)

THREE GO PROPOSALS:

Felix Geisendörfer has proposed adding an rss profile type to runtime/pprof to broaden the view of overall physical memory usage.
Cherry Mui proposed enabling AMD64 architecture-specific SIMD intrinsics by default. There's still work to do, though, so it's not going to happen till Go 1.28.
Neal Patel has suggested go doc gets a -test option to include symbols from test files in documentation, such as may be useful for LLM agents.

Notes From Optimizing CPU-Bound Go Hot Paths — Lessons learned from optimizing CPU-bound hot paths while porting Brotli to pure Go, including how Go’s abstractions can impact performance in hot loops, what does and doesn’t get inlined, and some workarounds.

Andrii Berezhynskyi

One Database. Zero Pipelines. Full Postgres — Extend Postgres: hypertables, 95% compression, continuous aggregates. Analytics on live data. $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

📄 Hoisting Wire Plumbing Out of Your Go Handlers – Write your Go handler plumbing once, not once per endpoint. Redowan Delowar

📄 A Gopher Meets a Crab – A Go developer's tale of spending time trying to "fit Rust into a Go-shaped brain." Paul Hinze

🛠 Code & Tools

Solod v0.1: Go Ergonomics, Practical Stdlib, Native C Interop — For the past few months, Anton has been working on this system-level language with a Go syntax and no runtime. v0.1 has ports of key parts of the stdlib like io, bytes, fmt, os, time, and strings. This post includes benchmarks and examples, including how Solod can interface with SQLite.

Anton Zhiyanov

💡 There are some parallels in the Ruby world, where Ruby's creator, Matz, is working on Spinel, a compiler that similarly compiles a subset of Ruby to C.

Boring: A Single-Binary SSH Tunnel Manager — An SSH tunnel manager that "just works": single binary, TOML config, ssh_config compatibility, automatic reconnects, and a TUI for starting/stopping tunnels on demand.

Florian Becker

mvm: A Fresh Take on an 'Interpreter' for Go — Six years ago we first featured yaegi (Yaegi is Another Elegant Go Interpreter), a Go interpreter suitable for embedding into other apps. mvm, from the creator of yaegi, is a new take on the idea, instead compiling Go to bytecode for a VM to run.

Marc Vertes

💡 There's a web-based playground where you can give mvm a spin.

go-githubapp: A Go Library for Building GitHub Apps — A simple framework for building GitHub Apps that handle GitHub webhooks.

Palantir

📷 imagemeta v1.0 – Extract EXIF and XMP metadata from JPEG, HEIC, AVIF, TIFF and RAW camera images.
gotreesitter 0.16 – Pure-Go tree-sitter runtime (no Cgo). v0.16 adds native UTF-16 parsing/editing.
postgresparser 1.2 – ANTLR-based pure-Go PostgreSQL-dialect SQL parser.
go-github 86.0 – Go client library for GitHub's REST API (v3).

📰 Classifieds

CodeRabbit: Your team's second brain. Now in Slack. One agent for your entire SDLC to keep context and cut review time. Trusted by 6M+ repos.

⚙️ Go finally has an AI agent framework that isn't a Python port. Agents as http.Handlers, orchestrate LLMs & Claude Code. Open source. agentfield.ai.