--- title: "11 security fixes land in Go" publication: "Go Weekly" issue: 600 published_at: "2026-05-08" canonical_url: "https://golangweekly.com/issues/600" --- Plus Figma's Go-powered Postgres pooler, a runtime-free Go dialect for systems programming, and 3 fresh Go proposals. #​600 — May 8, 2026 [Read the Web Version](https://golangweekly.com/issues/600) Together with [![Microsoft\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_280,h_60/e_make_transparent/co_white,e_outline:7/om9hjsmudy5lsvba59eb.png)](https://posetteconf.com/2026/schedule/) Go Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/c8ihcntrn5z21g0skzmt.jpg)](https://groups.google.com/g/golang-announce/c/qcCIEXso47M) [Go 1.26.3 and Go 1.25.10 Released with 11 Security Fixes](https://groups.google.com/g/golang-announce/c/qcCIEXso47M) — The headline issue is a module-proxy checksum bypass that lets untrusted proxies serve altered modules and Go toolchains, but areas as diverse as `net/mail`, `go bug`, `net/http` and `html/template` also get fixes. The proxy bug was found by an LLM, and over on Bluesky, [Russ Cox apologized](https://bsky.app/profile/swtch.com/post/3mlc74hct3k2s) for its long-term presence. Go Security Team [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/5dd244c1.png)](https://posetteconf.com/2026/schedule/) [Azure HorizonDB at POSETTE: An Event for Postgres 2026](https://posetteconf.com/2026/schedule/) — Explore 44 talks about Azure HorizonDB, PostgreSQL-backed app development, Postgres performance & AI, Postgres 19 and more at POSETTE 2026, a free & virtual developer event, happening 16-18 Jun. Don’t miss your favorites - use [Add to Calendar](https://posetteconf.com/2026/schedule/). Microsoft | AMD sponsor [How Figma Built the Bouncer It Needed for Postgres in Go](https://www.figma.com/blog/pgkeeper-building-the-bouncer-we-needed-for-postgres/) — Figma’s database team built their own Postgres connection pooler in Go on top of [jackc/pgx](https://github.com/jackc/pgx) and [backpressure](https://pkg.go.dev/github.com/bradenaw/backpressure). It’s not open source (yet) but they go deep into the design here, complete with plentiful illustrations. He, Goh, and Baid (Figma) **THREE GO PROPOSALS:** - Felix Geisendörfer has [proposed adding an `rss` profile type](https://github.com/golang/go/issues/79179) to `runtime/pprof` to broaden the view of overall physical memory usage. - Cherry Mui [proposed enabling AMD64 architecture-specific SIMD intrinsics](https://github.com/golang/go/issues/78979) by default. There's still work to do, though, so it's not going to happen [till Go 1.28.](https://github.com/golang/go/issues/78979#issuecomment-4391160592) - Neal Patel has [suggested `go doc` gets a `-test` option](https://github.com/golang/go/issues/79204) to include symbols from test files in documentation, such as may be useful for LLM agents. [Notes From Optimizing CPU-Bound Go Hot Paths](https://blog.andr2i.com/posts/2026-05-03-notes-from-optimizing-cpu-bound-go-hot-paths) — Lessons learned from optimizing CPU-bound hot paths while porting Brotli to pure Go, including how Go’s abstractions can impact performance in hot loops, what does and doesn’t get inlined, and some workarounds. Andrii Berezhynskyi [One Database. Zero Pipelines. Full Postgres](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=golang-weekly-newsletter) — Extend Postgres: hypertables, 95% compression, continuous aggregates. Analytics on live data. [$1000 credit to start](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=golang-weekly-newsletter). Tiger Data (creators of TimescaleDB) sponsor 📄 [Hoisting Wire Plumbing Out of Your Go Handlers](https://rednafi.com/go/hoist-wire-plumb/) – Write your Go handler plumbing once, not once per endpoint. Redowan Delowar 📄 [A Gopher Meets a Crab](https://miren.dev/blog/gopher-meets-crab) – A Go developer's tale of spending time trying to _"fit Rust into a Go-shaped brain."_ Paul Hinze 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/garc1tzpy9eav7a5koc7.jpg)](https://antonz.org/solod-v0-1/) [Solod v0.1: Go Ergonomics, Practical Stdlib, Native C Interop](https://antonz.org/solod-v0-1/) — For the past few months, Anton has been working on this system-level language with a Go syntax and no runtime. v0.1 has ports of key parts of the stdlib like `io`, `bytes`, `fmt`, `os`, `time`, and `strings`. This post includes benchmarks and examples, including how Solod can interface with SQLite. Anton Zhiyanov 💡 There are some parallels in the Ruby world, where Ruby's creator, Matz, is working on [Spinel](https://rubyinside.com/spinel/), a compiler that similarly compiles a subset of Ruby to C. [Boring: A Single-Binary SSH Tunnel Manager](https://alebeck.github.io/boring/) — An SSH tunnel manager that "just works": single binary, TOML config, `ssh_config` compatibility, automatic reconnects, and a TUI for starting/stopping tunnels on demand. Florian Becker [mvm: A Fresh Take on an 'Interpreter' for Go](https://mvm.sh/) — Six years ago we first featured [yaegi](https://github.com/traefik/yaegi) (Yaegi is Another Elegant Go Interpreter), a Go interpreter suitable for embedding into other apps. `mvm`, from the creator of yaegi, is a new take on the idea, instead compiling Go to bytecode for a VM to run. Marc Vertes 💡 There's [a web-based playground](https://mvm.sh/playground/) where you can give mvm a spin. [go-githubapp: A Go Library for Building GitHub Apps](https://github.com/palantir/go-githubapp) — A simple framework for building GitHub Apps that handle GitHub webhooks. Palantir - 📷 [imagemeta v1.0](https://github.com/evanoberholster/imagemeta) – Extract EXIF and XMP metadata from JPEG, HEIC, AVIF, TIFF and RAW camera images. - [gotreesitter 0.16](https://github.com/odvcencio/gotreesitter/releases/tag/v0.16.0) – Pure-Go [tree-sitter](https://tree-sitter.github.io/tree-sitter/) runtime (no Cgo). v0.16 adds native UTF-16 parsing/editing. - [postgresparser 1.2](https://github.com/ValkDB/postgresparser) – ANTLR-based pure-Go PostgreSQL-dialect SQL parser. - [go-github 86.0](https://github.com/google/go-github/releases/tag/v86.0.0) – Go client library for [GitHub's REST API](https://docs.github.com/en/rest?apiVersion=2026-03-10) (v3). 📰 Classifieds [CodeRabbit](https://fandf.co/4n1brGW): Your team's second brain. Now in Slack. One agent for your entire SDLC to keep context and cut review time. Trusted by 6M+ repos. --- ⚙️ [Go finally has an AI agent framework that isn't a Python port](https://agentfield.ai/github/?utm_source=golang&utm_medium=newsletter&utm_campaign=golang-0604&utm_id=golang-060424-github-cta&utm_content=github-cta). Agents as `http.Handler`s, orchestrate LLMs & Claude Code. Open source.[agentfield.ai](https://agentfield.ai/?utm_source=golang&utm_medium=newsletter&utm_campaign=golang-0604&utm_id=golang-060424-home-cta&utm_content=home-cta). Curated by Peter Cooper and [Glenn Goodrich](https://twitter.com/ruprict). Go is a [trademark of Google](https://go.dev/brand). The [Go gopher](https://go.dev/blog/gopher), whenever used, is an original creation by Renée French. [Change your email](https://golangweekly.com/edit_subscription/*|UID|*) [Stop getting this newsletter](https://golangweekly.com/leave/*|UID|*) © Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom