--- title: "Why Cilium vendors every Go module in 2026" publication: "Go Weekly" issue: 601 published_at: "2026-05-15" canonical_url: "https://golangweekly.com/issues/601" --- Plus an even stricter `gofmt`, GoLand's newest EAP, and a fast set of B-tree-based collection types. #​601 — May 15, 2026 [Read the Web Version](https://golangweekly.com/issues/601) Together with [![Depot\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_1280,h_320/e_make_transparent/co_white,e_outline:20/lqhtj3olkxbq58buyzzc.png)](https://fandf.co/4ttYJ59) Go Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/zle6dzjkxagmovomofo1.jpg)](https://blog.trailofbits.com/2026/05/12/go-fuzzing-was-missing-half-the-toolkit.-we-forked-the-toolchain-to-fix-it./) ['Go Fuzzing Was Missing Half the Toolkit: We Forked the Toolchain to Fix It'](https://blog.trailofbits.com/2026/05/12/go-fuzzing-was-missing-half-the-toolkit.-we-forked-the-toolchain-to-fix-it./) — [Go’s fuzzer](https://go.dev/doc/security/fuzz/) lags the LibAFL-class tools Rust and C++ devs take for granted. Enter [gosentry](https://github.com/trailofbits/gosentry): a fork of the Go toolchain that runs `testing.F` harnesses on a LibAFL engine, adding struct-aware and grammar-based fuzzing, race and goroutine-leak detection. Together these surface bug classes the native fuzzer can miss. Kevin Valerio (Trail of Bits) [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/50ec984a.png)](https://fandf.co/4ttYJ59) [From 8 Seconds to Under 1: How Depot CI Boots Fast](https://fandf.co/4ttYJ59) — No warm pools, no pre-warming. Depot CI's microVMs start just-in-time, so cold boot speed is everything. The full optimization story: custom kernel, replacing systemd, ditching cloud-init, and tuning huge pages to [get from 8 seconds to under 800ms](https://fandf.co/4ttYJ59). Depot sponsor [How Cilium Hardens Its Go Supply Chain End to End](https://cilium.io/blog/2026/05/06/securing-cicd-open-source-lessons-from-cilium/) — Vendoring every Go module is just one of a dozen controls in Cilium’s GitHub Actions and supply chain playbook, from gating PR triggers to signing releases, with an honest list of the gaps they haven’t closed yet. André Martins and Feroz Salam (Cilium) 📊 [The GoLand 2026.2 Early Access Program](https://blog.jetbrains.com/go/2026/05/11/the-goland-2026-2-early-access-program-has-started/) — The commercial Go IDE focuses on performance, pulling perf work out of separate tools and into the IDE, like built-in profiler visualization and analysis, escape analysis, a struct layout optimizer, and real-time CPU/memory usage monitoring. Artem Pronichev (JetBrains) 💡 EAP builds are free to use for 30 days over the EAP cycle, so you can daily drive it for free until the beta. [btype: Fast B-Tree-Based Collection Types](https://github.com/tidwall/btype) — From the creator of [GJSON](https://github.com/tidwall/gjson) comes a new library offering B-tree-based collection types (including maps, sets, tables, queues, and stacks) that’s faster than existing B-tree implementations in Go, Rust, and C++. Josh Baker [Building a Distributed Search Engine in Pure Go](https://antfly.io/blog/distributed-search-engine-go) — Multi-Raft consensus, SIMD-accelerated vectors (via [go-highway](https://github.com/ajroetker/go-highway)), and ML inference (via [gomlx](https://github.com/gomlx/gomlx)) without leaving the Go toolchain. Antfly 📄 [A Deep Dive Into How Your Go Code Becomes a Binary](https://blog.gaborkoos.com/posts/2026-05-08-The-Go-Compiler-a-Deep-Dive-Into-How-Your-Code-Becomes-a-Binary/) – _“This is a really long deep dive.”_ Gabor Koos 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/qqn5ckbhwdibqcipjyk0.jpg)](https://github.com/mvdan/gofumpt) 🔎 [gofumpt 0.10: An Even Stricter `gofmt`](https://github.com/mvdan/gofumpt) — If [`gofmt`](https://go.dev/blog/gofmt) doesn't go far enough for you, `gofumpt` (which can be run as a drop-in replacement for `gofmt`) has [even more rules](https://github.com/mvdan/gofumpt#added-rules) to keep your codebase under control. [v0.10](https://github.com/mvdan/gofumpt/releases/tag/v0.10.0) is based on Go 1.26’s `gofmt` and adds… yes, even more rules. Daniel Martí [58ms to Fork a Database. 0ms to Clean It Up](https://ghost.build/developers/?utm_source=content-syndication&utm_medium=referral&utm_campaign=golang-weekly-newsletter) — _ghost_ gives your agent its own Postgres fork per task. No cleanup, no shared state, no project limits. [Try for free](https://ghost.build/developers/?utm_source=content-syndication&utm_medium=referral&utm_campaign=golang-weekly-newsletter). ghost sponsor [go-app 11.0: Build Progressive Web Apps with Go and WebAssembly](https://github.com/maxence-charriere/go-app) — A framework for building Go-powered PWAs that uses Go’s standard `http` approach for the backend and adds a declarative syntax so you can write component-based UIs in Go itself. Maxence Charrière 🎵 [lofimusic.app](https://lofimusic.app/chillhop) is mentioned as an example of a site built on `go-app`. [grdpwasm: A Go WASM-Powered RDP Client for the Web](https://github.com/nakagami/grdpwasm) — A browser-based implementation of an [RDP](https://en.wikipedia.org/wiki/Remote_Desktop_Protocol) (Microsoft's _Remote Desktop Protocol_) client in Go that's compiled to WebAssembly. Hajime Nakagami - [graphql-go v1.10.0](https://github.com/graph-gophers/graphql-go/releases/tag/v1.10.0) – GraphQL library now implementing the official GraphQL September 2025 spec. - [Dasel 3.10](https://github.com/TomWright/dasel) – CLI tool and Go library for working with JSON, YAML, TOML, XML, CSV, HCL, and INI files. - 🖼️ [Native WebP for Go 1.3](https://github.com/HugoSmits86/nativewebp) – Go-based native WebP encoder with no `libwebp`dependency. - [urfave/cli 3.9](https://github.com/urfave/cli/releases/tag/v3.9.0) – Popular package for building command line tools in a declarative fashion. - [Caddy Defender 0.10.1](https://github.com/JasonLovesDoggo/caddy-defender) – [Caddy](https://caddyserver.com/) module to block or manipulate requests originating from AIs or cloud services. - 🔒 [Lego 5.0](https://github.com/go-acme/lego/releases/tag/v5.0.0) – Let's Encrypt client and ACME library. There are more details [in this blog post.](https://ldez.github.io/blog/2026/05/11/lego-v5/) - [Ark 0.8](https://github.com/mlange-42/ark) – Archetype-based Entity Component System (ECS) for Go. - [wgpu v0.28.0](https://github.com/gogpu/wgpu) – Pure Go WebGPU Implementation. 📰 Classifieds [CodeRabbit](https://fandf.co/4n1brGW): Your team's second brain. Now in Slack. One agent for your entire SDLC to keep context and cut review time. Trusted by 6M+ repos. --- Compose Claude Code, Codex & Gemini as one harness — agents as http.Handlers. Native Go SDK.[agentfield.ai/github](http://agentfield.ai/github) Curated by Peter Cooper and [Glenn Goodrich](https://twitter.com/ruprict). Go is a [trademark of Google](https://go.dev/brand). The [Go gopher](https://go.dev/blog/gopher), whenever used, is an original creation by Renée French. [Change your email](https://golangweekly.com/edit_subscription/*|UID|*) [Stop getting this newsletter](https://golangweekly.com/leave/*|UID|*) © Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom