--- title: "Go security issues worth auditing for" publication: "Go Weekly" issue: 605 published_at: "2026-06-12" canonical_url: "https://golangweekly.com/issues/605" --- Plus another take on ternaries, x/clipboard goes Cgo-free, and working with Wi-Fi on macOS from Go. #​605 — June 12, 2026 [Read the Web Version](https://golangweekly.com/issues/605) Together with [![Tiger Data logo\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_1280,h_282/e_make_transparent/co_white,e_outline:30/px1u7kjyvz7xnbm6ytir.png)](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=golang-weekly-newsletter) Go Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/epxmxskik0hntuxbpc1f.jpg)](https://lemire.me/blog/2026/06/06/how-much-do-amd64-microarchitecture-levels-help-in-go/) [How Much Do AMD64 Microarchitecture Levels Help?](https://lemire.me/blog/2026/06/06/how-much-do-amd64-microarchitecture-levels-help-in-go/) — A benchmark of Go’s [GOAMD64 levels](https://go.dev/wiki/MinimumRequirements#amd64) on [`roaring`](https://github.com/RoaringBitmap/roaring) shows gains from `v2`/`v3`, but little from `v4`. A reminder to benchmark CPU-heavy code before changing build targets: `v4` makes binaries require AVX-512-capable CPUs, but the Go compiler does not currently _emit_ AVX-512. Daniel Lemire [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/74d2ac70.png)](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=golang-weekly-newsletter) [Query Billions of Time-Series Rows Without Leaving Postgres](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=golang-weekly-newsletter) — TimescaleDB extends Postgres for analytics at any scale. Hypertables partition automatically. Hypercore compression cuts storage 10x. Continuous aggregates keep dashboards live. No second database. [$1000 credit](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=golang-weekly-newsletter). Tiger Data (creators of TimescaleDB) sponsor **PROPOSALS AND IN BRIEF:** - The core Go team's Alan Donovan [proposes adding a `NewEntrypoint` API to the `testing` package](https://github.com/golang/go/issues/79941) to simplify calling a function in a child process. - `x ? y : z`-style conditionals have been rejected in Go before, but a proposal floats a [`(if cond then expr else expr)`](https://github.com/golang/go/issues/78940) approach. - 🔒 A senior security engineer argues [`net.IP.IsPrivate` is widely misused as a security primitive](https://github.com/golang/go/issues/79925), driving recurring SSRF CVEs across the ecosystem. - 🔎 GitHub [CodeQL's pull-request scans now run incrementally for Go](https://github.blog/changelog/2026-06-10-incremental-analysis-for-go-c-c-and-codeql-cli/) (and C/C++). - 🇪🇺 [GopherCon Europe 2026](https://www.gophercon.eu/) is taking place next week in Germany. - There's an update on the idea of [adding `url.MustParse` and a generic `must.Do`](https://github.com/golang/go/issues/54297) to Go. [Subtle Go Security Issues to Audit For](https://www.elttam.com/blog/golang-code-review-notes-ii) — A follow-up to 2022’s [Go code review notes](https://www.elttam.com/blog/golang-codereview), with a closer look at Go security review topics around `httputil.ReverseProxy`, `net/url`, `encoding/json`, integer overflows, null bytes, and CSRF. Zoltan Madarassy and Alex Brown [Web Search API for Go Developers](https://serpapi.com/playground/?utm_source=cooperpress&utm_campaign=go_sponsored) — Get real-time Google, Maps, Shopping, and other search engine data in structured JSON. SerpApi sponsor 📄 [Reading Wi-Fi Data from Go on macOS](https://dev.to/jaisonerick/reading-wi-fi-data-from-go-on-macos-after-apple-removed-airport-19g) – Working around Apple removing `airport` with a signed Swift helper embedded in the author's [`macwifi`](https://github.com/jaisonerick/macwifi)package. Jaison Erick 📄 [Discovering and Navigating `//go:linkname` Directives](https://dnaeon.github.io/golinkname/) – How the directive aliases symbols across packages, plus a CLI to map its use. Marin Atanasov Nikolov 📄 [Special Cases in Go](https://www.dolthub.com/blog/2026-05-22-special-cases-in-go/) – _"Go tries to be a simple language, but it doesn’t always succeed."_ Nick Tobey 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/znlnvghhocsyxldrojqv.jpg)](https://github.com/AllenDang/giu/releases/tag/v0.15.0) [giu 0.15: A _Dear ImGui_-Based GUI Framework](https://github.com/AllenDang/giu/releases/tag/v0.15.0) — The cross-platform immediate-mode GUI framework built on [Dear ImGui](https://github.com/ocornut/imgui) returns with its first release in over a year. Updates include a light theme and macOS font-scaling fixes. Allen Dang 📋 [clipboard 0.8: The Clipboard Library Goes Cgo-Free on Desktop](https://github.com/golang-design/clipboard/releases/tag/v0.8.0) — [golang.design](https://golang.design/)'s cross-platform clipboard library drops Cgo on all desktop platforms and adds native Wayland support. It also improves MIME-type processing and image handling. Changkun Ou 🔑 [Talos: An Open Source API Key Server from Ory](https://github.com/ory/talos) — The team behind Hydra and Kratos open sources a Go-powered API key server for users, services, machine-to-machine, and AI agents. Ory [Porcupine 1.2: A Linearizability Checker for Distributed Systems](https://github.com/anishathalye/porcupine) — You model a distributed system in Go, feed in a concurrent operation history, and Porcupine checks whether it's linearizable. There's [a 2017 blog post](https://anishathalye.com/testing-distributed-systems-for-linearizability/) that explains more. Anish Athalye - [Gost-DOM 0.12](https://github.com/gost-dom/browser) – Headless browser that simulates browser environments for TDD. [Here's why](https://github.com/gost-dom/browser/blob/main/docs/why-gost.md) you might use it and [how to get started](https://github.com/gost-dom/browser/blob/main/docs/Getting-started.md) – the API is pretty nice. - [sx 0.6](https://github.com/v-byte-cpu/sx) – The Go-powered network scanner adds macOS support. - [Restic 0.19.0](https://github.com/restic/restic/releases/tag/v0.19.0) – Popular Go-powered backup program. - [Ginkgo 2.30.0](https://github.com/onsi/ginkgo/releases/tag/v2.30.0) – The testing framework. 📰 Classifieds 🤖 Code review has four jobs. AI took the first — what happens to the other three? AgentField's open-source breakdown [→ Read the post](https://agentfield.ai/blog/ai-native-code-review/?utm_source=golang&utm_medium=newsletter&utm_campaign=golang-260612&utm_id=golang-260612-blog-ai-native-code-review&utm_content=blog-ai-native-code-review). Curated by Peter Cooper and [Glenn Goodrich](https://twitter.com/ruprict). Go is a [trademark of Google](https://go.dev/brand). The [Go gopher](https://go.dev/blog/gopher), whenever used, is an original creation by Renée French. [Change your email](https://golangweekly.com/edit_subscription/*|UID|*) [Stop getting this newsletter](https://golangweekly.com/leave/*|UID|*) © Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom