--- title: "Hooking into the Go toolchain" publication: "Go Weekly" issue: 620 published_at: "2026-10-09" canonical_url: "https://golangweekly.com/issues/620" --- Plus the data race that wasn't a bug, a Go-powered Linux, and hacking the Go compiler for faster IPv4-to-IPv6 mapping. #​620 — October 9, 2026 [Read the Web Version](https://golangweekly.com/issues/620) ℹ️ We're back, _but_ we're taking another break next week, so we'll see you again on Friday, October 23! :-) __ _Your editor, Peter Cooper_ Together with [![Three Dots Labs\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_1280,h_289/e_make_transparent/co_white,e_outline:17/vonzxauqd8tsxfvqseup.png)](https://threedots.tech/the-domain-engineer/?utm_source=golangweekly) Go Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/yna9kitpqq3n37dpzywx.jpg)](https://victoriametrics.com/blog/http-race-condition/) [The Data Race That Wasn't a Bug (and the One That Was)](https://victoriametrics.com/blog/http-race-condition/) — `Client.Do` can return before `net/http` has finished reading your request body, so reusing the buffer can trigger a data race. A walk through the transport’s goroutines and why VictoriaMetrics kept one such race but fixed another. Jesús Espino [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/bceb594c.png)](https://threedots.tech/the-domain-engineer/?utm_source=golangweekly) [Nail Your Complex Go Backend](https://threedots.tech/the-domain-engineer/?utm_source=golangweekly) — Adding a feature shouldn't break three other things. Learn advanced backend patterns by building a food delivery platform, by hand or with your coding agent. Enrollment opens in two weeks. [Join the waitlist so you don’t miss it!](https://threedots.tech/the-domain-engineer/?utm_source=golangweekly) Three Dots Labs sponsor [Hooking into the Go Toolchain](https://internals-for-interns.com/posts/hooking-into-the-go-toolchain/) — A deep tour of `go build -toolexec` for wrapping compiler and linker runs, starting with a simple timer and moving on to rewriting code mid-build, patching `importcfg` to add new imports, and more. Kemal Akkoyun **IN BRIEF:** - 🔐 [Go 1.27.2 and 1.26.9](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) have been released with 15 security fixes, mostly in `net/http`, plus a fix for [a compiler bug that could corrupt values](https://github.com/golang/go/issues/81612). - 📊 [Every Go release since 2013, benchmarked](https://praneos.com/blog/go-performance-1-2-to-1-27/). The same benchmark programs took 11.5% less time on Go 1.27 than on 1.23, and ~41% less than on 1.2. - 🔒 Google has [paused bounties](https://bughunters.google.com/about/rules/open-source/google-open-source-software-vulnerability-reward-program-rules#product-vulnerabilities) for product vulnerabilities in Go and its other open source projects after [a flood of mostly invalid automated reports](https://www.bleepingcomputer.com/news/google/google-halts-open-source-bug-bounty-program-amid-ai-spam-surge/). - 🇯🇵 [GopherCon Japan 2027's CFP](https://gophercon.jp/2027/cfp/) is open until October 25 if you fancy speaking at the (bilingual) event in Tokyo next February. [Hacking the Go Compiler to Efficiently Map IPv4 to IPv6](https://vincent.bernat.ch/en/blog/2026-go-netip-addrto6) — A small IPv4-to-IPv6 conversion led Vincent through noder hacks, SSA rewrite rules, and compiler pass ordering to close a ~8x performance gap. Vincent Bernat [Arch-Specific SIMD in Go](https://go.dev/blog/archsimd) — A follow-up to the Go team’s look at [platform-independent SIMD in Go](https://go.dev/blog/simd-experiment) covering the experimental `archsimd` package, which now supports `arm64` and `wasm`, plus tips for writing SIMD code that compiles well. Junyang Shao and David Chase (Go Team) [Don't Couple Your Go Code to GitHub](https://iain.rocks/blog/dont-couple-your-go-code-to-github) — Is putting `github.com` in import paths a problem? Iain thinks so, and makes the case for using your own domain instead, but it kicked off [a lively debate on Hacker News](https://news.ycombinator.com/item?id=49868404). Iain Cambridge [Ship Go Features, Not Data Pipelines](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=golang-weekly-newsletter) — TimescaleDB extends Postgres so your Go service gets fast analytics without a second system. [Get $1000 credit](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=golang-weekly-newsletter). Tiger Data (creators of TimescaleDB) sponsor 📄 [Poisoning a Go Build Cache](https://lukasschwab.me/blog/gen/poisoning-go-cache.html) – A hands-on look at how $GOCACHE works and why sharing it in CI can be risky. Lukas Schwab 📄 [Go 1.27 Detects Goroutine Leaks: I Tested It on Mine](https://jrobineau.com/en/blog/2026-09-30-go-127-goroutine-leak-profile.html) – With three caught, but one notable miss. Jules Robineau 📄 [Logs in Parallel Go Tests and Where to Find Them](https://arturdryomov.dev/posts/logs-in-parallel-go-tests/) – Hint: Go 1.25’s `t.Output()` is your friend. Artur Dryomov 🛠 Code & Tools [Francis: Durable Actors, Jobs and Workflows for Go](https://withblue.ink/2026/10/francis-stable) — Durable actors, cron jobs, background jobs with retries, rate limiting and saga-style workflows, embedded in your app and backed by SQLite or Postgres, with an optional standalone runtime for larger clusters. Alessandro Segala [connect-go v2 Arrives with Simpler, gRPC-Go-Style Handlers](https://buf.build/blog/connect-go-v2) — Buf's Go RPC library drops its generic request and response wrappers, splits HTTP out from the core, and no longer sends plain Go error messages to clients. There's a migration tool, and v1/v2 can coexist in one module. Buf [fx 40: Interactive Terminal JSON Viewer and Processor](https://github.com/antonmedv/fx) — We've linked `fx` a few times over the years, but [v40](https://github.com/antonmedv/fx/releases/tag/40.0.0) is a huge release: write queries inside the viewer and watch results update as you type, plus XML, HTML, EDN and MAML input, and vim-style commands. Anton Medvedev - [gopls 0.24 Prerelease](https://github.com/golang/tools/blob/gopls/v0.24.0-pre.2/gopls/doc/release/v0.24.0.md) – Now with LSP 3.18 support, better Go assembly handling, and a new analyzer for inconsistent `E`/`*E` error use. - [Echo 5.4](https://github.com/labstack/echo/releases/tag/v5.4.0) – The web framework fixes several security issues (some fixes change behavior). [4.16](https://github.com/labstack/echo/releases/tag/v4.16.0) gets them too. - 🤖 [GitHub MCP Server 2.0](https://github.com/github/github-mcp-server/releases/tag/v2.0.0) – GitHub's official, Go-powered MCP server adds structured outputs for agents. - [Rill 0.9](https://github.com/destel/rill/releases/tag/v0.9.0) – Composable, channel-based concurrency toolkit, now with first-class context support. v1.0 is not far away. - [gomponents 1.4](https://github.com/maragudk/gomponents/releases/tag/v1.4.0) – Build HTML views as plain Go functions. Now with faster rendering and an [official agent skill](https://github.com/maragudk/gomponents/blob/main/skills/gomponents/SKILL.md). 📰 Classifieds [POKE](https://link.svix.com/go-weekly-1) (Publish Once, Kickoff Everywhere) is a free agent skill that audits your Go code and helps you add events, SSE and Standard Webhooks. --- 🐘 Many Go backends end up talking to Postgres, so you may also like our other newsletter: [Postgres Weekly](https://postgresweekly.com/). 📢 Elsewhere in the ecosystem [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/ihyzdbxqzppjih1pazr5.jpg)](https://gonix.dev/) - ✨ [GoNIX](https://gonix.dev/) is a UNIX-like OS that boots a Linux kernel and hands off to a Go `init`, with coreutils, networking, and an SSH server, all written in Go too. After some teething problems, which I reported to its creator, the [instructions to boot it](https://gonix.dev/quickstart.html) on Apple silicon now work well _(as above)_. A neat experiment! - From the same author, James Mills, also comes [Parley](https://git.mills.io/prologic/parley), a _"federated, decentralised chat that speaks plain IRC"_. - _Neki_, PlanetScale's new sharded Postgres offering, sits behind a Go-powered proxy, and [this look at its design](https://planetscale.com/blog/designing-neki-for-performance) shows how it avoids decoding Postgres wire data it doesn't need to touch. - Mitchell Hashimoto has proposed [OSC 7501, a terminal protocol](https://mitchellh.com/writing/program-status-osc7501) that lets programs report their status to the terminal. [Bubble Tea 2.1](https://github.com/charmbracelet/bubbletea/releases/tag/v2.1.0) (released this week) already supports it. - 🕹️ Fancy some late '90s real-time strategy? [Nanolathe](https://nanolathe.gg/) reimplements _Total Annihilation_'s engine in Go, and you can [play a demo in your browser](https://nanolathe.gg/play/). Curated by Peter Cooper and [Glenn Goodrich](https://twitter.com/ruprict). Go is a [trademark of Google](https://go.dev/brand). The [Go gopher](https://go.dev/blog/gopher), whenever used, is an original creation by Renée French. [Change your email](https://golangweekly.com/edit_subscription/*|UID|*) [Stop getting this newsletter](https://golangweekly.com/leave/*|UID|*) © Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom