--- title: "Wails 3 arrives after nearly four years" publication: "Go Weekly" issue: 622 published_at: "2026-10-30" canonical_url: "https://golangweekly.com/issues/622" --- Plus why Go on Linux needs a kernel patch, Go concurrency on one page, TinyGo 0.44, and could go test run your own analyzers? #​622 — October 30, 2026 [Read the Web Version](https://golangweekly.com/issues/622) Together with [![Svix\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,e_trim,w_1280,h_386/e_make_transparent/co_white,e_outline:13/uokdi3wp1cp3vvnshdmd.png)](https://link.svix.com/cooper-p-03) Go Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/s0aokyzlbjmn4zfzop4e.jpg)](https://wails.io/blog/wails-v3-released/) [Wails 3.0: Build Desktop Apps with Go and Native Web Views](https://wails.io/blog/wails-v3-released/) — Nearly four years after its alpha, Wails 3 lets you build desktop apps with a Go backend and web frontend, rendered in a native WebView. 3.0 adds multiple windows, system tray support, an in-app updater, and generated JavaScript and TypeScript bindings for Go services. Mobile support remains experimental. Lea Anthony [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/8c603ab5.png)](https://link.svix.com/cooper-p-03) [Stop Hand-Rolling Webhooks in Your Go Service](https://link.svix.com/cooper-p-03) — Your webhooks want one package, one call per event, and idiomatic Go with typed models. Svix handles retries, signing, delivery logs, and a portal for your customers, so you don’t build any of it. Clerk has run its webhooks on Svix for 3+ years. Svix sponsor [How Go Shipped Its First `URGENT` Track Security Release](https://go.dev/blog/emudhra-incident) — As featured last week, Go [hardcoded a block](https://github.com/golang/go/issues/82345) on eMudhra's broken intermediate certs. Now the Go security team explains why the notes were vague, how the fix shipped hours after they were alerted, and its plan for [revocation checking on Linux](https://github.com/golang/go/issues/82402). Roland Shoemaker (Go Team) **IN BRIEF:** - 🔒 [`golang.org/x/net` v0.62.0](https://pkg.go.dev/vuln/GO-2026-6860) fixes two bugs in its `html` package: a quadratic slowdown on crafted input and a [raw text rendering flaw](https://pkg.go.dev/vuln/GO-2026-6866). - Filippo Valsorda has proposed friendlier [`crypto/aead` packages](https://github.com/golang/go/issues/82456) for symmetric encryption, plus [`crypto/cobblestone`](https://github.com/golang/go/issues/82535) for messages too big to hold in memory. - 𝕏 [Emma Twersky](https://x.com/twerske/status/2115836691466387463), familiar to many from Angular's DevRel team, now leads Frameworks and Languages DevRel at Google, covering Go alongside Flutter and Dart. 🔒 [Go on Linux and CVE-2026-98432: Patch Your Kernel](https://groups.google.com/g/golang-announce/c/PCoQcdxoScw) — Go enables [Multipath TCP](https://en.wikipedia.org/wiki/Multipath_TCP) by default for listeners in apps whose main module declares `go 1.24` or later. [Anthropic's remote root exploit](https://www.anthropic.com/research/discovering-vulnerabilities-with-claude) for a new Linux kernel bug used such a listener, but the bug isn't MPTCP-specific. Update your kernel, as `GODEBUG=multipathtcp=0` is only _"a fragile mitigation"_. Neal Patel (Go Security Team) 💡 [An issue that proposes Go turn the default off](https://go.dev/issue/82717) is open, but the Go team says any change would be premature for now. [Go Concurrency Distilled](https://antonz.org/go-concurrency-distilled/) — A handy interactive refresher where Anton boils Go's numerous concurrency concepts and mechanisms down into a single page, covering everything from channels and `select` to `context`, `synctest` and the scheduler, with examples you can edit and run in place. Anton Zhiyanov 📊 [Measuring Go 1.28's HTTP/2 'Parking' Memory Savings](https://abdolirad.me/articles/go-1-28-http2-parking-memory/) — Thanks to [a change by Brad Fitzpatrick](https://github.com/golang/go/commit/5c51011e82ed754af072baaf4338ff35e76fe705), an idle HTTP/2 server connection in Go 1.28 can let its serve goroutine exit. With 5,000 idle connections, a dev build ran 5,000 fewer goroutines and used about 40% less RSS. Mohammad Abdolirad [Proposal: Let `go test` Run Your Project's Own Analyzers](https://github.com/golang/go/issues/82464) — `//go:analyze` directives would add custom analyzers to `go test`, and libraries could ship checks that run on packages that import them, like `vet` checks `Printf` calls. It's still early but being actively discussed. Alan Donovan (Go Team) 📺 [Profiling Go with `pprof`: Flame Graphs and Memory Leaks](https://www.youtube.com/watch?v=As8Jdq9Gpwg) – A quick, six minute primer that finds a CPU hog and leak in an app. Hüseyin Babal 📄 [Partial Updates in Go with Field Masks](https://rednafi.com/go/patch-field-mask/) – How to separate update intent from values in `PATCH` requests. Redowan Delowar 📄 [Where Go 1.27's HTTP/1 Connection Reuse Stops Working](https://lleg.dev/posts/go-127-http1-connection-reuse-256kb/) Lleg 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/x1tqnpdllec2vidaspd5.jpg)](https://gohawk.dev/) [gohawk: Static Analysis for Leaks and Lock Bugs](https://gohawk.dev/) — Finds leaked files, unjoined goroutines, unreaped processes and lock inversions, using Infer-style function summaries to track ownership across packages. It's a young project, but has already led to merged fixes in [Moby](https://github.com/moby/moby/pull/53517) and [Caddy](https://github.com/caddyserver/caddy/pull/7968). ([GitHub repo](https://github.com/kojah/gohawk).) James Ko [TinyGo 0.44: Smaller, Faster, Better](https://tinygo.org/blog/2026/tinygo-0.44-smaller-faster-better/) — The Go compiler for microcontrollers and WebAssembly now does more init work at compile time for smaller binaries that start faster, drops needless slice bounds checks, and adds multicore goroutines on the ESP32-S3. Support for the Arduino Uno R4 also brings TinyGo's first Renesas CPU support. The TinyGo Team [You Chose Go for Simplicity. Keep Your Data Stack Simple Too](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=golang-weekly-newsletter) — TimescaleDB extends Postgres with compression and continuous aggregates. Your Go code doesn’t change. [Get $1000 credit](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=golang-weekly-newsletter). Tiger Data (creators of TimescaleDB) sponsor [noalloc: Keep Your Hot Paths Allocation-Free](https://github.com/theconsensuslabs/noalloc) — Mark a function with `//noalloc:root` and this CLI checks its call tree for heap allocations, flagging offending lines. It's a days-old, AI-written experiment that borrows an idea from [OxCaml's`zero_alloc`](https://theconsensus.dev/p/2026/06/27/the-feature-in-oxcaml-more-languages-should-steal.html). Phil Eaton (The Consensus) - 🔒 [Echo 5.4.4](https://github.com/labstack/echo/releases/tag/v5.4.4) – The popular web framework has had four patch releases in eight days, including a fix for a critical [access control bypass](https://github.com/labstack/echo/releases/tag/v5.4.1) in its proxy middleware's WebSocket handling. - [go-json 0.12](https://github.com/goccy/go-json/releases/tag/v0.12.0) – Fast `encoding/json`-compatible library. Adds a `jsontext` package and an early `encoding/json/v2`-style API. - [cel-go 0.33](https://github.com/cel-expr/cel-go/releases/tag/v0.33.0) – Google's [Common Expression Language](https://cel.dev/) for Go gets an opt-in parser that's 8-19x faster. - [Huma 2.40](https://github.com/danielgtaylor/huma/releases/tag/v2.40.0) – Framework for building HTTP APIs with OpenAPI 3 specs. - [mockery 3.9](https://github.com/vektra/mockery/releases/tag/v3.9.0) – The popular mock generator for Go interfaces. ([Docs](https://vektra.github.io/mockery/latest/).) 📢 Elsewhere in the ecosystem - ✨ Richard Seroter, Google Cloud's Chief Evangelist and the exec with product and engineering responsibility for Go, 𝕏 [says Go has just become the most-used language on Google Cloud](https://x.com/rseroter/status/2115473918303621284) by raw SDK API requests, with Java not far behind. - Before 'distributed SQLite' became a busy, venture-funded category, there was [rqlite](https://github.com/rqlite/rqlite), built in Go in 2014. [Its creator tells the story](https://philipotoole.com/twelve-years-of-distributed-sqlite/) of the ecosystem's growth. - [Lisette](https://lisette.run/) is a Rust-inspired language with algebraic data types, pattern matching and no `nil` that compiles to readable Go and can call Go packages directly. - ⚠️ A reminder that the [2026 Go Developer Survey](https://go.dev/blog/survey2026-announce) closes for submissions on November 3, so there are a few more days to have your say. Curated by Peter Cooper and [Glenn Goodrich](https://twitter.com/ruprict). Go is a [trademark of Google](https://go.dev/brand). The [Go gopher](https://go.dev/blog/gopher), whenever used, is an original creation by Renée French. [Change your email](https://golangweekly.com/edit_subscription/*|UID|*) [Stop getting this newsletter](https://golangweekly.com/leave/*|UID|*) © Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom