• Vulnerability in golang.org/x/net
  • You can't parse [X]HTML with regex.
• 💀 IngressNightmare: 9.8 Critical Unauthenticated Remote Code Execution Vulnerabilities in Ingress NGINX
• Conferences & CFPs
  • 🇮🇹 GoLab, Oct 5-7 @ Florence, Italy
    • CFP open through Apr 10
  • 🇬🇧 GopherCon UK, Aug 13-5 @ London, UK
    • CFP open through May 17
• Accepted proposal: add go mod verify -tag
• Interview with Ludovic Fernandez aka Ldez, maintainer of golangci-lint
  • Welcome to golangci-lint v2
  • golangci-lint official web site
  • Ldez on GitHub
  • lego: Let's Encrypt client and ACME library written in Go
  • Support LDez financially

• Updates on old news:
  • 🧮 Accepted proposal: New x/exp/stats package
• Watch Anders Hejlsberg talk about why Microsoft chose Go for TypeScript 7
• More typo squatting!
  • Blog: Linux, macOS users infected with malware posing as legitimate Go packages
  • On Reddit: Someone copied our GitHub project, added stars from fake users, injected malicious code
  • Previous typo squatting discussion in Episode 98
• 🦆 Blog: Fast Streaming Inserts in DuckDB with ADBC by Loïc Alleyne
  • Interview with Matt Topol, Episode 4
• Lightning Round
  • 🦾 windows/arm support being removed in Go 1.26
  • 🐶 github.com/DATA-DOG/go-txdb: Single transaction based sql.Driver for Go
  • github.com/peterldowns/pgtestdb: write efficient database-backed tests for PostgreSQL

• 🛡️ Security releases
  • Go 1.24.1 & 1.23.7 released
  • golang.org/x/net v0.36.0 released
• gopls v0.18.0 released
• 🇫🇮 Helsinki meetup, March 18, still looking for speakers
• TypeScript rewrite in Go
• 🌩️ Lightning Round
  • Asdf Has Been Re-Written in Go
  • Go clients dominate internet API traffic
  • Why was nvm for Windows written in Go?

• 🛡️ Security releases
  • golang.org/x/crypto v0.35.0
  • golang.org/x/oauth2 v0.27.0
• Proposals
  • Accepted: net/http: support content negotiation
  • 🧮 Likely accept: math/stats: new package with Mean, Median, more
• Conferences
  • 🇨🇿 Gophercamp, April 25 @ Brno, Czech Republic
    • CFP open until ??
• 🇨🇭 Go blog: Faster Go maps with Swiss Tables by Michael Pratt
• Blog: Golang SQL Injection by Example by Liran Tal
  • Little Bobby Tables on xkcd
• How would you introduce Goroutines and Channels to someone new to Go?
• Interview with Lane Wagner about boot.dev
  • Lane on Cup o' Go, episode 16
  • boot.dev
  • Backend Banter podcast
  • Jonathan on Backend Banter

• 🛡️ Security pre-release announcements, update on Monday, Feb 24
  • golang.org/x/oauth2
  • golang.org/x/crypto
• Blog: State of the startup and scaleup hiring markets by Gergely Orosz – as seen by recruiters (Partial paywall)
• Blog: Testing concurrent code with testing/synctest by Damien Neil
• Proposals
  • 🤝 Likely (re-)accept: net/http: support content negotiation
• 🌩️ Lightning round
  • Minecraft from scratch
  • MyNav
• Interview with Carlos Becker
  • Personal web site
  • GoReleaser web site
  • GitHub proflie

This episode was LIVE! Even if you usually listen to this show, if you want you can check out the video on YouTube :)

Visit https://cupogo.dev/ for store links, past episodes including transcripts, and more!

• GopherCon Israel
• Accepted proposal: Clone a Hash
• We Replaced Our React Frontend with Go and WebAssembly from Dagger
• Extensible Wasm Applications with Go by Cherry Mui
• SQL NULLs are Weird! by Raymond Tukpe
• Lighting round:
  • Go programs freeze when they are launched via a Steam client
  • Lovable's rewrite From Python to Go
  • Bunster: Compile shell scripts to static binaries
  • NVM for Windows
  • chi drops support for Go 1.14-1.19
• Go 1.24.0 released

• 🛡️ Security releases
  • Go 1.23.6 & 1.22.12 released
  • Go 1.24rc3 released
• Proposal accepted: cmd/fix: automate migrations for simple deprecations
• ⛓️‍💥 Go Supply Chain Attack: Malicious Package Exploits Go Module Proxy Caching for Persistence
• 👊🏾Ghettoize Hook👊🏾
• Interview with Thorsten Ball
  • thorstenball.com
  • zed
  • Sourcegraph
  • Register Spill
  • Hard numbers in the Wayland vs X11 input latency discussion

• Proposals
  • ✈️ Accepted: runtime/trace: flight recording
  • 🫷 Accepted: add vet check for sync.WaitGroup abuse
  • Draft: json/v2 proposal draft
• 🌩️ Lightning round
  • Blog post: Gist of Go: Channels by Anton Zhiyanov
  • ⚒️ Blog post: Go 1.24's go tool is one of the best additions to the ecosystem in years by Jamie Tanna
    • On Hacker News
  • Video: Building a course platform in Go
• Interview with Anton Zhiyanov
  • Web site
  • codapi: Interactive code examples
  • On GitHub

• Go 1.24RC2 released
• Go 1.23.5 & 1.22.11 released
• 🇺🇸 GopherCon, Aug 26-28 @ New York, New York
  • CFS open through March 3
• Proposals
  • 🇺🇸 New: reduce error handling boilerplate using ?
  • 🥁 New: sync/v2 package
• Lightning round
  • 📼 VHS v0.9.0
  • 🤖 openai-go
  • 📦 Video: I tried to deploy to a VPS without Docker...

• 🛡️ Security updates
  • Go 1.23.5, 1.22.11, and 1.24RC2 coming Jan 16
  • github.com/golang/glog v1.2.4 released last week
• Go 1.24 interactive tour
• Proposals
  • On hold: container/unordered: a generic hash table with custom hash function and equivalence relation
  • #️⃣ Active: hash: standardize the hash function
• Blog post: Go is a Well-Designed Language, Actually by Matt Hall
• Hugo v0.141.0 released
• 🌩️ Lightning Round
  • CL: Grammar nit fix inspired by last week's Boldly Go: Daily post
  • ☮️ Video: Building my first project with Go by Peaceful Programmer
  • Pixel2, 2D game library in Go