This site is being rebuilt and some pages are out of date. For current details, write to [email protected]. This notice goes away when the rebuild is done.

No analytics unless you allow it, no tracking. This site keeps in your browser the language you pick, the theme, its colour, which site you chose, the currency on the pricing page and that you closed this notice; signing in adds session cookies. The legal page has the details.

Sign in

Quiet Pager · Radar

What changed in Go, Rust and Solidity this week.

What changed this week, from each project's own release notes, proposals and issues, with an exercise you can run for each change.

Written by a model · reviewed by a person · published Mondays · Atom feed

Archive · Week 41 · Oct 6 – 12, 2025from 3 items

The Go team released two patch releases, 1.24.8 and 1.25.2, both focused on security and bug fixes. A proposal to overhaul `go fix` was accepted, simplifying the command and aligning it with `go vet`.

Breakingstdlib

go1.24.8 release

What changed
Security fixes to archive/tar, crypto/tls, crypto/x509, encoding/asn1, encoding/pem, net/http, net/mail, net/textproto, net/url; bug fixes to compiler, linker, debug/pe, net/http, os, sync/atomic.
Production impact
The source does not say.
Try it
Upgrade to 1.24.8 and run go test ./... to ensure no test failures.
Source
go.dev/doc/devel/release#go1.24.8
Explain it and run it

Understand it, then run it

Go 1.24.8 was released on 2025‑10‑07. It contains security fixes for several standard packages: archive/tar, crypto/tls, crypto/x509, encoding/asn1, encoding/pem, net/http, net/mail, net/textproto, and net/url. There are also bug fixes for the compiler, the linker, debug/pe, net/http, os, and sync/atomic. The change is a maintenance update; it does not add new language features or APIs.

Run it now

Todaygo
// This program demonstrates that the standard library still works after the
// security and bug fixes in Go 1.24.8. It uses net/http to fetch a small
// resource from a local server and prints the response body. The code
// compiles and runs on Go 1.27.1, which already includes the 1.24.8 fixes.
package main

import (
	"fmt"
	"io"
	"net/http"
	"net/http/httptest"
)

func main() {
	// Set up a simple test server that returns a fixed response.
	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		fmt.Fprintln(w, "Hello, world!")
	}))
	defer ts.Close()

	// Make a GET request to the test server.
	resp, err := http.Get(ts.URL)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	// Read and print the response body.
	body, err := io.ReadAll(resp.Body)
	if err != nil {
		panic(err)
	}
	fmt.Print(string(body))
}

What it printed when we ran it on Go 1.27.1

Hello, world!

Run sends this program (for Solidity, the contract and its tests) to our own sandbox, where it is compiled and run once, with no network, and what it printed or the test report comes back here. Nothing is kept. Runs are counted per visitor for the day so everyone gets a turn; the details are on the legal page.

Breakingstdlib

go1.25.2 release

What changed
Security fixes to archive/tar, crypto/tls, crypto/x509, encoding/asn1, encoding/pem, net/http, net/mail, net/textproto, net/url; bug fixes to compiler, runtime, context, debug/pe, net/http, os, sync/atomic.
Production impact
The source does not say.
Try it
Upgrade to 1.25.2 and run go vet ./... to verify no new vet errors.
Source
go.dev/doc/devel/release#go1.25.2
Explain it and run it

Understand it, then run it

Go 1.25.2 was released on 2025‑10‑07. It contains a set of security fixes for several standard packages: archive/tar, crypto/tls, crypto/x509, encoding/asn1, encoding/pem, net/http, net/mail, net/textproto, and net/url. In addition, the release includes bug fixes for the compiler, runtime, context, debug/pe, os, and sync/atomic. These changes do not add new language features or APIs; they simply patch existing code to make it safer and more reliable.

Run it now

Todaygo
// This program demonstrates that Go 1.25.2 does not introduce new APIs.
// It simply prints a message confirming the absence of changes to the language.
package main

import "fmt"

func main() {
	fmt.Println("go1.25.2 has no new API to showcase.")
}

What it printed when we ran it on Go 1.27.1

go1.25.2 has no new API to showcase.

Run sends this program (for Solidity, the contract and its tests) to our own sandbox, where it is compiled and run once, with no network, and what it printed or the test report comes back here. Nothing is kept. Runs are counted per visitor for the day so everyone gets a turn; the details are on the legal page.

Worth knowingtooling

go fix overhaul

What changed
go fix now behaves like go vet, using the same analysis framework and a new -fixtool extension. The obsolete -fix=name,… flag is removed, and -diff is accepted by both commands.
Production impact
The source does not say.
Try it
Run go fix -diff on a package to see the diff output.
Source
github.com/golang/go/issues/71859
Explain it

Understand it, then run it

go fix used to be a separate command that applied a handful of automatic code changes. The new change makes it work the same way as go vet, the tool that reports problems. Now go fix runs the same analysis engine that go vet uses, but instead of just printing diagnostics it applies the suggested fixes. The old flag -fix=name,… is gone, and both commands accept a -diff flag to show what changes would be made without applying them.

Exercise

Write a small program that uses go vet to check a file for //go:fix inline directives and prints whether any fixes are available.

The 60-second version

This week the Go team rolled out two patch releases, 1.24.8 and 1.25.2, tightening security and squashing bugs across the standard library and compiler. They also accepted a proposal to simplify the `go fix` command, making it behave like `go vet` and removing legacy flags. These changes keep Go safer and easier to use, but you’ll need to update your toolchain to benefit from the new fixes.

Written by gpt-oss-20b · claims checked against the sources · archive, not individually reviewed