Wails 3 arrives after nearly four years

Go Weekly

Wails 3.0: Build Desktop Apps with Go and Native Web Views — Nearly four years after its alpha, Wails 3 lets you build desktop apps with a Go backend and web frontend, rendered in a native WebView. 3.0 adds multiple windows, system tray support, an in-app updater, and generated JavaScript and TypeScript bindings for Go services. Mobile support remains experimental.

Lea Anthony

Stop Hand-Rolling Webhooks in Your Go Service — Your webhooks want one package, one call per event, and idiomatic Go with typed models. Svix handles retries, signing, delivery logs, and a portal for your customers, so you don’t build any of it. Clerk has run its webhooks on Svix for 3+ years.

Svix sponsor

How Go Shipped Its First URGENT Track Security Release — As featured last week, Go hardcoded a block on eMudhra's broken intermediate certs. Now the Go security team explains why the notes were vague, how the fix shipped hours after they were alerted, and its plan for revocation checking on Linux.

Roland Shoemaker (Go Team)

IN BRIEF:

• 🔒 golang.org/x/net v0.62.0 fixes two bugs in its html package: a quadratic slowdown on crafted input and a raw text rendering flaw.

• Filippo Valsorda has proposed friendlier crypto/aead packages for symmetric encryption, plus crypto/cobblestone for messages too big to hold in memory.

• 𝕏 Emma Twersky, familiar to many from Angular's DevRel team, now leads Frameworks and Languages DevRel at Google, covering Go alongside Flutter and Dart.

🔒 Go on Linux and CVE-2026-98432: Patch Your Kernel — Go enables Multipath TCP by default for listeners in apps whose main module declares go 1.24 or later. Anthropic's remote root exploit for a new Linux kernel bug used such a listener, but the bug isn't MPTCP-specific. Update your kernel, as GODEBUG=multipathtcp=0 is only "a fragile mitigation".

Neal Patel (Go Security Team)

💡 An issue that proposes Go turn the default off is open, but the Go team says any change would be premature for now. The issue is ultimately with Linux, not Go.

Go Concurrency Distilled — A handy interactive refresher where Anton boils Go's numerous concurrency concepts and mechanisms down into a single page, covering everything from channels and select to context, synctest and the scheduler, with examples you can edit and run in place.

Anton Zhiyanov

📊 Measuring Go 1.28's HTTP/2 'Parking' Memory Savings — Thanks to a change by Brad Fitzpatrick, an idle HTTP/2 server connection in Go 1.28 can let its serve goroutine exit. With 5,000 idle connections, a dev build ran 5,000 fewer goroutines and used about 40% less RSS.

Mohammad Abdolirad

Proposal: Let go test Run Your Project's Own Analyzers — //go:analyze directives would add custom analyzers to go test, and libraries could ship checks that run on packages that import them, like vet checks Printf calls. It's still early but being actively discussed.

Alan Donovan (Go Team)

📺 Profiling Go with pprof: Flame Graphs and Memory Leaks – A quick, six minute primer that finds a CPU hog and leak in an app. Hüseyin Babal

📄 Partial Updates in Go with Field Masks – How to separate update intent from values in PATCH requests. Redowan Delowar

📄 Where Go 1.27's HTTP/1 Connection Reuse Stops Working Lleg

🛠 Code & Tools

gohawk: Static Analysis for Leaks and Lock Bugs — Finds leaked files, unjoined goroutines, unreaped processes and lock inversions, using Infer-style function summaries to track ownership across packages. It's a young project, but has already led to merged fixes in Moby and Caddy. (GitHub repo.)

James Ko

TinyGo 0.44: Smaller, Faster, Better — The Go compiler for microcontrollers and WebAssembly now does more init work at compile time for smaller binaries that start faster, drops needless slice bounds checks, and adds multicore goroutines on the ESP32-S3. Support for the Arduino Uno R4 also brings TinyGo's first Renesas CPU support.

The TinyGo Team

You Chose Go for Simplicity. Keep Your Data Stack Simple Too — TimescaleDB extends Postgres with compression and continuous aggregates. Your Go code doesn’t change. Get $1000 credit.

Tiger Data (creators of TimescaleDB) sponsor

noalloc: Keep Your Hot Paths Allocation-Free — Mark a function with //noalloc:root and this CLI checks its call tree for heap allocations, flagging offending lines. It's a days-old, AI-written experiment that borrows an idea from OxCaml's zero_alloc.

Phil Eaton (The Consensus)

• 🔒 Echo 5.4.4 – The popular web framework has had four patch releases in eight days, including a fix for a critical access control bypass in its proxy middleware's WebSocket handling.

• go-json 0.12 – Fast encoding/json-compatible library. Adds a jsontext package and an early encoding/json/v2-style API.

• cel-go 0.33 – Google's Common Expression Language for Go gets an opt-in parser that's 8-19x faster.

• Huma 2.40 – Framework for building HTTP APIs with OpenAPI 3 specs.

• mockery 3.9 – The popular mock generator for Go interfaces. (Docs.)

📢 Elsewhere in the ecosystem

• ✨ Richard Seroter, Google Cloud's Chief Evangelist and the exec with product and engineering responsibility for Go, 𝕏 says Go has just become the most-used language on Google Cloud by raw SDK API requests, with Java not far behind.

• Before 'distributed SQLite' became a busy, venture-funded category, there was rqlite, built in Go in 2014. Its creator tells the story of the ecosystem's growth.

• Lisette is a Rust-inspired language with algebraic data types, pattern matching and no nil that compiles to readable Go and can call Go packages directly.

• ⚠️ A reminder that the 2026 Go Developer Survey closes for submissions on November 3, so there are a few more days to have your say.