Everything our pipeline collected. Use the section tabs and filters to narrow — look for the In digest badge to see which stories actually made it into the newsletter.
a real, expensive problem: US health plans lose billions every year to improper payments and administrative waste in claims processing. We combine clinicians with AI to catch billing errors before the
Engineer (Amsterdam, Netherlands) Senior React SDK Developer (Skopje, North Macedonia)At Stream, we use Go for our video SFU, chat API, Moderation and Feeds, serving high traffic from major apps like
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being a
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go m
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious mod
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory a
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com"
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.
Go pre-release — try it in dev and prod, and file bugs.
🪨 why use many token when few token do trick — Claude Code skill that cuts 65% of tokens by talking like caveman
🥳 Go 1.27 Release Candidate 3 is released! 🔐 Security: Includes 10 security fixes to the standard library and the toolchain. 🏃♀️ Run it in dev! Run it in prod! File bugs! go.dev/issue/new
Go's static binaries make it a pretty natural fit for minimal or distroless style images, so I've been comparing options beyond the usual scratch or distroless base. There are a few Go focused minimal
$80k-$120k + equity, or Contract $50-$150/hr | jobs@arcforma.aiWe build production AI systems inside other people's companies: hotel groups, automotive retail, creative agencies, consumer brands. One
🥳 Go 1.27 Release Candidate 3 is released! 🔐 Security: Includes 10 security fixes to the standard library and the toolchain. 🏃♀️ Run it in dev! Run it in prod! File bugs! https:// go.dev/
🎊 Go 1.26.6 and 1.25.13 are released! 🔐 Security: Includes 10 security fixes to the standard library and the toolchain. 🔈 Announcement: https://groups.google.com/g/golang-announce/c/94pEornpR
TokenHub gives enterprises a private gateway to unify AI model access and governance, making every request controllable, traceable, and attributable.
Ventures is a venture studio building bootstrapped B2B SaaS. Three of our companies are hiring the person who will own their commercial side outright, working alongside a technical founder who ships d
Targeting Go 1.28 — What version of Go are you using ( go version )? $ go version go1.1
Usage-based pricing and billing for developers 🔓 Cloud or self-hosted ⚙️ No-code UI 💰 Realtime usage metering 🎟 Credits & top-ups 🔑 Control feature access
restaurants, bars, and nightclubs, mostly on Oracle MICROS Simphony (we're an Oracle partner). Small team, real money moving in production — you own systems, not tickets.Stack: Go (Echo, GORM, Postg
A race condition in the Docker daemon allows an attacker to create arbitrary empty files on the host system during a "docker cp" operation by swapping a destination path with a symbolic link. The affe
VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf in github.com/canonical/lxd
LXD: Importing a crafted backup leads to project restriction bypass in github.com/canonical/lxd
