Go 1.27 ships goroutine leak profiles

The Go blog's write-up on goroutine leak profiles in Go 1.27 is the piece to read, giving the runtime a first-class way to point at the goroutines that never came back. Tim Bray's post on un-racing a straightforward concurrency bug lands in the same territory from the other end, walking through the side-trips a supposedly simple fix takes in real code. Elsewhere, three Gitea advisories drop together (reusable OAuth2 codes, a path traversal in release asset dumps, and under-validated repo creation fields), which is worth a look for anyone self-hosting.