Go Library

Excelize v2.11.0: an important release with security fixes for XLSX reading, lower memory usage, and improvements to formulas, charts, and pivot tables. Includes breaking changes: Go 1.25+ is now required, and some chart/shape APIs were changed. https://github.com/xuri/excelize/releases/tag/v2.11.0

Channel iteration and goroutine leak

I ran into the classic “range over a channel” leak while working on a custom cron scheduler. I’ve debugged it on prod many times before, but writing one myself in a small piece of code reminded me how easy it is to write bugs like this even when you know about it.

https://rednafi.com/go/channel-iteration-goroutine-leak

Excessive nil pointer checks in Go

Let’s talk about nil pointer checks in Go. You want to prevent panics in production, but that doesn’t start with a deferred recover. It starts with defensive programming. Check your inputs, check your bounds, and check pointers for nil before dereferencing them. I’ve started to see more nil checks in Go code. In the right place, they are necessary for writing safe code. In the wrong place, they are a sign that the code has stopped being clear about what can and cannot be nil. I have noticed this pattern more in generated code, but this symptom is not new and is not limited to AI. When a nil check is cheap and prevents a panic, why not add it? Your reflex may be, let’s just be safe. But the check also tells the next reader something, and often the wrong thing.

https://konradreiche.com/blog/excessive-nil-pointer-checks-in-go

Shard your locks: benchmarking 6 Go cache designs

TL;DR: Shard your locks. A 256-way striped map (sharded) was the all-around winner — up to 8× faster than a single sync.Mutex at 8 cores — and it’s about 15 lines of code. sync.RWMutex, the reflexive fix for “reads are contended,” is a trap: it barely helps reads past two cores and is slower than a plain mutex for writes.

https://strebkov.dev/posts/shard-your-locks

router

Model router for agentic systems. Routes every prompt to the right model in <50ms. Cut costs 40-70% with just an endpoint change.

https://github.com/workweave/router

hasp

HASP is a local secret broker for coding agents. Agents need credentials to run tests, call APIs, and deploy code. Copying those credentials into prompts, shell history, .env files, or repo-local notes makes the agent faster today and harder to trust tomorrow. HASP keeps secrets in a local encrypted vault and gives commands only the values they are allowed to use at runtime. The core rule is: Managed secret values must not enter agent context.

https://github.com/gethasp/hasp

gopls's Model Context Protocol (MCP) Server

Gopls includes an experimental built-in server for the Model Context Protocol (MCP), allowing it to expose a subset of its functionality to AI assistants in the form of MCP tools.

https://go.dev/gopls/features/mcp

🔍 ТОП-5 ошибок на алгоритмической сессии Привет, на связи Таня Коровкина из ШОРТКАТ. Ментор по алгоритмам и backend-разработчик Каждый месяц тысячи разработчиков совершают одни и те же ошибки на алгоритмических интервью 🚩 И продолжают готовиться... не к тому. 6 июля(понедельник) в 19:00 (МСК) проведу вебинар и покажу, что на самом деле оценивает интервьюер и какие ошибки чаще всего приводят к отказу • дам практические советы, которые можно использовать уже на следующем собеседовании • расскажу про специфику российского BigTech 🤘 Это бесплатно. Эфир проходит в рамках менторской программы от ШОРТКАТ для разработчиков, которые хотят повысить свой грейд, ЗП и прокачать скиллы. Переходи в нашего бота, чтобы получить ссылку на эфир → @shortcut_go_bot Реклама. О рекламодателе.

Building Agents in Go Without a Framework

A production agent is a long-running, concurrent, I/O-bound process that spends most of its time waiting on a model, a tool, or a human. That shape fits Go's runtime. This post explains why, surveys the Go framework options, and shows how to build an agent without one.

https://blog.getzep.com/agentic-development-in-go

MaxBytes Middleware in Go: The Same Trap, Again

Most of my API accepts small JSON payloads, so a strict global limit is a sane default. File uploads need a couple of orders of magnitude more. And the obvious solution – overriding the limit with another middleware on that route – fails in exactly the same way. Silently.

https://destel.dev/blog/max-bytes-middleware-in-go

Dependencies should be fetched directly from VCS

One aspect where I do feel Go is clearly better is dependency management; specifically the security aspect thereof. Go is not magically immune to malicious dependencies, but it is a lot more resistant to them chiefly because there is no "publish a package" step.

https://www.arp242.net/deps-vcs.html

How does struct{} take zero bytes in Go

While learning Go, I came across struct{}. First as a way to implement memory-efficient sets, since it takes zero bytes. Then again with goroutines, where it's the standard way to send a signal over a channel. What I didn't fully understand was: how does something that takes zero bytes actually work under the hood?

https://www.bud1m.com/blog/go-empty-struct

Finding Leaked Goroutines in Go 1.27

Go 1.27 is getting a goroutine leak detector in runtime/pprof. The proposal was accepted in April.

https://rednafi.com/shards/2026/06/go-goroutine-leak-profile

Understanding the Go Runtime: The Reflect Package https://internals-for-interns.com/posts/go-runtime-reflect

kor

Kor is a tool to discover unused Kubernetes resources.

https://github.com/yonahd/kor

gobee

Write your BPF programs in Go, not C. gobee transpiles a Go subset to BPF C and generates typed cilium/ebpf bindings.

https://github.com/boratanrikulu/gobee

errcheck

errcheck finds silently ignored errors in Go code.

https://github.com/kisielk/errcheck

🔍Тестовое собеседование с Go TeamLead из американского FinTech в этот четверг 25 июня(в четверг!) в 19:00 по мск приходи онлайн на открытое собеседование, чтобы посмотреть на настоящее интервью на Middle Go-разработчика. Как это будет: 📂 Дмитрий Дорофеев, Go TeamLead в американском FitTech Truv Inc, ex-VK, будет задавать реальные вопросы и задачи разработчику-добровольцу 📂 Дмитрий будет комментировать каждый ответ респондента, чтобы дать понять, чего от вас ожидает собеседующий на интервью 📂 В конце можно будет задать любой вопрос Дмитрию Это бесплатно. Эфир проходит в рамках менторской программы от ШОРТКАТ для Go-разработчиков, которые хотят повысить свой грейд, ЗП и прокачать скиллы. Переходи в нашего бота, чтобы получить ссылку на эфир → @shortcut_go_bot Реклама. О рекламодателе.

fiber

Fiber is an Express inspired web framework built on top of Fasthttp, the fastest HTTP engine for Go. Designed to ease things up for fast development with zero memory allocation and performance in mind.

https://github.com/gofiber/fiber

Generating an MCP server in Go

MCP is table stakes for products these days. Everything’s AI, and agents will query your data one way or another. As we’ve built Oblique, a core principle is not having internal APIs. Anything a user is able to do in the UI should be possible through Terraform or REST - and now, MCP. We generate tons of bindings from our gRPC interface with the explicit intent that as new features are added, they make their way to all of our integration points.

https://oblique.security/blog/mcp