Go security fixes for sumdb bypasses lead the day

Go maintainers issued multiple security releases and an x/mod update to close sumdb verification bypasses that could allow malicious proxies to inject undetected modules. Git developers proposed a packfile performance fix, while Python core developers continued work on a module exports PEP.

golang.org/x/mod v0.40.0 closes sumdb bypasses

The Go team released golang.org/x/mod v0.40.0 fixing two sumdb transparency log bypass vulnerabilities, tracked as CVE-2026-56865. A malicious GOPROXY or GOSUMDB could previously serve modules without detection. Projects relying on the module proxy and checksum database infrastructure should update to block undetected module injection.

Go 1.26.6 and 1.25.13 security releases

Go 1.26.6 and Go 1.25.13 shipped with ten security fixes, including a sumdb tile verification bypass that enabled malicious module injection via GOPROXY. The releases also harden module hash handling against related cache attacks. Operators running these stable lines in production should upgrade to obtain the protections.

Go 1.27 RC3 includes the same security fixes

Go 1.27 Release Candidate 3 was published containing the ten security fixes for sumdb tile verification and module hash handling. The candidate folds the protections into the upcoming release train. Testers evaluating 1.27 should move to this RC for the corrected behavior.

Git packfile list insertion performance fix

A patch on the Git list corrects an O(N squared) regression in packfile list insertion that appeared after a 2025 refactor. The slowdown is noticeable in monorepos that carry very large pack counts, such as sets of 38k packs. The change restores efficient insertion for repositories with many packs.

PEP 842 module exports sees active revision

A revised draft of PEP 842, which proposes an export keyword for marking module public names, drew sustained discussion among Python core developers including Guido van Rossum. Participants debated syntax options and the relationship to existing all semantics. The work aims to make public API boundaries in Python modules more explicit.