<p><strong>TLDR:</strong> TypeScript 7.0 hit release candidate this week — the compiler rewrite in Go delivers roughly 10x faster builds, with stable release expected within a month. A North Korea-linked supply chain campaign called PolinRider has expanded into Go modules, with 162 malicious artifacts found across 108 packages hiding payloads in fake font files and VS Code task configs. Go 1.26 is out with Green Tea GC as the default, promising 10–40% lower GC overhead for production services. OpenAI also published a detailed writeup on how they serve voice AI to 900 million weekly users using a Go relay built on SO_REUSEPORT and pre-allocated buffers.</p>
<hr>
<h2>TypeScript 7.0 RC: compiler rewritten in Go, ~10x faster builds</h2>
<p>Microsoft shipped the release candidate for TypeScript 7.0, the first version of the compiler rewritten in Go. The speedup comes from native code execution and shared-memory parallelism across parsing, type checking, and emit — roughly 10x faster than TypeScript 6.0. A stable programmatic API won’t land until 7.1, but a compatibility shim (@typescript/typescript6) lets both versions coexist. Final release is expected within a month. Worth watching if you maintain any tooling that shells out to tsc. <a href="https://daily.dev/posts/Xyzb6yCXV" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>PolinRider: North Korea-linked campaign plants malware in Go modules</h2>
<p>Socket and JFrog independently documented a North Korea-linked supply chain campaign that has expanded from npm into Go modules, Packagist, and Chrome extensions. Researchers found 162 malicious release artifacts across 108 packages. The attack hides JavaScript loaders inside fake .woff2 font files and triggers execution via VS Code task files that auto-run on folder open — bypassing the lifecycle script detection most tools rely on. Payloads use TRON and Aptos blockchain RPCs as dead-drop infrastructure to retrieve second-stage malware that steals browser credentials, GitHub tokens, crypto wallets, and cloud storage metadata. If you’ve pulled any unfamiliar Go modules recently, treat the environment as compromised, rotate secrets from a clean machine, and audit your VS Code task configs. <a href="https://daily.dev/feed-by-ids?id=6HetdRGL4&amp;id=xKZgY7UCD" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Go 1.26 ships with Green Tea GC as default</h2>
<p>Go 1.26 makes Green Tea GC the default, with the team claiming 10–40% reduction in GC overhead for production services — no code changes required. Other additions worth noting: an experimental goroutine leak profiler (building on what 1.27 formalizes), heap base address randomization, faster cgo calls, and three new standard library packages including crypto/hpke and runtime/secret. The rewritten go fix tool also gains a source-level inliner for library migration paths. cmd/doc is removed in favor of go doc. <a href="https://daily.dev/posts/EeI6x0bGf" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>How OpenAI serves voice AI to 900M users with a Go relay</h2>
<p>OpenAI published the architecture behind their WebRTC voice infrastructure. The relay is stateless and written in Go, using SO_REUSEPORT, runtime.LockOSThread for thread pinning, and pre-allocated buffers — no kernel bypass. The clever bit is encoding destination metadata into the ICE ufrag field so the relay can forward the first packet to the right transceiver without a database lookup. Worth reading if you’re building any real-time or low-latency Go services; the tradeoffs around SFU vs TURN vs custom relay are explained clearly. <a href="https://daily.dev/posts/dyaTZVNEs" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Gin at 12 years: radix tree routing, zero broken APIs, 88k stars:</strong> Gin’s creator wrote up the original design decisions — radix tree router for O(k) lookups, sync.Pool for Context objects, and a strict backward compatibility promise modeled on Go’s own — explaining how a framework built in 2014 for a failed startup still compiles unchanged today. <a href="https://daily.dev/feed-by-ids?id=HPYKJID1s&amp;id=xsMofoBsS" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Go singleflight for cache stampede prevention:</strong> A practical walkthrough of wiring <a href="http://golang.org/x/sync/singleflight" target="_blank" rel="noopener nofollow">golang.org/x/sync/singleflight</a> into a cache-aside pattern covers the key pitfalls: don’t pass a caller’s context into the shared call, don’t mutate the shared return value, and measure coalescing effectiveness via the shared bool before deciding whether you need Redis-level coordination. <a href="https://daily.dev/posts/0L7XM5yYL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>etcd-operator v1alpha2 donated to Cozystack, drops StatefulSet management:</strong> The rewritten etcd-operator abandons StatefulSet-based member management for direct use of etcd’s Membership API, adds scale-to-zero, CEL-based CRD validation without webhooks, and ships an in-place migration tool (etcd-migrate) that upgrades from v1alpha1 without quorum loss. <a href="https://daily.dev/posts/Tc8dzITg3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>shenv: age-encrypted .env sharing via git, no server required:</strong> shenv is a Go CLI that encrypts .env files with age, commits the ciphertext to git, and decrypts only for teammates whose public keys are in a recipients.shenv file — with a shenv run command that injects secrets directly into a process without ever writing plaintext to disk. <a href="https://daily.dev/posts/BXWVV70iW" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


Go language updates, concurrency patterns, and community projects.

Go Digest

TypeScript 7.0 hit release candidate this week — the compiler rewrite in Go delivers roughly 10x faster builds, with stable release expected within a month. A North Korea-linked supply chain campaign called PolinRider has expanded into Go modules, with 162 malicious artifacts found across 108 packages hiding payloads in fake font files and VS Code task configs. Go 1.26 is out with Green Tea GC as the default, promising 10–40% lower GC overhead for production services. OpenAI also published a detailed writeup on how they serve voice AI to 900 million weekly users using a Go relay built on SO_REUSEPORT and pre-allocated buffers.

TypeScript 7.0 RC lands in Go, North Korea targets Go modules