Issue #427: Go's new vulnerability analysis tool — Go Weekly

#​427 — September 9, 2022

Unsubscribe | Read on the Web

The Go Weekly Newsletter

Go's New Vulnerability Management Tool: govulncheck — The core team has unveiled a very helpful command-line tool that can scan your code for vulnerabilities, only surfacing the ones that actually affect your code base. We can see this being a standard part of any build pipeline, so try it out and give your feedback.

Julie Qiu (Go Team)

A Complete Guide to Logging with Zerolog — This is a very extensive tutorial, and if you want a high-performance, zero-allocation logging library, Zerolog comes well recommended.

Better Stack Team

Gophers - Opportunity is Knocking — We’re a premier software engineering firm looking for mid to senior level engineers to help us develop advanced software solutions and applications in Go. Got at least 1 year of professional Go experience and located in the Americas or Western Europe? We want to hear from you.

Ardan Labs sponsor

Go Developer Survey 2022 Q2 Results — Over time, the Go team has increased the cadence of its community surveys, and while only about six thousand gophers responded to this one, the results remain interesting:

• Most developers are happy Go has both generics and fuzz testing support, but "don't have a specific need for them right now."

• The "top challenge" has shifted from generics to error handling.

• Avoiding dependencies with known vulnerabilities is the top security-related challenge.

Sudoku, Go and WebAssembly — Sudoku! Now we’re talking :-) (Any fellow Cracking the Cryptic fans here?) Eli explains his recent experiments with generating Sudoku puzzles from Go for his family to play.

Eli Bendersky

• Bringing Structured, Leveled Logging to the Standard Library?
  ↳ A discussion on the official Go repo.

• The Story of DigitalOcean's Rails to Go App Migration
  ↳ The hows and whys of taking a key internal app from Rails to Go-powered microservices.

• A Portal Between Ruby and Go (using FFI)
  ↳ More Ruby to Go migration manoeuvring.

• ▶️ Practical Memory Profiling
  ↳ Bill Kennedy's GopherCon Europe 2022 talk. We'll be featuring more talks from the event next week.

🛠 Code & Tools

Statsviz: Visualize Go Runtime Metrics in the Browser — A major rewrite that now uses runtime/metrics rather than runtime.MemStats for more precise, real-time results. GitHub repo.

Aurélien Rainone

Lane 2.0: Generic PriorityQueues, Queues, Stacks, and Deques — Aims to provide ‘textbook’ implementations of several queue data structures. v2.0 introduces support for generics and you can now use custom types without reflection.

Théo Crevon

Deliver a Chat Experience That Won't Disappoint with Stream

Stream sponsor

Viper: A Complete Config Solution for Go Apps — A mature project used by projects like Hugo and Docker Notary for their configuration needs. It’s been a couple of years since we linked to it and 1.13.0 has just dropped – Go 1.19 support has been added, and etcd3 is now supported as a remote provider.

Steve Francia

sx: Fast, Modern, Easy-to-Use Network Scanner — Handles ARP, TCP, UDP, ICMP scans and more. Takes a very Unix-y approach and boasts being 30x faster than nmap.

v-byte-cpu

Lip Gloss 0.6: Style Definitions for Nice Terminal Layouts — Provides a ‘fluent’-style API for stylizing text output from your programs in a rather pretty way.

Charm

Participle: A Parser Library for Go — Participle takes the familiar approach of using struct field tags to define a grammar, so if you’ve used encoding/json, you’re well on your way.

Alec Thomas

⚡️ QUICK RELEASES:

• Echo 4.9
  ↳ High performance, minimal web framework.

• Multi Progress Bar 8.0
  ↳ Progress bar option for CLI apps.

• goleak 1.2
  ↳ Goroutine leak detector from Uber.

• Scany 1.2
  ↳ Scan data from a database into structs.

• FastHTTP 1.40
  ↳ Performance tuned HTTP package.

• Weaviate 1.15
  ↳ 'ML-first' vector search engine.

• Mo 1.2
  ↳ Monads and popular FP abstractions powered by generics.