# dev-news log, Tuesday, 10 November 2026

Source: https://dev-news.anonyfox.com/log/2026-11-10/

**Go 1.27.4 / 1.26.11** {go} (2026-11-10). The Go release announcement lists 12 security fixes: CVE-2026-97033 through CVE-2026-97043 plus CVE-2026-97054. Eleven concern the build toolchain; CVE-2026-97054 fixes an HTTP/1 server crash caused by a MaxBytesReader header race. [notes](https://go.dev/doc/devel/release#go1.27.4) · [announcement](https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM)

**Visual Studio Code 1.145.3** {vscode} (2026-11-10). Two confirmed security advisories patched in 1.145.3 are CVE-2026-102230 and CVE-2026-120780. The first fixes integrated-browser uploads that could expose local files without path-based approval. The second fixes a serve-web release downgrade that could restore vulnerable server behavior. [notes](https://code.visualstudio.com/updates/v1_145) · [upload advisory](https://github.com/microsoft/vscode/security/advisories/GHSA-f56j-7499-5hch) · [serve-web advisory](https://github.com/microsoft/vscode/security/advisories/GHSA-xfg5-fq3p-cx69)