ImportStatic
@importstatic.com
Working notes on AI, Rust, Go and Databases, written for people who ship software and would rather read one tested example than three paragraphs of adjectives.
Pinned
ImportStatic
Practical, tested articles on AI engineering, Rust and Go.
importstatic.com
Hi, this is ImportStatic. We write about AI engineering, Rust and Go: what changed in a release, how something behaves when you run it, and which option to pick. Every code sample is compiled and run first. New articles show up here as they are published.
https://importstatic.com
https://importstatic.com
Go's testing.AllocsPerRun skips a warm-up call and truncates the per-run average, so a map that grew 20 times over 1,001 inserts reported 0 allocations. Assert on the total instead.
How to enforce zero allocations in Go when AllocsPerRun rounds them away
testing.AllocsPerRun reported 0 for a Go function that allocated 20 times. How to count every allocation in a test, and what the noalloc checker adds.
importstatic.com
November 4, 2026 at 12:15 AM
Go's testing.AllocsPerRun skips a warm-up call and truncates the per-run average, so a map that grew 20 times over 1,001 inserts reported 0 allocations. Assert on the total instead.
argon2.IDKey in Go's x/crypto allocates its whole memory cost per call. At RFC 9106's 64 MiB, 128 concurrent logins peaked at 4,566-7,164 MiB RSS; a semaphore of 3 kept it at 526 MiB.
Capping Argon2 memory in Go when many logins hash at once
Each argon2.IDKey call in Go allocates its full memory cost. We measured 128 concurrent logins at 64 MiB, with a semaphore and with GOMEMLIMIT.
importstatic.com
November 3, 2026 at 2:14 PM
argon2.IDKey in Go's x/crypto allocates its whole memory cost per call. At RFC 9106's 64 MiB, 128 concurrent logins peaked at 4,566-7,164 MiB RSS; a semaphore of 3 kept it at 526 MiB.
gemini-2.5-flash requests move to Gemini 3.5 Flash-Lite on December 1, and Flash-Lite defaults to minimal thinking. Google's guide says to set medium or high for agents with tool calls. https://aistudio.google.com/docs/whats-new-gemini-3.6
November 3, 2026 at 8:14 AM
gemini-2.5-flash requests move to Gemini 3.5 Flash-Lite on December 1, and Flash-Lite defaults to minimal thinking. Google's guide says to set medium or high for agents with tool calls. https://aistudio.google.com/docs/whats-new-gemini-3.6
Storing Gemini chat history in Go? In our go-genai v1.77.0 test, []*genai.Content survived json.Marshal and Unmarshal with function call ids and thought signatures intact. Rebuilding a turn with NewContentFromFunctionCall dropped both.
November 3, 2026 at 4:37 AM
Storing Gemini chat history in Go? In our go-genai v1.77.0 test, []*genai.Content survived json.Marshal and Unmarshal with function call ids and thought signatures intact. Rebuilding a turn with NewContentFromFunctionCall dropped both.
The Gemini API reroutes gemini-2.5-pro to 3.8 Flash and gemini-2.5-flash to 3.5 Flash-Lite on December 1. Go tool loops using go-genai's helper send no id, which Google says can return empty replies.
The Gemini 2.5 deprecation reroutes your requests on December 1
The Gemini 2.5 deprecation moves gemini-2.5-pro and gemini-2.5-flash to other models on December 1. The new defaults and prices, plus a go-genai tool loop fix.
importstatic.com
November 3, 2026 at 12:16 AM
The Gemini API reroutes gemini-2.5-pro to 3.8 Flash and gemini-2.5-flash to 3.5 Flash-Lite on December 1. Go tool loops using go-genai's helper send no id, which Google says can return empty replies.
A PostgreSQL gotcha: SELECT xact_id::text ... ORDER BY xact_id sorts by the text output column, not the table column, because output names win in ORDER BY. EXPLAIN showed a text sort key. Give the cast an alias and the index is used in order.
November 2, 2026 at 2:09 PM
A PostgreSQL gotcha: SELECT xact_id::text ... ORDER BY xact_id sorts by the text output column, not the table column, because output names win in ORDER BY. EXPLAIN showed a text sort key. Give the cast an alias and the index is used in order.
PostgreSQL's snapshot xmin is cluster-wide: in our test on 18.6, an idle transaction that had written to a different database held it back, while an idle read-only one did not. Worth knowing if a sync job or queue filters on pg_snapshot_xmin().
November 2, 2026 at 11:00 AM
PostgreSQL's snapshot xmin is cluster-wide: in our test on 18.6, an idle transaction that had written to a different database held it back, while an idle read-only one did not. Worth knowing if a sync job or queue filters on pg_snapshot_xmin().
Polling Postgres with WHERE updated_at > cursor loses rows when a transaction commits after the cursor passes its timestamp. About 8.5% ended wrong in our test. A pg_snapshot_xmin filter lost none.
Why updated_at pagination skips rows in PostgreSQL
A sync cursor on updated_at loses rows when transactions commit out of order. We reproduced it with pgx and tested the fixes that work on PostgreSQL 18.
importstatic.com
November 2, 2026 at 7:54 AM
Polling Postgres with WHERE updated_at > cursor loses rows when a transaction commits after the cursor passes its timestamp. About 8.5% ended wrong in our test. A pg_snapshot_xmin filter lost none.
Google's Computer Use guide sets safety_acknowledgement to the boolean True. Its reference agent sends the string "true" through generate_content. We have no API key to test either, so check yours against a real response.
November 2, 2026 at 7:53 AM
Google's Computer Use guide sets safety_acknowledgement to the boolean True. Its reference agent sends the string "true" through generate_content. We have no API key to test either, so check yours against a real response.
Fast mode on Claude Opus 4.8 is deprecated and goes away on November 30, 2026. After that, claude-opus-4-8 requests with speed: "fast" return an error. The migration path in the release notes is Opus 5.5. https://platform.claude.com/docs/en/release-notes/overview
November 2, 2026 at 4:47 AM
Fast mode on Claude Opus 4.8 is deprecated and goes away on November 30, 2026. After that, claude-opus-4-8 requests with speed: "fast" return an error. The migration path in the release notes is Opus 5.5. https://platform.claude.com/docs/en/release-notes/overview
Google's Go samples for Gemini Computer Use fail to compile on go-genai 1.77.0 because Input needs a pointer. They also never check safety_decision, and the API terms bar bypassing human confirmation.
https://importstatic.com/ai/gemini-computer-use-go-loop
https://importstatic.com/ai/gemini-computer-use-go-loop
Gemini Computer Use in Go: fixing the docs samples and adding safety checks
Gemini Computer Use Go samples fail to compile on go-genai 1.77.0. The fix, a loop that handles safety confirmations, and two options for stored screenshots.
importstatic.com
November 2, 2026 at 12:15 AM
Google's Go samples for Gemini Computer Use fail to compile on go-genai 1.77.0 because Input needs a pointer. They also never check safety_decision, and the API terms bar bypassing human confirmation.
https://importstatic.com/ai/gemini-computer-use-go-loop
https://importstatic.com/ai/gemini-computer-use-go-loop
PyPI now rejects V7 tarballs at upload and says GNU ones get warnings, then rejections, with no dates yet. In our sample of 3,307 sdists uploaded since 2025, 111 were GNU, and 97 of those declared uv_build or maturin as their backend. https://docs.pypi.org/archives/
November 1, 2026 at 4:57 PM
PyPI now rejects V7 tarballs at upload and says GNU ones get warnings, then rejections, with no dates yet. In our sample of 3,307 sdists uploaded since 2025, 111 were GNU, and 97 of those declared uv_build or maturin as their backend. https://docs.pypi.org/archives/
tar-codec's default name validator refuses colons in any path. Extracting mailman-3.3.10 with uv's settings stopped at domain:admin:notice:new-list.txt, the only one of 4,252 latest PyPI sdists we tested to fail. tar-codec 0.0.15, called directly.
November 1, 2026 at 1:51 PM
tar-codec's default name validator refuses colons in any path. Extracting mailman-3.3.10 with uv's settings stopped at domain:admin:notice:new-list.txt, the only one of 4,252 latest PyPI sdists we tested to fail. tar-codec 0.0.15, called directly.
go version -m prints the GODEBUG defaults compiled into a Go binary, so you can read them without the source. In our Go 1.27.3 test they survived -ldflags="-s -w" -trimpath. An empty result for a setting means the toolchain default applies.
November 1, 2026 at 10:46 AM
go version -m prints the GODEBUG defaults compiled into a Go binary, so you can read them without the source. In our Go 1.27.3 test they survived -ldflags="-s -w" -trimpath. An empty result for a setting means the toolchain default applies.
The latest sdists of 4,252 popular PyPI packages use six tar entry types and five pax keys. 383 are GNU format, which PyPI plans to reject. tar-codec decoded all of them.
https://importstatic.com/rust/pypi-sdists-tar-features-measured
https://importstatic.com/rust/pypi-sdists-tar-features-measured
The tar features PyPI sdists use, counted across 4,744 archives
We ran tar-codec, tar and Go's archive/tar over 4,744 PyPI sdists. Six entry types and five pax keys cover the latest releases, and 9% are still GNU format.
importstatic.com
November 1, 2026 at 7:33 AM
The latest sdists of 4,252 popular PyPI packages use six tar entry types and five pax keys. 383 are GNU format, which PyPI plans to reject. tar-codec decoded all of them.
https://importstatic.com/rust/pypi-sdists-tar-features-measured
https://importstatic.com/rust/pypi-sdists-tar-features-measured
GODEBUG=multipath=0 does nothing and prints nothing, because Go ignores unknown keys in that variable. The same typo in go.mod stops the build: unknown godebug "multipath". We ran both on Go 1.27.3. The correct key is multipathtcp.
November 1, 2026 at 4:05 AM
GODEBUG=multipath=0 does nothing and prints nothing, because Go ignores unknown keys in that variable. The same typo in go.mod stops the build: unknown godebug "multipath". We ran both on Go 1.27.3. The correct key is multipathtcp.
A go.mod with go 1.23 builds a server with MPTCP off. One go get of x/net raised that line to 1.26 and turned it on, with nothing in the output about MPTCP.
https://importstatic.com/go/go-mptcp-listener-check-disable
https://importstatic.com/go/go-mptcp-listener-check-disable
How to check for Go MPTCP listeners and turn them off
Go 1.24+ on Linux listens with MPTCP by default, which the CVE-2026-98432 exploit needs. Read the setting from a binary, disable it, and know its limits.
importstatic.com
November 1, 2026 at 12:14 AM
A go.mod with go 1.23 builds a server with MPTCP off. One go get of x/net raised that line to 1.26 and turned it on, with nothing in the output about MPTCP.
https://importstatic.com/go/go-mptcp-listener-check-disable
https://importstatic.com/go/go-mptcp-listener-check-disable
rustc nightly now has -Zasync-panic. We ran it on the Oct 29 nightly: with =no, a finished async fn returns Pending instead of panicking, and so does one whose body panicked. The tracking issue calls it a lang experiment. https://github.com/rust-lang/rust/issues/164106
October 31, 2026 at 1:43 PM
rustc nightly now has -Zasync-panic. We ran it on the Oct 29 nightly: with =no, a finished async fn returns Pending instead of panicking, and so does one whose body panicked. The tracking issue calls it a lang experiment. https://github.com/rust-lang/rust/issues/164106
Gemini's store field sits on each request inside a batch, not on the batch itself. In go-genai 1.77.0, a batch with Store: false had no top-level store; it appeared inside each inline request.
October 31, 2026 at 10:38 AM
Gemini's store field sits on each request inside a batch, not on the batch itself. In go-genai 1.77.0, a batch with Store: false had no top-level store; it appeared inside each inline request.
Polling a finished Rust future: async fn and JoinHandle panic, tokio sleep returns Ready again, and Fuse returns Pending with no wakeup. Tested on tokio 1.54.1.
https://importstatic.com/rust/rust-async-fn-resumed-after-completion
https://importstatic.com/rust/rust-async-fn-resumed-after-completion
Why Rust panics with "async fn resumed after completion"
Polling a finished Rust future can panic, hang or return Ready again. What async fn, tokio and futures each do, and how to fix the panic in a select! loop.
importstatic.com
October 31, 2026 at 7:33 AM
Polling a finished Rust future: async fn and JoinHandle panic, tokio sleep returns Ready again, and Fuse returns Pending with no wakeup. Tested on tokio 1.54.1.
https://importstatic.com/rust/rust-async-fn-resumed-after-completion
https://importstatic.com/rust/rust-async-fn-resumed-after-completion
In go-genai 1.77.0, ExtraBody on the client is merged into every request body. With store=false there, a call setting Store: true still sent false, and countTokens and embedding calls carried the field too. We tested against a local stub server.
October 31, 2026 at 6:30 AM
In go-genai 1.77.0, ExtraBody on the client is merged into every request body. With store=false there, a call setting Store: true still sent false, and countTokens and embedding calls carried the field too. We tested against a local stub server.
Cursor's cleanup script for the tampered Claude Code extension notes that the attacker's key is appended without a leading newline, so it can share a line with a real key. A line-by-line fingerprint check could miss that. We searched for the key text as a substring.
October 31, 2026 at 3:24 AM
Cursor's cleanup script for the tampered Claude Code extension notes that the attacker's key is appended without a leading newline, so it can share a line with a real key. A line-by-line fingerprint check could miss that. We searched for the key text as a substring.
Paid Gemini API projects created since Oct 26 keep prompts and responses in logs for up to 55 days by default. store=false needs go-genai 1.76, and each batch request sets it separately.
https://importstatic.com/ai/gemini-api-logging-store-default
https://importstatic.com/ai/gemini-api-logging-store-default
Gemini API logging is now on by default for new paid projects
Gemini API logging is now on by default for new paid projects, with 55-day retention. Turn it off in AI Studio, or set store=false per request in Go.
importstatic.com
October 31, 2026 at 12:20 AM
Paid Gemini API projects created since Oct 26 keep prompts and responses in logs for up to 55 days by default. store=false needs go-genai 1.76, and each batch request sets it separately.
https://importstatic.com/ai/gemini-api-logging-store-default
https://importstatic.com/ai/gemini-api-logging-store-default
Cursor's check for the tampered Claude Code 2.1.313 extension greps one file. On a test home with the key gone and the LaunchAgent left, it printed 'machine not impacted'.
https://importstatic.com/ai/claude-code-extension-2-1-313-check
https://importstatic.com/ai/claude-code-extension-2-1-313-check
How to check if the tampered Claude Code extension reached your machine
Cursor's check for the tampered Claude Code extension looks at one file. A read-only Go checker for the other indicators, and what to do if you find them.
importstatic.com
October 30, 2026 at 3:14 PM
Cursor's check for the tampered Claude Code 2.1.313 extension greps one file. On a test home with the key gone and the LaunchAgent left, it printed 'machine not impacted'.
https://importstatic.com/ai/claude-code-extension-2-1-313-check
https://importstatic.com/ai/claude-code-extension-2-1-313-check
Storing an int in an interface in Go only allocates when the value is outside 0-255: the runtime points small values at a read-only [256]uint64 table. On Go 1.27.3, sink = n % 200 made 0 allocations per call and sink = n + 1000 made 1.
October 30, 2026 at 1:36 PM
Storing an int in an interface in Go only allocates when the value is outside 0-255: the runtime points small values at a read-only [256]uint64 table. On Go 1.27.3, sink = n % 200 made 0 allocations per call and sink = n + 1000 made 1.