
Research
Node.js Fixes AsyncLocalStorage Crash Bug That Could Take Down Production Servers
Node.js patched a crash bug where AsyncLocalStorage could cause stack overflows to bypass error handlers and terminate production servers.
See what code using these bindings looks like:
https://github.com/mbenkmann/bindings/tree/master/examples
master branchhttps://godoc.org/github.com/mbenkmann/bindings
newest branchhttps://godoc.org/gopkg.in/mbenkmann/bindings.v9
The bindings need the C development files of the respective libraries. The following are example commands for installing the SDL library. Other libraries are installed in a similar fashion.
On Ubuntu, type:
apt install libsdl2-dev
On Fedora, type:
yum install SDL2-devel
On Arch Linux, type:
pacman -S sdl2
On Gentoo, type:
emerge -av libsdl2
On macOS, use Homebrew:
brew install sdl2 pkg-config
Use go get to install the bindings to your $GOPATH. The following example
command will install the bindings for SDL:
go get -v https://winterdrache.de/bindings/sdl
newest' branchThe default branch installed by go get contains bindings for library versions
that are about 2 years old. That way they can be used right away with the
libraries provided by your operation system even if you are not using the most
recent version. Programs developed with these bindings will be compatible with
older systems without you having to ship a recent version of the respective
library.
However, if you need features only provided by more recent library versions, or
if you are going to ship copies of the libraries with your program anyway, you
will want to use bindings that support the most recent features. To do this,
make sure you have the most recent development files of the respective libraries
installed, then switch to the 'newest' branch like this
cd ${GOPATH%%:*}/src/winterdrache.de/bindings
git checkout newest
Install the libraries and the ready-made bindings first. Then follow these instructions:
https://github.com/mbenkmann/bindings/tree/master/generators
Provide developers who have used the supported libraries with other programming languages an easy way to use them with Go.
Offer a Go API that is similar to the C API, so that
However, API that permits out of bounds writes without use of package unsafe must be avoided; and API that permits out of bounds reads without package unsafe should be avoided.
API stability matching the original library, i.e. as long as the original library's API does not change, the Go binding API should not change.
Produce as much of the bindings as possible with generalized scripts, keep library-specific configuration to a minimum and use handwritten bindings only as a last resort. This way
Do not introduce additional failure points, i.e. if a C code fragment using a supported library has no bugs, the equivalent Go code using the bindings should not have any bugs, either. In fact, the behaviour should be exactly the same.
Support Linux, Windows and macOS.
The following are things that could be legitimate project goals but that this project has deliberately chosen not to pursue:
The project is being developed mainly on Ubuntu Linux. Your help in supporting other platforms is appreciated.
This project was initiated in May 2018. It is therefore very young and not completely settled.
Because the bindings are mechanically generated, most functions have only received little manual review. Especially functions that take pointer arguments are an issue because unless the pointer target is declared "const", it is not possible to automatically determine if it is an input, output or both. The scripts rely on manually maintained lists of defaults and exceptions for these cases. As this project gets used by more people, these lists will get better. However, as a user of this library you have to do your part in this effort.
If you see something, say something!
Filing an issue on Github is quick and painless and unlike calling the cops on a "suspicious" cardboard box, an incorrect issue will not cause airports to shut down or schools to be evacuated.
Examples of things to look out for:
In all such cases it doesn't hurt to take a quick look at the generated wrapper function. Most issues are easy to spot, e.g. if the documentation mentions that the caller has to free a returned string, but the wrapper function does not contain the word "free", that's almost certainly an issue.
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Node.js patched a crash bug where AsyncLocalStorage could cause stack overflows to bypass error handlers and terminate production servers.

Research
/Security News
A malicious Chrome extension steals newly created MEXC API keys, exfiltrates them to Telegram, and enables full account takeover with trading and withdrawal rights.

Security News
CVE disclosures hit a record 48,185 in 2025, driven largely by vulnerabilities in third-party WordPress plugins.