AUDIT.md raw

Stdlib Audit: Moxie .mx vs Go upstream

Reference: Go 1.25.3 at ~/go/src/

Batch 1: runtime/, os/, syscall/ (2026-05-29)

runtime/ (97 files)

os/ (42 files)

syscall/ (51 files)

Cross-cutting finding: string + concatenation

65 files across the stdlib still use + instead of | for string concatenation. The compiler accepts both (ir_emit.mx line 1783: OpAdd and OpOr both dispatch to emitSliceConcat for string types). Not a bug, but should be converted for language consistency. Packages affected: os/, net/, net/http/, crypto/x509/, archive/, debug/, go/, syscall/js/, vendor/

Batch 2-7: pending