#623 — November 6, 2026

Together with

The Official Guide to encoding/json/v2 (and Migrating to It) — Now that encoding/json/v2 and jsontext are stable, the Go team has a refreshed introduction to how they work, including how v1 and v2 interoperate. There's also a new migration guide which shows off jsonsplit for running v1 and v2 side by side in production and logging any differences.

Pratt, Tsai, Martí et al. (Go Team)

💡 Lleg put v2 to the test and found nine default behavior changes, 10% faster unmarshaling on plain structs, and big perf gains for deeply recursive custom decoders.

What Happens to Your go func() When the Pod Restarts? — Whatever it was doing is gone: you lose the email being sent or the webhook call. Go Event-Driven, the hands-on training from Watermill's authors, starts with goroutines and ends with Go services where data survives a restart. Don’t miss the last cohort this year that opens November 11.

Three Dots Labs sponsor

How //go:embed Works: From Source Files to Binary — A guided tour of how an embedded file travels through the toolchain, with links to the Go source for each step. Along the way, we learn why import _ "embed" is needed, even when you never reference the package.

Ainsley Clark

IN BRIEF:

The draft Go 1.28 release notes now list two new go vet checks for unchecked bufio.Scanner and sql.Rows errors, a FlagSet.All iterator, url.MustParse and Landlock support for subprocesses. The release is targeted for February 2027.
🔐 Go 1.27.4 and 1.26.11 are due on November 10 with security fixes to the standard library and toolchain covering twelve CVEs (a lot for a minor release).
React framework Next.js has added (in its 'canary' build) experimental route.go handlers where you can write plain net/http-style GET/POST funcs in a route.go file and Next.js will serve them as routes.
Following last month's accepted experiment for building cgo code without a C toolchain, a CL in review reimplements runtime/cgo in Go and assembly on every remaining OS and removes the C code entirely.

PROPOSAL UPDATES:

maps.Grow has been accepted and may make it into Go 1.28. Redowan Delowar explains why it's useful.
unicode/ascii, a package of ASCII-only string functions generic over strings and byte slices, has been proposed, with naming as a sticking point.
runtime/bubble, from two Temporal engineers, would build on testing/synctest's bubbles to let a host program run goroutines, channels and select deterministically.
math/decimal, an arbitrary-precision decimal type with explicit rounding modes, has been proposed with an implementation already attached.

Go's Generic Collections Proposal Has Been Accepted — We covered the initial plan in July but now the umbrella proposal is accepted, along with set.Set and hash-based Map and Set types. They'll land in golang.org/x/exp/collection first.

The Go Team

Go's GC Can Hit a Wall on 192 Cores — I doubt many of us work with such mammoth systems, but on 192-core amd64 hosts, heap-triggered GC cycles can take 3-4x longer as idle cores pile onto a shared lock-free stack. arm64 already has mitigations for this, and fixes are in review.

Nate Watson et al.

Is Your Go Service Ready for AI Agents? Run the Free POKE Audit — A free agent skill that audits your Go service and gives the smallest steps to add an event log, SSE, and webhooks.

Svix sponsor

📄 The MustCreate Pattern for Go Tests – How a generic MustCreate(t, NewUsername, "joe123") can replace a pile of per-type test helpers. Michael Lynch

📄 The Heap Profile Named a Function I Didn't Write – alloc_space measures churn, inuse_space what's still live, which can point to different allocation hotspots. Nolan Keir

📄 Sandboxing Subprocesses with Landlock in Go 1.28 – How Go 1.28 will make it easier to restrict subprocesses on Linux. Mohammad Abdolirad

📄 Five Go Exercises Worth Trying – Picks from the practice-go challenge collection, each with a solution walkthrough. Alex Pliutau

🛠 Code & Tools

GoLand 2026.3: Coding Agents Move Into the Go IDE — JetBrains Air is a system for running existing terminal coding agents (like Claude or Codex) within IDEs, and it's now included in JetBrains' Go IDE. A redesigned Home window and Git worktree improvements round out the release.

Artem Pronichev (JetBrains)

go-yaml v4: The First Stable Release Under the YAML Org — The archived gopkg.in/yaml.v3 now has a stable successor, adding Load and Dump functions that take options, a plugin system, and a debugging CLI. Dump's formatting defaults differ from Marshal's, and v2 and v3 now get security fixes only.

The YAML Organization

🔎 Betterleaks: A Secrets Scanner from the Creator of Gitleaks — The creator of Gitleaks no longer controls that project, so this is its successor, written in Go. It scans Git history, GitHub/GitLab orgs, S3 and container images, and can check whether found keys are still active.

Zach Rice et al.

Fanout: A Single-Binary OpenTelemetry Backend in Go — From the creator of Echo: OTLP in, Parquet on disk, DuckDB for queries, all in one Go binary. It's alpha, but could be an appealing alternative to a full observability stack for smaller setups. GitHub repo.

Vishal Rana

📰 Classifieds

Billion-row analytics with plain database/sql: TimescaleDB extends Postgres, so your Go code doesn’t change. Get $1000 credit.

WarpBuild provides optimized hardware and fast Golang caches for CI. At half the cost. Get $50 in free credits with code START50.

🔒 pgx 5.12 – The Postgres driver fixes a SQL injection in simple-protocol batches and a require_auth bypass. It also adds batched transaction startup, client certificate policy controls, and per-query batch timing.
Wails 3.1 – An update after last week's big 3.0 release with fixes, performance improvements, and experimental cgo-free macOS and Linux backends.
🤖 ADK for Go 2.7 – Google's agent toolkit adds Claude as a first-party (experimental) model option and experimental classifiers for workflow routing.
Excelize 2.11.1 – The spreadsheet reading/writing library tackles 16 CVEs, mostly crashes and runaway allocations on malicious input, and now requires Go 1.26+.
Ginkgo 2.34 – The BDD-style test framework adds DeferOnFailure for capturing state before teardown destroys it.