Golang Weekly

The Go team explains Go's new JSON API

Fri, 6 Nov 2026 00:00:00 +0000

#623 — November 6, 2026

Go Weekly

The Official Guide to encoding/json/v2 (and Migrating to It) — Now that encoding/json/v2 and jsontext are stable, the Go team has a refreshed introduction to how they work, including how v1 and v2 interoperate. There's also a new migration guide which shows off jsonsplit for running v1 and v2 side by side in production and logging any differences.

Pratt, Tsai, Martí et al. (Go Team)

💡 Lleg put v2 to the test and found nine default behavior changes, 10% faster unmarshaling on plain structs, and big perf gains for deeply recursive custom decoders.

What Happens to Your go func() When the Pod Restarts? — Whatever it was doing is gone: you lose the email being sent or the webhook call. Go Event-Driven, the hands-on training from Watermill's authors, starts with goroutines and ends with Go services where data survives a restart. Don’t miss the last cohort this year that opens November 11.

Three Dots Labs sponsor

How //go:embed Works: From Source Files to Binary — A guided tour of how an embedded file travels through the toolchain, with links to the Go source for each step. Along the way, we learn why import _ "embed" is needed, even when you never reference the package.

Ainsley Clark

IN BRIEF:

The draft Go 1.28 release notes now list two new go vet checks for unchecked bufio.Scanner and sql.Rows errors, a FlagSet.All iterator, url.MustParse and Landlock support for subprocesses. The release is targeted for February 2027.
🔐 Go 1.27.4 and 1.26.11 are due on November 10 with security fixes to the standard library and toolchain covering twelve CVEs (a lot for a minor release).
React framework Next.js has added (in its 'canary' build) experimental route.go handlers where you can write plain net/http-style GET/POST funcs in a route.go file and Next.js will serve them as routes.
Following last month's accepted experiment for building cgo code without a C toolchain, a CL in review reimplements runtime/cgo in Go and assembly on every remaining OS and removes the C code entirely.

PROPOSAL UPDATES:

maps.Grow has been accepted and may make it into Go 1.28. Redowan Delowar explains why it's useful.
unicode/ascii, a package of ASCII-only string functions generic over strings and byte slices, has been proposed, with naming as a sticking point.
runtime/bubble, from two Temporal engineers, would build on testing/synctest's bubbles to let a host program run goroutines, channels and select deterministically.
math/decimal, an arbitrary-precision decimal type with explicit rounding modes, has been proposed with an implementation already attached.

Go's Generic Collections Proposal Has Been Accepted — We covered the initial plan in July but now the umbrella proposal is accepted, along with set.Set and hash-based Map and Set types. They'll land in golang.org/x/exp/collection first.

The Go Team

Go's GC Can Hit a Wall on 192 Cores — I doubt many of us work with such mammoth systems, but on 192-core amd64 hosts, heap-triggered GC cycles can take 3-4x longer as idle cores pile onto a shared lock-free stack. arm64 already has mitigations for this, and fixes are in review.

Nate Watson et al.

Is Your Go Service Ready for AI Agents? Run the Free POKE Audit — A free agent skill that audits your Go service and gives the smallest steps to add an event log, SSE, and webhooks.

Svix sponsor

📄 The MustCreate Pattern for Go Tests – How a generic MustCreate(t, NewUsername, "joe123") can replace a pile of per-type test helpers. Michael Lynch

📄 The Heap Profile Named a Function I Didn't Write – alloc_space measures churn, inuse_space what's still live, which can point to different allocation hotspots. Nolan Keir

📄 Sandboxing Subprocesses with Landlock in Go 1.28 – How Go 1.28 will make it easier to restrict subprocesses on Linux. Mohammad Abdolirad

📄 Five Go Exercises Worth Trying – Picks from the practice-go challenge collection, each with a solution walkthrough. Alex Pliutau

🛠 Code & Tools

GoLand 2026.3: Coding Agents Move Into the Go IDE — JetBrains Air is a system for running existing terminal coding agents (like Claude or Codex) within IDEs, and it's now included in JetBrains' Go IDE. A redesigned Home window and Git worktree improvements round out the release.

Artem Pronichev (JetBrains)

go-yaml v4: The First Stable Release Under the YAML Org — The archived gopkg.in/yaml.v3 now has a stable successor, adding Load and Dump functions that take options, a plugin system, and a debugging CLI. Dump's formatting defaults differ from Marshal's, and v2 and v3 now get security fixes only.

The YAML Organization

🔎 Betterleaks: A Secrets Scanner from the Creator of Gitleaks — The creator of Gitleaks no longer controls that project, so this is its successor, written in Go. It scans Git history, GitHub/GitLab orgs, S3 and container images, and can check whether found keys are still active.

Zach Rice et al.

Fanout: A Single-Binary OpenTelemetry Backend in Go — From the creator of Echo: OTLP in, Parquet on disk, DuckDB for queries, all in one Go binary. It's alpha, but could be an appealing alternative to a full observability stack for smaller setups. GitHub repo.

Vishal Rana

📰 Classifieds

Billion-row analytics with plain database/sql: TimescaleDB extends Postgres, so your Go code doesn’t change. Get $1000 credit.

WarpBuild provides optimized hardware and fast Golang caches for CI. At half the cost. Get $50 in free credits with code START50.

🔒 pgx 5.12 – The Postgres driver fixes a SQL injection in simple-protocol batches and a require_auth bypass. It also adds batched transaction startup, client certificate policy controls, and per-query batch timing.
Wails 3.1 – An update after last week's big 3.0 release with fixes, performance improvements, and experimental cgo-free macOS and Linux backends.
🤖 ADK for Go 2.7 – Google's agent toolkit adds Claude as a first-party (experimental) model option and experimental classifiers for workflow routing.
Excelize 2.11.1 – The spreadsheet reading/writing library tackles 16 CVEs, mostly crashes and runaway allocations on malicious input, and now requires Go 1.26+.
Ginkgo 2.34 – The BDD-style test framework adds DeferOnFailure for capturing state before teardown destroys it.

Wails 3 arrives after nearly four years

Fri, 30 Oct 2026 00:00:00 +0000

#622 — October 30, 2026

Read the Web Version

Go Weekly

Wails 3.0: Build Desktop Apps with Go and Native Web Views — Nearly four years after its alpha, Wails 3 lets you build desktop apps with a Go backend and web frontend, rendered in a native WebView. 3.0 adds multiple windows, system tray support, an in-app updater, and generated JavaScript and TypeScript bindings for Go services. Mobile support remains experimental.

Lea Anthony

Stop Hand-Rolling Webhooks in Your Go Service — Your webhooks want one package, one call per event, and idiomatic Go with typed models. Svix handles retries, signing, delivery logs, and a portal for your customers, so you don’t build any of it. Clerk has run its webhooks on Svix for 3+ years.

Svix sponsor

How Go Shipped Its First URGENT Track Security Release — As featured last week, Go hardcoded a block on eMudhra's broken intermediate certs. Now the Go security team explains why the notes were vague, how the fix shipped hours after they were alerted, and its plan for revocation checking on Linux.

Roland Shoemaker (Go Team)

IN BRIEF:

🔒 golang.org/x/net v0.62.0 fixes two bugs in its html package: a quadratic slowdown on crafted input and a raw text rendering flaw.
Filippo Valsorda has proposed friendlier crypto/aead packages for symmetric encryption, plus crypto/cobblestone for messages too big to hold in memory.
𝕏 Emma Twersky, familiar to many from Angular's DevRel team, now leads Frameworks and Languages DevRel at Google, covering Go alongside Flutter and Dart.

🔒 Go on Linux and CVE-2026-98432: Patch Your Kernel — Go enables Multipath TCP by default for listeners in apps whose main module declares go 1.24 or later. Anthropic's remote root exploit for a new Linux kernel bug used such a listener, but the bug isn't MPTCP-specific. Update your kernel, as GODEBUG=multipathtcp=0 is only "a fragile mitigation".

Neal Patel (Go Security Team)

💡 An issue that proposes Go turn the default off is open, but the Go team says any change would be premature for now. The issue is ultimately with Linux, not Go.

Go Concurrency Distilled — A handy interactive refresher where Anton boils Go's numerous concurrency concepts and mechanisms down into a single page, covering everything from channels and select to context, synctest and the scheduler, with examples you can edit and run in place.

Anton Zhiyanov

📊 Measuring Go 1.28's HTTP/2 'Parking' Memory Savings — Thanks to a change by Brad Fitzpatrick, an idle HTTP/2 server connection in Go 1.28 can let its serve goroutine exit. With 5,000 idle connections, a dev build ran 5,000 fewer goroutines and used about 40% less RSS.

Mohammad Abdolirad

Proposal: Let go test Run Your Project's Own Analyzers — //go:analyze directives would add custom analyzers to go test, and libraries could ship checks that run on packages that import them, like vet checks Printf calls. It's still early but being actively discussed.

Alan Donovan (Go Team)

📺 Profiling Go with pprof: Flame Graphs and Memory Leaks – A quick, six minute primer that finds a CPU hog and leak in an app. Hüseyin Babal

📄 Partial Updates in Go with Field Masks – How to separate update intent from values in PATCH requests. Redowan Delowar

📄 Where Go 1.27's HTTP/1 Connection Reuse Stops Working Lleg

🛠 Code & Tools

gohawk: Static Analysis for Leaks and Lock Bugs — Finds leaked files, unjoined goroutines, unreaped processes and lock inversions, using Infer-style function summaries to track ownership across packages. It's a young project, but has already led to merged fixes in Moby and Caddy. (GitHub repo.)

James Ko

TinyGo 0.44: Smaller, Faster, Better — The Go compiler for microcontrollers and WebAssembly now does more init work at compile time for smaller binaries that start faster, drops needless slice bounds checks, and adds multicore goroutines on the ESP32-S3. Support for the Arduino Uno R4 also brings TinyGo's first Renesas CPU support.

The TinyGo Team

You Chose Go for Simplicity. Keep Your Data Stack Simple Too — TimescaleDB extends Postgres with compression and continuous aggregates. Your Go code doesn’t change. Get $1000 credit.

Tiger Data (creators of TimescaleDB) sponsor

noalloc: Keep Your Hot Paths Allocation-Free — Mark a function with //noalloc:root and this CLI checks its call tree for heap allocations, flagging offending lines. It's a days-old, AI-written experiment that borrows an idea from OxCaml's zero_alloc.

Phil Eaton (The Consensus)

🔒 Echo 5.4.4 – The popular web framework has had four patch releases in eight days, including a fix for a critical access control bypass in its proxy middleware's WebSocket handling.
go-json 0.12 – Fast encoding/json-compatible library. Adds a jsontext package and an early encoding/json/v2-style API.
cel-go 0.33 – Google's Common Expression Language for Go gets an opt-in parser that's 8-19x faster.
Huma 2.40 – Framework for building HTTP APIs with OpenAPI 3 specs.
mockery 3.9 – The popular mock generator for Go interfaces. (Docs.)

📢 Elsewhere in the ecosystem

✨ Richard Seroter, Google Cloud's Chief Evangelist and the exec with product and engineering responsibility for Go, 𝕏 says Go has just become the most-used language on Google Cloud by raw SDK API requests, with Java not far behind.
Before 'distributed SQLite' became a busy, venture-funded category, there was rqlite, built in Go in 2014. Its creator tells the story of the ecosystem's growth.
Lisette is a Rust-inspired language with algebraic data types, pattern matching and no nil that compiles to readable Go and can call Go packages directly.
⚠️ A reminder that the 2026 Go Developer Survey closes for submissions on November 3, so there are a few more days to have your say.

Why Go had to hardcode a block on broken certs

Fri, 23 Oct 2026 00:00:00 +0000

#621 — October 23, 2026

Read the Web Version

Go Weekly

Interactive Refactoring in gopls — LSP refactorings can't 'ask' you anything, so "Add struct tags" in gopls just guessed json and camelCase. gopls can now pop up dialogs to collect your input. It uses a stateless, form-like protocol extension the Go and Dart teams have proposed as an LSP standard.

Hongxiang Jiang (Go Team)

💡 For now it works in VS Code, with Neovim and Emacs support at proof-of-concept stage. A Move declaration refactoring is coming soon, with Change signature to follow.

Deploy Self-Healing Apps on Kubernetes — Learn Kubernetes by building a real production setup. Erik Reinert takes you from a local Kind cluster to Amazon EKS with health probes, autoscaling, safe rollbacks, and GitOps with Argo CD.

Master.dev sponsor

🚫 Go Hardcodes a Block on Broken eMudhra Certs — Eight intermediate CA certificates had trivially recoverable private keys, so Go 1.27.3 and 1.26.10 now refuse chains through them. It's hardcoded because, as Filippo Valsorda notes, Linux trust stores have no way to pass revocations on to apps.

The Go Team

IN BRIEF:

📺 The GopherCon Europe 2026 talks are now online, including ▶️ using Go to build for the Sega Dreamcast(!) and a ▶️ panel with the Go team.
🇮🇳 GopherCon India 2026 takes place in Hyderabad on November 22, with tickets now on sale.
Fiber has marked its v2 module as deprecated, so Go's tooling will now nudge v2 users toward Fiber v3.

GO 1.28 & PROPOSALS:

Go 1.28 will let you omit a composite literal's type when the context supplies it (so p = {1, 2} will work).
iter.Seq could gain Map and Filter methods now that Go has generic methods, with a new proposal's thread already debating where to stop. Fold? Keys? Map2?
net/http is getting Server.HandleRequest (accepted last week), while maps.Grow and an RSS-based memory profile for runtime/pprof are both likely accepts.

Better HTTP/1 Connection Reuse — You can now (mostly) stop draining HTTP/1 response bodies in Go 1.27 as the client now drains the leftovers in the background, within limits, making io.Copy(io.Discard, resp.Body) helpers largely redundant when you close the body.

Nicholas Husin and Damien Neil (Go Team)

💡 The release notes add a caveat the post skips: programs that let idle connections pile up (say, with MaxIdleConns set to 0 or a new Client per request) may get slower.

SIMD and Go: How the New Packages Work Under the Hood — A heavily illustrated tour of Go's experimental SIMD support, covering what vector instructions actually do, the operations offered by simd/archsimd and the new portable simd package, and how the compiler turns them into machine code.

Jesús Espino

One Less System to Operate. Everything in SQL — TimescaleDB extends Postgres so your metrics and app data share one database and one SQL join. Get $1000 credit.

Tiger Data (creators of TimescaleDB) sponsor

📄 Spinning is a Bounded Bet: Why Go Hides Its Spinlocks – Part one of a four-part series on spinning versus parking. Alex Rios

📄 ConcurrentML: Improving on Go's Concurrency Model – Makes the case for composable events as a fix for the limits of select. Nikhil Marathe

📄 Cutting a Go Git Server's RAM Usage by Two-Thirds – Using pprof to take a push from 617MB to 199MB. Xe Iaso (Tigris)

📄 Why a Healthy Go Heap Can Still Get OOM-Killed in Kubernetes Gulcan Topcu

📄 Dancing Backwards with Go: Why TDD Feels Weird John Arundel

🛠 Code & Tools

MyGo: Build Desktop Apps in Go with No Cgo Required — Build macOS, Windows and Linux apps with a UI drawn on the GPU from pure Go, or a web frontend in the system webview that calls Go via a generated TypeScript client. Apps can be just a few megabytes. GitHub repo.

EGOIST

TinyGo 0.43: Go for Microcontrollers and WebAssembly — The Go compiler 'for small places' closes more gaps with regular Go, adding testing/synctest, parallel tests, panic recovery on Wasm, and more. Much of the work comes from Jake Bailey of TypeScript's Go port fame.

The TinyGo Team

💡 For some TinyGo fun, Hoani Bryson's Trick Shot II won this year's Nokia 3310 Jam, built on his own Go engine that even runs on a Pico inside a real 3310.

coregex: A Faster Drop-In Replacement for regexp — Brings the multi-engine design of Rust's regex crate to Go, with lazy DFA, PikeVM, one-pass matching and SIMD prefilters. The author claims 15–240x speedups.

Andrey Kolkov

💡 The standard library may close some of that gap: a port of RE2's lazy DFA to regexp is up for review, with early benchmarks showing big performance improvements.

gopls 0.24 – The official Go language server moves to LSP 3.18 and adds hover, highlighting and references in Go assembly files (interactive refactoring is covered in the feature at the top of the issue).
GoReleaser 2.19 – The release automation tool graduates several experimental features and adds tunable zstd compression for archives.
fasthttp 1.76 – The fast HTTP package gets extra hardening against request smuggling and message-framing attacks.
decimal 1.6 – Arbitrary-precision fixed-point decimals, now with Sqrt, Root and BSON Decimal128.
chi 5.5 – Lightweight router, now with RFC 9745 deprecation middleware.

📰 Classifieds

Build your Golang app faster. WarpBuild runners are twice as fast at half the cost. Get $50 in free credits with code START50.

CodeAF, an open-source coding harness written in Go: #1 of ten on DeepSWE on the same model, at 2x to 25x less per fix than the others.

🪝 Send webhooks from your Go service in minutes. Svix handles retries, signing, delivery logs, and a portal for your customers.

⭐ And finally…

Help Set Go's Priorities with the 2026 Go Developer Survey — The Go team uses the results to decide what to work on. Last year, the top frustration was keeping Go code idiomatic and following best practices, which led to the rewritten go fix in Go 1.26 and more modernizers in 1.27.

Cameron Balahan (Go Team)

Hooking into the Go toolchain

Fri, 9 Oct 2026 00:00:00 +0000

#620 — October 9, 2026

Read the Web Version

ℹ️ We're back, but we're taking another break next week, so we'll see you again on Friday, October 23! :-)
__
Your editor, Peter Cooper

Go Weekly

The Data Race That Wasn't a Bug (and the One That Was) — Client.Do can return before net/http has finished reading your request body, so reusing the buffer can trigger a data race. A walk through the transport’s goroutines and why VictoriaMetrics kept one such race but fixed another.

Jesús Espino

Nail Your Complex Go Backend — Adding a feature shouldn't break three other things. Learn advanced backend patterns by building a food delivery platform, by hand or with your coding agent. Enrollment opens in two weeks. Join the waitlist so you don’t miss it!

Three Dots Labs sponsor

Hooking into the Go Toolchain — A deep tour of go build -toolexec for wrapping compiler and linker runs, starting with a simple timer and moving on to rewriting code mid-build, patching importcfg to add new imports, and more.

Kemal Akkoyun

IN BRIEF:

🔐 Go 1.27.2 and 1.26.9 have been released with 15 security fixes, mostly in net/http, plus a fix for a compiler bug that could corrupt values.
📊 Every Go release since 2013, benchmarked. The same benchmark programs took 11.5% less time on Go 1.27 than on 1.23, and ~41% less than on 1.2.
🔒 Google has paused bounties for product vulnerabilities in Go and its other open source projects after a flood of mostly invalid automated reports.
🇯🇵 GopherCon Japan 2027's CFP is open until October 25 if you fancy speaking at the (bilingual) event in Tokyo next February.

Hacking the Go Compiler to Efficiently Map IPv4 to IPv6 — A small IPv4-to-IPv6 conversion led Vincent through noder hacks, SSA rewrite rules, and compiler pass ordering to close a ~8x performance gap.

Vincent Bernat

Arch-Specific SIMD in Go — A follow-up to the Go team’s look at platform-independent SIMD in Go covering the experimental archsimd package, which now supports arm64 and wasm, plus tips for writing SIMD code that compiles well.

Junyang Shao and David Chase (Go Team)

Don't Couple Your Go Code to GitHub — Is putting github.com in import paths a problem? Iain thinks so, and makes the case for using your own domain instead, but it kicked off a lively debate on Hacker News.

Iain Cambridge

Ship Go Features, Not Data Pipelines — TimescaleDB extends Postgres so your Go service gets fast analytics without a second system. Get $1000 credit.

Tiger Data (creators of TimescaleDB) sponsor

📄 Poisoning a Go Build Cache – A hands-on look at how $GOCACHE works and why sharing it in CI can be risky. Lukas Schwab

📄 Go 1.27 Detects Goroutine Leaks: I Tested It on Mine – With three caught, but one notable miss. Jules Robineau

📄 Logs in Parallel Go Tests and Where to Find Them – Hint: Go 1.25’s t.Output() is your friend. Artur Dryomov

🛠 Code & Tools

Francis: Durable Actors, Jobs and Workflows for Go — Durable actors, cron jobs, background jobs with retries, rate limiting and saga-style workflows, embedded in your app and backed by SQLite or Postgres, with an optional standalone runtime for larger clusters.

Alessandro Segala

connect-go v2 Arrives with Simpler, gRPC-Go-Style Handlers — Buf's Go RPC library drops its generic request and response wrappers, splits HTTP out from the core, and no longer sends plain Go error messages to clients. There's a migration tool, and v1/v2 can coexist in one module.

Buf

fx 40: Interactive Terminal JSON Viewer and Processor — We've linked fx a few times over the years, but v40 is a huge release: write queries inside the viewer and watch results update as you type, plus XML, HTML, EDN and MAML input, and vim-style commands.

Anton Medvedev

gopls 0.24 Prerelease – Now with LSP 3.18 support, better Go assembly handling, and a new analyzer for inconsistent E/*E error use.
Echo 5.4 – The web framework fixes several security issues (some fixes change behavior). 4.16 gets them too.
🤖 GitHub MCP Server 2.0 – GitHub's official, Go-powered MCP server adds structured outputs for agents.
Rill 0.9 – Composable, channel-based concurrency toolkit, now with first-class context support. v1.0 is not far away.
gomponents 1.4 – Build HTML views as plain Go functions. Now with faster rendering and an official agent skill.

📰 Classifieds

POKE (Publish Once, Kickoff Everywhere) is a free agent skill that audits your Go code and helps you add events, SSE and Standard Webhooks.

🐘 Many Go backends end up talking to Postgres, so you may also like our other newsletter: Postgres Weekly.

📢 Elsewhere in the ecosystem

✨ GoNIX is a UNIX-like OS that boots a Linux kernel and hands off to a Go init, with coreutils, networking, and an SSH server, all written in Go too. After some teething problems, which I reported to its creator, the instructions to boot it on Apple silicon now work well (as above). A neat experiment!
From the same author, James Mills, also comes Parley, a "federated, decentralised chat that speaks plain IRC".
Neki, PlanetScale's new sharded Postgres offering, sits behind a Go-powered proxy, and this look at its design shows how it avoids decoding Postgres wire data it doesn't need to touch.
Mitchell Hashimoto has proposed OSC 7501, a terminal protocol that lets programs report their status to the terminal. Bubble Tea 2.1 (released this week) already supports it.
🕹️ Fancy some late '90s real-time strategy? Nanolathe reimplements Total Annihilation's engine in Go, and you can play a demo in your browser.