golang

Helm published patch releases 4.3.1 and 3.22.1 on October 15. Both bump golang.org/x/net; the 3.22.1 changelog cites five Go vulnerability IDs, and the 4.3.1 notes cite none.

A Go blog post says Go 1.27's net/http now drains unread HTTP/1 response bodies for up to 50 ms or 256 KB on close, so connections can be reused.

Go's October 8 point releases include security fixes to the go command, crypto/tls, html/template, net/http, net/textproto and os; Go's vulnerability database details four of the CVEs.

Go 1.27 reached general availability on August 19, 2026, finalizing generic methods and shipping encoding/json/v2, crypto/mldsa, and new go fix modernizers.

Go 1.27's second release candidate fixes an os.Root symlink escape and a crypto/tls Encrypted Client Hello privacy leak, alongside the language's first generic methods.

The Go team published a formal REST API for pkg.go.dev on May 21, giving tool authors and IDE integrations a stable, versioned interface to module metadata, documentation, symbols, and vulnerability data.

Go 1.26 ships with the Green Tea garbage collector enabled by default, replacing the object-centric mark-sweep algorithm with a page-level scanner that reduces GC CPU costs by 10 to 40 percent in real-world workloads.