What were the notable Go updates?

gopls/internal/cmd: remove gopls -port=int debugging flag, encoding/json/v2: support `format` tag option behind goexperiment, and gopls/internal/settings: add embedlit analyzer.

@golang

Go and the standard library - backend infrastructure at scale

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

GOPLS PATCHES CRITICAL NETWORK BINDING VULNERABILITY; JSON FORMAT ENTERS EXPERIMENTAL PHASE

By RepoJournal · Filed 06:01 UTC on May 6, 2026 · About Go

gopls just closed a security gap that could have exposed your debug server to the network, while the standard library gates the new JSON format tag behind an experiment flag.

gopls removed its -port debugging flag [1], which could implicitly bind to INADDR_ANY and expose the language server to network traffic—a vulnerability now explicitly rejected. The flag is deprecated in favor of explicit host binding (localhost recommended) via -listen=address. Meanwhile, encoding/json/v2 now gates the format tag option behind GOEXPERIMENT=jsonformat [2], a breaking change that requires opt-in to use custom field formatting. On the tooling front, gopls gained embedlit modernizer analysis [3] and published six modernizers for public use [4], while the modernize analysis suite expands to catch more outdated patterns. The HTTP/2 implementation in golang/net now wraps the stdlib version when building with Go 1.27+ [5], shifting the source of truth entirely into the standard library. pkg.go.dev's CLI got a usability overhaul with automatic pagination [6] and environment-aware platform detection [7]. A race condition in QUIC's streamForFrame was fixed [8], and golang/geo patched two integer overflow bugs in polyline decoding [9].

Action items

→ Upgrade gopls immediately if running debug servers exposed to networks golang/tools [immediate]
→ Review code using encoding/json custom formats; add GOEXPERIMENT=jsonformat if needed golang/go [plan]
→ Test HTTP/2 client/server behavior if upgrading to Go 1.27 golang/net [plan]
→ Monitor pkg.go.dev CLI adoption; pagination now automatic golang/pkgsite [monitor]

References

[1] gopls/internal/cmd: remove gopls -port=int debugging flag golang/tools
[2] encoding/json/v2: support `format` tag option behind goexperiment golang/go
[3] gopls/internal/settings: add embedlit analyzer golang/tools
[4] go/analysis/passes/modernize: publish modernizers golang/tools
[5] http2: enable net/http wrapping when go >= 1.27 golang/net
[6] cmd/internal/pkgsite-cli: implement auto-pagination golang/pkgsite
[7] cmd/internal/pkgsite-cli: remove -goos and -goarch flags and use go env golang/pkgsite
[8] quic: fix data race in streamForFrame golang/net
[9] add FuzzDecodePolyline. Fix 2 overflow bugs revealed by the test. (#270) golang/geo

Quick answers

What shipped in Go on May 6, 2026?: gopls just closed a security gap that could have exposed your debug server to the network, while the standard library gates the new JSON format tag behind an experiment flag. In total, 21 commits and 1 pull requests landed.
What were the notable Go updates?: gopls/internal/cmd: remove gopls -port=int debugging flag, encoding/json/v2: support `format` tag option behind goexperiment, and gopls/internal/settings: add embedlit analyzer.

PRINTF ANALYZER GETS SMARTER, PLAYGROUND NEEDS GO 1.26

The printf linter stops falsely flagging intentional double newlines, while gotip now requires Go 1.26 to bootstrap.

go 13 shipped 1-min read

@golang 1 day ago

GO REWORKS HTTP/3 REGISTRATION, KILLS GLOBAL STATE IN MODULE LOADER

Damien Neil's paired changes to net/http and x/net/http3 fundamentally reshape how HTTP/3 integrates with the standard library, while Michael Matloob strips out state manipulation functions that no longer belong anywhere.

go 28 shipped 1-min read

@golang 2 days ago

GOPLS FIXES COMMENT HANDLING IN COMPOSITE LITERALS, VULNDB ADDS 46 SECURITY REPORTS

A critical gopls bug that corrupted code when comments appeared in composite literals is fixed, while the vulnerability database absorbs a major batch of 46 new security reports across the ecosystem.

go 21 shipped 2-min read

@golang 3 days ago

COMPILER SHRINKS CODE SIZE WHILE QUIC FIXES BUSY-LOOP HANGS

The Go compiler now frees unused registers at loop headers, cutting generated code size across all architectures, while the net package fixes a critical QUIC keep-alive deadlock that was burning CPU on blocked connections.

go 25 shipped 1-min read

Elsewhere on the wire

AI Agents about 10 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 10 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.