The Wire · Showcase
GOPLS PATCHES CRITICAL NETWORK BINDING VULNERABILITY; JSON FORMAT ENTERS EXPERIMENTAL PHASE
By RepoJournal · Filed · About Go
gopls just closed a security gap that could have exposed your debug server to the network, while the standard library gates the new JSON format tag behind an experiment flag.
gopls removed its -port debugging flag [1], which could implicitly bind to INADDR_ANY and expose the language server to network traffic—a vulnerability now explicitly rejected. The flag is deprecated in favor of explicit host binding (localhost recommended) via -listen=address. Meanwhile, encoding/json/v2 now gates the format tag option behind GOEXPERIMENT=jsonformat [2], a breaking change that requires opt-in to use custom field formatting. On the tooling front, gopls gained embedlit modernizer analysis [3] and published six modernizers for public use [4], while the modernize analysis suite expands to catch more outdated patterns. The HTTP/2 implementation in golang/net now wraps the stdlib version when building with Go 1.27+ [5], shifting the source of truth entirely into the standard library. pkg.go.dev's CLI got a usability overhaul with automatic pagination [6] and environment-aware platform detection [7]. A race condition in QUIC's streamForFrame was fixed [8], and golang/geo patched two integer overflow bugs in polyline decoding [9].
Action items
- → Upgrade gopls immediately if running debug servers exposed to networks golang/tools [immediate]
- → Review code using encoding/json custom formats; add GOEXPERIMENT=jsonformat if needed golang/go [plan]
- → Test HTTP/2 client/server behavior if upgrading to Go 1.27 golang/net [plan]
- → Monitor pkg.go.dev CLI adoption; pagination now automatic golang/pkgsite [monitor]
References
- [1] gopls/internal/cmd: remove gopls -port=int debugging flag golang/tools
- [2] encoding/json/v2: support `format` tag option behind goexperiment golang/go
- [3] gopls/internal/settings: add embedlit analyzer golang/tools
- [4] go/analysis/passes/modernize: publish modernizers golang/tools
- [5] http2: enable net/http wrapping when go >= 1.27 golang/net
- [6] cmd/internal/pkgsite-cli: implement auto-pagination golang/pkgsite
- [7] cmd/internal/pkgsite-cli: remove -goos and -goarch flags and use go env golang/pkgsite
- [8] quic: fix data race in streamForFrame golang/net
- [9] add FuzzDecodePolyline. Fix 2 overflow bugs revealed by the test. (#270) golang/geo
FAQ
- What changed in Go on May 6, 2026?
- gopls just closed a security gap that could have exposed your debug server to the network, while the standard library gates the new JSON format tag behind an experiment flag.
- What should Go teams do about it?
- Upgrade gopls immediately if running debug servers exposed to networks • Review code using encoding/json custom formats; add GOEXPERIMENT=jsonformat if needed • Test HTTP/2 client/server behavior if upgrading to Go 1.27
- Which Go repositories shipped on May 6, 2026?
- golang/tools, golang/go, golang/net, golang/pkgsite, golang/geo