Starting with Go 1.27, the go command now recognizes a GODEBUG setting for which support was removed (such as asynctimerchan, see below) if it appears in go.mod files (godebug entries) and .go source files (//go:debug comments). It accepts these settings if they are set to the final default value established before the setting was removed. If they are set to an old value, the go command will fail. This change is in the spirit of the Go 1 compatibility guarantee and allows existing programs that set supported GODEBUG settings to continue to build and run without changes even when the respective setting support has been removed.

go test now invokes the stdversion vet check by default. This reports the use of standard library symbols that are too new for the Go version in force in the referring file, as determined by go directive in go.mod and build tags on the file.

For modules specifying go 1.27 or later in their go.mod file, go mod tidy now automatically merges duplicate require blocks. This ensures the file maintains a clean, standard structure containing at most two require blocks: one for direct dependencies and one for indirect dependencies.

Existing comment blocks attached to dependencies are preserved during this consolidation. If a comment block is associated with a mixed set of directives (containing both direct and indirect dependencies), the comment block is merged and attached to the new direct dependency block.

Previously, if a go.mod file accumulated multiple disjoint require blocks (often due to manual edits, unresolved Git merge conflicts, or legacy upgrades) go mod tidy would leave the extra blocks intact or inadvertently create new ones. The tool now strictly enforces the two-block layout, consolidating disparate requirements into their respective blocks and cleaning up the structure of the module file automatically.

go tool trace's -http command-line option now restricts the listen address to localhost when passed only a port (e.g., -http=:6060). This change makes go tool trace consistent with the behavior of go tool pprof's -http flag. To listen on all addresses, explicitly include the specified address (e.g., -http=0.0.0.0:6060).

Tracebacks for modules with go directives configuring Go 1.27 or later will now include runtime/pprof goroutine labels in the header line. This behavior can be disabled with tracebacklabels=0 GODEBUG setting (added in Go 1.26). This opt-out is expected to be kept indefinitely in case goroutine labels acquire sensitive information that shouldn't be made available in tracebacks.

The compiler now resolves a relative filename in a //line or /*line*/ directive against the directory of the file containing the directive, matching the behavior of go/scanner. Absolute filenames are unaffected. See #70478.

The compiler now generates simpler names for function literals (closures). Previously, when the containing function is inlined, the function literal's name can get quite long. Now the compiler chooses the same name for the function literal regardless of inlining. It may also combine multiple instances of the same function literal (as its containing function is inlined) to share the same code in the compiled binary. This change does not affect the functionality of Go code. Tests that check symbol names may need update, although it is recommended to not depend on the names of function literals. For programs that incorrectly compare function code pointer for equality, the issue may be more exposed with Go 1.27, as function literals with different captured closure data may have equal code pointers in more cases.

Two new packages are now available:

The encoding/json/v2 package is a major revision of encoding/json. It provides Marshal, MarshalWrite, MarshalEncode, Unmarshal, UnmarshalRead, and UnmarshalDecode, all of which accept variadic Options arguments to configure marshaling and unmarshaling behavior.

• The encoding/json/jsontext package provides lower-level syntactic processing of JSON. The Encoder and Decoder types operate on JSON as a sequence of Token and Value, maintaining a state machine to ensure the produced or consumed sequence is valid JSON text.

The v2 package chooses stricter, more interoperable defaults than v1: it rejects invalid UTF-8 in JSON strings and rejects duplicate names within a JSON object. See the v1 encoding/json package documentation for the complete set of behavioral differences and the options available to adjust them.

The encoding/json package is now backed by the v2 implementation. Marshaling and unmarshaling behavior is preserved, but the exact text of error messages may differ. The package also gains a number of new Options that can configure v2 to operate with v1 semantics to avoid requiring a full migration to the new API. The v1 API will continue to be supported and users are not required to migrate.

Marshal performance is broadly at parity with the previous implementation, while unmarshal performance is significantly faster.

Users who encounter compatibility problems with the new implementation may disable it by setting GOEXPERIMENT=nojsonv2 at build time, restoring the original v1 implementation. This opt-out is expected to be removed in a future release.

See the proposal issue for background and additional detail. If you need to disable the new implementation, please file an issue.

Compression speed is improved in Go 1.27. The exact encoded output from Writer may be different from Go 1.26 as a result of the encoder implementation change. Since DEFLATE is the underlying compression used in archive/zip, compress/gzip, compress/zlib, and image/png, the outputs from those packages may also have changed.

PrivateKey.Sign now checks that the length of the hash is correct, if a non-nil SignerOpts is provided.

Post-quantum hybrid key exchanges can now be explicitly enabled in Config.CurvePreferences even if the tlsmlkem=0 or tlssecpmlkem=0 GODEBUG options are used. Those options were always meant to only apply to the default set used when Config.CurvePreferences is nil.

When parsing into pkix.Name fields, a wider range of pkix.AttributeTypeAndValue.Value types is now supported, and unknown types are parsed into asn1.RawValue.

SystemCertPool now respects SSL_CERT_FILE and SSL_CERT_DIR on Windows and Darwin. When these environment variables are set, roots are loaded from disk and instead of using the platform certificate verification APIs, the native Go verifier is used. This behavior can be disabled with GODEBUG=x509sslcertoverrideplatform=0.

RDNSequence.String (and therefore Name.String) now renders string-typed attribute values as strings even when the attribute's OID is unrecognized. Previously such values were always hex-encoded in their DER form. See #33093.

UnixConn read methods now return io.EOF directly instead of wrapping it in net.OpError when the underlying read returns EOF.

HTTP/2 server now accepts client priority signals, as defined in RFC 9218, allowing it to prioritize serving HTTP/2 streams with higher priority. If the old behavior is preferred, where streams are served in a round-robin manner regardless of priority, Server.DisableClientPriority can be set to true.

HTTP/1 Response.Body now automatically drains any unread content upon being closed, up to a conservative limit, to allow better connection reuse. For most programs, this change should be a no-op, or result in a performance improvement. In rare cases, programs that do not benefit from connection reuse might experience performance degradation if they had been improperly allowing an excessive amount of idle connections to linger; usually by setting Transport.MaxIdleConns to 0 or using different Clients for different requests, thereby bypassing Transport.MaxIdleConns limit. In these cases, setting Transport.DisableKeepAlives to true will disable connection reuse. However, such performance degradation usually indicates improper configuration or usage of Transport or Client in the first place, and a deeper look would likely be beneficial.

The new Server.MaxHeaderValueCount field allows HTTP servers to control the number of header values that they are willing to accept. If unset, DefaultMaxHeaderValueCount is used.

The unicode package and associated support throughout the system have been upgraded from Unicode 15 to Unicode 17. See the Unicode 16.0.0 and Unicode 17.0.0 release notes for information about the changes.

On the big-endian 64-bit PowerPC port on Linux (GOOS=linux GOARCH=ppc64), the Go toolchain now generates binaries that use the ELFv2 system ABI. ELFv2 support requires Linux kernel 3.13 or later. RHEL7 backported this support to its 3.10 kernel.

Cgo, position-independent executables (PIE), and external linking are now supported. Using these features requires an ELFv2 compatible runtime (libc and all linked and loaded libraries).

For programs that do not use cgo, the Go toolchain still generates static binaries with internal linking by default. For programs that have cgo options, if a static, pure-Go binary is needed, one can set the environment variable CGO_ENABLED=0 when running go build.