#go

Go 1.27 build failing on a removed GODEBUG setting in go.mod

Go 1.27 refuses to build with removed GODEBUG settings

Go 1.27 fails with 'removed GODEBUG set to old value'. We tested every removed setting on Go 1.26.9 and 1.27.2: where it fails, the fix, and one silent timer change.

Sat Oct 17 2026 · 10 min read · 0 views

Software

Go MCP server on localhost accepting a request with a foreign Host header before v1.4.0

Is your Go MCP server open to DNS rebinding? Check v1.4.0

CVE-2026-34742: Go MCP SDK before 1.4.0 accepts any Host header on localhost HTTP servers. We tested v1.3.1, v1.4.0 and v1.8.0, and show the fix and a proxy trap.

Sat Oct 17 2026 · 9 min read · 0 views

Go encoding/json v1 and v2 results for eleven LLM-style JSON payloads on Go 1.26.9 and 1.27.2

Does Go 1.27's json v2 break your LLM parsing? We tested

Go 1.27 runs encoding/json on the v2 engine. We tested 11 LLM-style payloads on Go 1.26.9 and 1.27.2: v1 behaved the same, v2 is stricter, Unmarshal is 2.3x faster.

Sat Oct 17 2026 · 10 min read · 0 views

Software

New TCP connections per 100 requests for unread HTTP response bodies on Go 1.26.9 and Go 1.27.2

Go 1.27 now drains HTTP bodies on Close: what we measured

Go 1.27 drains unread HTTP/1 response bodies on Close, up to 256 KiB or 50 ms. We measured connection reuse on Go 1.26.9 and 1.27.2 and found a hard cliff at 257 KiB.

Sat Oct 17 2026 · 9 min read · 0 views

Software