This roundup covers a Google blog post arguing Go is well-suited for AI-assisted coding (and the pushback it received on Hacker News and Reddit), plus a batch of Go ecosystem news: Go 1.27 Release Candidate 3 is out with the final release expected soon; Go 1.26.6 and 1.25.13 shipped with ten security fixes, including two addressing malicious GOPROXY/GOSUMDB checksum bypasses; and Fiber 3.5 released with speedups and middleware security hardening. Also featured: a profile-guided optimization experiment on encoding/json showing up to 4.7% throughput gains, a look at integrating llama.cpp into Go without CGo, GopherCon UK slides on proposed Go 1.28 set types, a TypeScript-to-Go CLI rewrite story from Appwrite, and a roundup of the newsletter's own highlights from earlier in the year.
Questions this post answers
What security vulnerabilities were fixed in Go 1.26.6 and Go 1.25.13?
Go 1.26.6 and Go 1.25.13 shipped together with ten security fixes. Two of the fixes address issues that let a malicious GOPROXY or GOSUMDB slip module content past the checksum database, allowing tampered dependencies to bypass verification. Developers relying on module proxies should update to these patched versions. Developers tracking Go security patches can follow release details like these on daily.dev.
When is Go 1.27 expected to be released?
Go 1.27 Release Candidate 3 has shipped, with the final release expected to follow within about a week, since final Go releases typically arrive roughly a week after the third release candidate. It will be announced on the official Go blog when it lands. Teams planning a Go 1.27 upgrade can track release timing news on daily.dev.
How much throughput improvement does profile-guided optimization give for Go's encoding/json package?
Enabling profile-guided optimization (PGO) on encoding/json parsing yielded up to 4.7% more throughput in a benchmark experiment. The test trained profiles on three different JSON documents and measured each resulting build against all three, checking how well a profile trained on one workload transfers to previously unseen workloads. Developers evaluating Go performance tuning options can find PGO benchmarks like this on daily.dev.