Radar · Go · Archive · Week 10 · Mar 2 – 8, 2026
go1.26.1 security release
Worth knowingstdlib
- What changed
- Security fixes to the crypto/x509, html/template, net/url, and os packages, plus bug fixes to the go command, the go fix command, the compiler, and the os and reflect packages.
- Production impact
- The source does not say.
- Try it
- Upgrade to go1.26.1 and run
go test ./...to confirm no regressions. - Source
- go.dev/doc/devel/release#go1.26.1
Understand it, then run it
Go 1.26.1 is a security patch release. It fixes vulnerabilities in the crypto/x509, html/template, net/url, and os packages. The release also corrects bugs in the go command, the go fix command, the compiler, and the os and reflect packages. No new language features or APIs were added.
Run it now
// This program demonstrates that html/template renders a string safely.
// The security fixes in Go 1.26.1 are already in effect in Go 1.27.1.
package main
import (
"html/template"
"os"
)
func main() {
// A simple template that includes user data.
tmpl, err := template.New("demo").Parse(`Hello, {{.Name}}!`)
if err != nil {
panic(err)
}
// Render the template with a sample data structure.
if err := tmpl.Execute(os.Stdout, map[string]string{"Name": "Alice"}); err != nil {
panic(err)
}
}
What it printed when we ran it on Go 1.27.1
Hello, Alice!
Run sends this program (for Solidity, the contract and its tests) to our own sandbox, where it is compiled and run once, with no network, and what it printed or the test report comes back here. Nothing is kept. Runs are counted per visitor for the day so everyone gets a turn; the details are on the legal page.
Written by gpt-oss-20b from the linked source · claims checked against the sources · archive, not individually reviewed