Go 1.27: generic methods, encoding/json v2 and post-quantum signatures

Go 1.27 came out on August 19, 2026, and it’s one of those releases that touches things the community has been asking for for years. Generic methods have finally arrived, encoding/json got a new implementation underneath, and the standard library stepped firmly into post-quantum cryptography. I read the Go blog announcement and the release notes, and here I pull out what matters most day to day.

Generic methods

Ever since generics arrived in the language, one limitation was annoying: methods couldn’t declare their own type parameters. In Go 1.27, they can. The example in the notes is math/rand/v2, which now has a generic N method on *Rand, previously available only as a generic function:

func (*Rand) N[Int intType](Int) Int

The important restriction: interface methods still cannot declare type parameters, and interface methods cannot be implemented by generic methods. In other words, you can write more natural APIs on concrete types, but you can’t abstract that behind an interface. It’s a conservative choice, very much in Go’s style.

The blog also mentions two smaller language improvements: keys in struct literals can now be any valid field selector, which lets you initialize fields of embedded structs directly, and generic functions can be used without explicit type arguments in composite literals, conversions and channel sends.

encoding/json v2

Two new packages arrived: encoding/json/v2, for high-level JSON processing with configurable options, and encoding/json/jsontext, for lower-level processing with Encoder, Decoder, Token and Value. v2 is stricter by default: it rejects invalid UTF-8 in strings and duplicate names within an object.

The detail that affects everyone: the original encoding/json is now implemented on top of v2. According to the notes, marshal performance is at parity and unmarshal is significantly faster, while keeping compatibility. If something breaks, you can go back to the old implementation at build time:

GOEXPERIMENT=nojsonv2 go build

The notes warn that this option is expected to be removed in a future release, so it’s for buying time, not a permanent fix.

Cryptography, uuid and SIMD

The crypto/mldsa package implements the ML-DSA post-quantum signature scheme, specified in FIPS 204. It’s integrated into crypto/x509, which now supports ML-DSA keys and signatures, and into crypto/tls, with new MLDSA44, MLDSA65 and MLDSA87 values for TLS 1.3. For anyone who needs to prepare for post-quantum cryptography requirements, having this in the standard library is a relief.

There’s also a new uuid package, which generates and parses UUIDs, and should remove one of the most common dependencies in Go projects. For performance enthusiasts, there’s experimental SIMD support with the simd and simd/archsimd packages, enabled with GOEXPERIMENT=simd.

Runtime and tooling

The compiler now generates size-specialized allocation calls, cutting the cost of some small allocations, under 80 bytes, by up to 30%. The notes are honest about the real effect: around a 1% improvement in allocation-heavy programs, with binaries about 60 KB larger.

The goroutineleak profile, experimental in Go 1.26, is now generally available in runtime/pprof and at the /debug/pprof/goroutineleak endpoint, for detecting permanently blocked goroutines. The asynctimerchan GODEBUG setting was removed, and channels created by the time package are now always unbuffered.

On the tooling side, go fix gained the atomictypes, embedlit, slicesbackward and unsafefuncs modernizers, and go mod tidy now consolidates require blocks into at most two, one for direct dependencies and one for indirect ones. bytes.CutLast and strings.CutLast also arrived, the unicode package was updated to Unicode 17, and Go now requires macOS 13 Ventura or later.

My take

Generic methods are the headline, but I think the biggest short-term impact comes from JSON. Every Go program that unmarshals JSON will run on a new implementation without changing a line, which is great when it works and scary when it doesn’t. I’d run the test suite with special attention to payloads with odd UTF-8 or duplicate keys before shipping to production.

The rest follows Go tradition: concrete improvements, modest and honest performance numbers, and little magic. The uuid package and ML-DSA in the standard library are the kind of thing that doesn’t make headlines but reduces dependencies and risk in real projects.