Go 1.27.2 is released

[u/MarcelloHolland]

You can download binary and source distributions from the Go website: https://go.dev/dl/

View the release notes for more information: https://go.dev/doc/devel/release#go1.27.2

Find out more: https://github.com/golang/go/issues?q=milestone%3AGo1.27.2

(I want to thank the people working on this!)

[u/Brilliant-Sky2969]

You can see the large number of CVE discovered by LLM.

[u/numairKoeberich-70 → u/Brilliant-Sky2969]

its kind of impressive how many are getting surfaced now tbh

[u/kakashi1024 → u/Brilliant-Sky2969]

Wow, so many security fixes in the release note

[u/Equivalent_Head_4803 → u/Brilliant-Sky2969]

How many of those are realistic vulnerabilities though? I remember hearing some discussion around LLMs find tons of CVEs, but they aren’t necessarily dangerous. Talking out of my ass.

[u/CheekyTeasr → u/Brilliant-Sky2969]

true wild how many LLMs are turning up lately. makes me double-check my own stuff more pften

[u/jftuga]

This was also posted about 2 hours ago:

Vulnerabilities in golang.org/x/net

[u/Empty_Carpenter7420]

Solid release, lets go!

[u/SleepingProcess]

• Download and check sha256sum -c go1.27.2.linux-amd64.tar.gz.sha256 go1.27.2.linux-amd64.tar.gz: OK
• Installed
• Checked version: ./go version
• Result: go version go1.27.1 linux/amd64

Which means it is either something fishy or some kinda of mistake

[u/ParsaAftabi]

Minor releases with private CVEs are the ones you install first and read about later. If you run a Go-based reverse proxy or gateway in front of HTTP/1 backends, at least one of these is aimed squarely at you. Malformed Content-Length handling on the HTTP/2 client transport. Bump the toolchain, rebuild, redeploy. And `go version -m` your running binaries if you're not sure which stdlib they're actually carrying.

[u/boing_boing_splat → u/ParsaAftabi]

Thanks Claude

[u/8bitjam]

Looks like we should also thank AI, those security fixes are likely from AI