1---2title: "Go, Backwards Compatibility, and GODEBUG"3layout: article4---56<!--7This document is kept in the Go repo, not x/website,8because it documents the full list of known GODEBUG settings,9which are tied to a specific release.10-->1112## Introduction {#intro}1314Go's emphasis on backwards compatibility is one of its key strengths.15There are, however, times when we cannot maintain complete compatibility.16If code depends on buggy (including insecure) behavior,17then fixing the bug will break that code.18New features can also have similar impacts:19enabling the HTTP/2 use by the HTTP client broke programs20connecting to servers with buggy HTTP/2 implementations.21These kinds of changes are unavoidable and22[permitted by the Go 1 compatibility rules](/doc/go1compat).23Even so, Go provides a mechanism called GODEBUG to24reduce the impact such changes have on Go developers25using newer toolchains to compile old code.2627A GODEBUG setting is a `key=value` pair28that controls the execution of certain parts of a Go program.29The environment variable `GODEBUG`30can hold a comma-separated list of these settings.31For example, if a Go program is running in an environment that contains3233	GODEBUG=http2client=0,http2server=03435then that Go program will disable the use of HTTP/2 by default in both36the HTTP client and the HTTP server.37Unrecognized settings in the `GODEBUG` environment variable are ignored.38It is also possible to set the default `GODEBUG` for a given program39(discussed below).4041When preparing any change that is permitted by Go 1 compatibility42but may nonetheless break some existing programs,43we first engineer the change to keep as many existing programs working as possible.44For the remaining programs,45we define a new GODEBUG setting that46allows individual programs to opt back in to the old behavior.47A GODEBUG setting may not be added if doing so is infeasible,48but that should be extremely rare.4950GODEBUG settings added for compatibility will be maintained51for a minimum of two years (four Go releases).52Some, such as `http2client` and `http2server`,53will be maintained much longer, even indefinitely.5455When possible, each GODEBUG setting has an associated56[runtime/metrics](/pkg/runtime/metrics/) counter57named `/godebug/non-default-behavior/<name>:events`58that counts the number of times a particular program's59behavior has changed based on a non-default value60for that setting.61For example, when `GODEBUG=http2client=0` is set,62`/godebug/non-default-behavior/http2client:events`63counts the number of HTTP transports that the program64has configured without HTTP/2 support.6566## Default GODEBUG Values {#default}6768When a GODEBUG setting is not listed in the environment variable,69its value is derived from three sources:70the defaults for the Go toolchain used to build the program,71amended to match the Go version listed in `go.mod`,72and then overridden by explicit `//go:debug` lines in the program.7374The [GODEBUG History](#history) gives the exact defaults for each Go toolchain version.75For example, Go 1.21 introduces the `panicnil` setting,76controlling whether `panic(nil)` is allowed;77it defaults to `panicnil=0`, making `panic(nil)` a run-time error.78Using `panicnil=1` restores the behavior of Go 1.20 and earlier.7980When compiling a work module or workspace that declares81an older Go version, the Go toolchain amends its defaults82to match that older Go version as closely as possible.83For example, when a Go 1.21 toolchain compiles a program,84if the work module's `go.mod` or the workspace's `go.work`85says `go` `1.20`, then the program defaults to `panicnil=1`,86matching Go 1.20 instead of Go 1.21.8788As an exception, GODEBUGs introduced for security releases89will have the new behavior apply to all versions.9091Because this method of setting GODEBUG defaults was introduced only in Go 1.21,92programs listing versions of Go earlier than Go 1.20 are configured to match Go 1.20,93not the older version.9495To override these defaults, starting in Go 1.23, the work module's `go.mod`96or the workspace's `go.work` can list one or more `godebug` lines:9798	godebug (99		default=go1.21100		panicnil=1101		asynctimerchan=0102	)103104The special key `default` indicates a Go version to take unspecified105settings from. This allows setting the GODEBUG defaults separately106from the Go language version in the module.107In this example, the program is asking for Go 1.21 semantics and108then asking for the old pre-Go 1.21 `panic(nil)` behavior and the109new Go 1.23 `asynctimerchan=0` behavior.110111Only the work module's `go.mod` is consulted for `godebug` directives.112Any directives in required dependency modules are ignored.113It is an error to list a `godebug` with an unrecognized setting.114(Toolchains older than Go 1.23 reject all `godebug` lines, since they do not115understand `godebug` at all.) When a workspace is in use, `godebug`116directives in `go.mod` files are ignored, and `go.work` will be consulted117for `godebug` directives instead.118119The defaults from the `go` and `godebug` lines apply to all main120packages that are built. For more fine-grained control,121starting in Go 1.21, a main package's source files122can include one or more `//go:debug` directives at the top of the file123(preceding the `package` statement).124The `godebug` lines in the previous example would be written:125126	//go:debug default=go1.21127	//go:debug panicnil=1128	//go:debug asynctimerchan=0129130Starting in Go 1.21, the Go toolchain treats a `//go:debug` directive131with an unrecognized GODEBUG setting as an invalid program.132Programs with more than one `//go:debug` line for a given setting133are also treated as invalid.134(Older toolchains ignore `//go:debug` directives entirely.)135136The defaults that will be compiled into a main package137are reported by the command:138139	go list -f '{{.DefaultGODEBUG}}' my/main/package140141Only differences from the base Go toolchain defaults are reported.142143When testing a package, `//go:debug` lines in the `*_test.go`144files are treated as directives for the test's main package.145In any other context, `//go:debug` lines are ignored by the toolchain;146`go` `vet` reports such lines as misplaced.147148## GODEBUG History {#history}149150This section documents the GODEBUG settings introduced and removed in each major Go release151for compatibility reasons.152Packages or programs may define additional settings for internal debugging purposes;153for example,154see the [runtime documentation](/pkg/runtime#hdr-Environment_Variables)155and the [go command documentation](/cmd/go#hdr-Build_and_test_caching).156157### Go 1.28158159Go 1.28 changed160[`net/http.FileServer`](/pkg/net/http#FileServer),161[`net/http.FileServerFS`](/pkg/net/http#FileServerFS),162[`net/http.ServeContent`](/pkg/net/http#ServeContent),163[`net/http.ServeFile`](/pkg/net/http#ServeFile), and164[`net/http.ServeFileFS`](/pkg/net/http#ServeFileFS) to165limit the maximum number of ranges in a Range header.166When the number of ranges in a header exceeds the new167`httpservecontentmaxranges` setting, the header is ignored.168The default value is `httpservecontentmaxranges=200`.169Setting `httpservecontentmaxranges=0` disables the limit.170To avoid denial of service attacks, this setting and default171was backported to Go 1.27.2 and Go 1.26.9.172173Go 1.28 added a new `netmarshal` setting that controls whether174the text marshaling of the types `net.IPMask`, `net.IPNet`, and175`net.HardwareAddr` is readable. The value `netmarshal=0` will176JSON encode those types using an unreadable base64 encoding.177The value `netmarshal=1` will use a readable version such as the IP address.178For Go 1.28 and 1.29 the default value remains `netmarshal=0`.179This ensures that JSON or other marshaled data generated by those180versions will be readable by older versions of Go.181The expectation is that Go 1.30 will change the default to be netmarshal=1.182Go 1.28 and all future releases will support both the old and new183encodings when reading data. This setting may be removed in a future Go release,184Go 1.34 at the earliest.185186### Go 1.27187188Go 1.27 removed the `gotypesalias` setting, as noted in the [Go 1.22](#go-122) section.189190Go 1.27 removed the `tlsunsafeekm` setting, as noted in the [Go 1.22](#go-122) section.191192Go 1.27 removed the `tlsrsakex` setting, as noted in the [Go 1.22](#go-122) section.193194Go 1.27 removed the `tls3des` setting, as noted in the [Go 1.23](#go-123) section.195196Go 1.27 removed the `tls10server` setting, as noted in the [Go 1.22](#go-122) section.197198Go 1.27 removed the `x509keypairleaf` setting, as noted in the [Go 1.23](#go-123) section.199200Go 1.27 removed the `asynctimerchan` setting, as noted in the [Go 1.23](#go-123) section.201202Go 1.27 added a new `htmlmetacontenturlescape` setting that controls whether203html/template will escape URLs in the `url=` portion of the content attribute of204HTML meta tags. The default `htmlmetacontentescape=1` will cause URLs to be205escaped. Setting `htmlmetacontentescape=0` disables this behavior. To avoid206content injection attacks, this setting and default was backported to Go 1.25.8207and Go 1.26.1.208209Go 1.27 changes the default for `tracebacklabels` (added in [Go 1.26](#go-126))210to `1`. This opt-out is expected to be kept indefinitely in case goroutine211labels acquire sensitive information that shouldn't be made available in212tracebacks.213214Go 1.27 added a new `x509sslcertoverrideplatform` setting that controls whether215crypto/x509 will load roots from disk on Windows and Darwin when `SSL_CERT_FILE`216or `SSL_CERT_DIR` are set. The default value `x509sslcertoverrideplatform=1` will217cause roots to be loaded from disk when these environment variables are set.218Setting `x509sslcertoverrideplatform=0` disables this behavior in favor of using219the platform certificate store instead of honoring the environment variables. We220plan to remove this setting in Go 1.31.221222Go 1.27 added a `fips140ems` setting that when set to `0` disables the223enforcement of Extended Master Secret in FIPS 140-3 mode. There is no change in224default behavior. This setting was backported to Go 1.26.6 and Go 1.25.13.225We plan to remove this setting in Go 1.31.226227### Go 1.26228229Go 1.26 added a new `httpcookiemaxnum` setting that controls the maximum number230of cookies that net/http will accept when parsing HTTP headers. If the number of231cookies in a header exceeds the number set in `httpcookiemaxnum`, cookie parsing232will fail early. The default value is `httpcookiemaxnum=3000`. Setting233`httpcookiemaxnum=0` will allow the cookie parsing to accept an indefinite234number of cookies. To avoid denial of service attacks, this setting and default235was backported to Go 1.25.2 and Go 1.24.8.236237Go 1.26 added a new `urlmaxqueryparams` setting that controls the maximum number238of query parameters that net/url will accept when parsing a URL-encoded query string.239If the number of parameters exceeds the number set in `urlmaxqueryparams`,240parsing will fail early. The default value is `urlmaxqueryparams=10000`.241Setting `urlmaxqueryparams=0` disables the limit. To avoid denial of service242attacks, this setting and default was backported to Go 1.25.6 and Go 1.24.12.243244Go 1.26 added a new `urlstrictcolons` setting that controls whether `net/url.Parse`245allows malformed hostnames containing colons outside of a bracketed IPv6 address.246The default `urlstrictcolons=1` rejects URLs such as `http://localhost:1:2` or `http://::1/`.247Colons are permitted as part of a bracketed IPv6 address, such as `http://[::1]/`.248Go 1.27 limited this validation to `http` and `https` URLs, so the setting has no249effect on URLs with other schemes.250251Go 1.26 enabled two additional post-quantum key exchange mechanisms:252SecP256r1MLKEM768 and SecP384r1MLKEM1024. The default can be reverted using the253[`tlssecpmlkem` setting](/pkg/crypto/tls/#Config.CurvePreferences).254255Go 1.26 added a new `tracebacklabels` setting that controls the inclusion of256goroutine labels set through the `runtime/pprof` package. Setting `tracebacklabels=1`257includes these key/value pairs in the goroutine status header of runtime258tracebacks and debug=2 runtime/pprof stack dumps. This format may change in the future.259(see go.dev/issue/76349)260261Go 1.26 added a new `cryptocustomrand` setting that controls whether most crypto/...262APIs ignore the random `io.Reader` parameter. For Go 1.26, it defaults263to `cryptocustomrand=0`, ignoring the random parameters. Using `cryptocustomrand=1`264reverts to the pre-Go 1.26 behavior.265266### Go 1.25267268Go 1.25 added a new `decoratemappings` setting that controls whether the Go269runtime annotates OS anonymous memory mappings with context about their270purpose. These annotations appear in /proc/self/maps and /proc/self/smaps as271"[anon: Go: ...]". This setting is only used on Linux. For Go 1.25, it defaults272to `decoratemappings=1`, enabling annotations. Using `decoratemappings=0`273reverts to the pre-Go 1.25 behavior. This setting is fixed at program startup274time, and can't be modified by changing the `GODEBUG` environment variable275after the program starts.276277Go 1.25 added a new `embedfollowsymlinks` setting that controls whether the278Go command will follow symlinks to regular files embedding files.279The default value `embedfollowsymlinks=0` does not allow following280symlinks. `embedfollowsymlinks=1` will allow following symlinks.281282Go 1.25 added a new `containermaxprocs` setting that controls whether the Go283runtime will consider cgroup CPU limits when setting the default GOMAXPROCS.284The default value `containermaxprocs=1` will use cgroup limits in addition to285the total logical CPU count and CPU affinity. `containermaxprocs=0` will286disable consideration of cgroup limits. This setting only affects Linux.287288Go 1.25 added a new `updatemaxprocs` setting that controls whether the Go289runtime will periodically update GOMAXPROCS for new CPU affinity or cgroup290limits. The default value `updatemaxprocs=1` will enable periodic updates.291`updatemaxprocs=0` will disable periodic updates.292293Go 1.25 disabled SHA-1 signature algorithms in TLS 1.2 according to RFC 9155.294The default can be reverted using the `tlssha1=1` setting.295296Go 1.25 switched to SHA-256 to fill in missing SubjectKeyId in297crypto/x509.CreateCertificate. The setting `x509sha256skid=0` reverts to SHA-1.298299Go 1.25 corrected the semantics of contention reports for runtime-internal locks,300and so removed the [`runtimecontentionstacks` setting](/pkg/runtime#hdr-Environment_Variables).301302Go 1.25 (starting with Go 1.25 RC 2) disabled build information stamping when303multiple VCS are detected due to concerns around VCS injection attacks. This304behavior and setting was backported to Go 1.24.5 and Go 1.23.11. This behavior305can be renabled with the setting `allowmultiplevcs=1`.306307### Go 1.24308309Go 1.24 added a new `fips140` setting that controls whether the Go310Cryptographic Module operates in FIPS 140-3 mode.311The possible values are:312- "off": no special support for FIPS 140-3 mode. This is the default.313- "on": the Go Cryptographic Module operates in FIPS 140-3 mode.314- "only": like "on", but cryptographic algorithms not approved by315  FIPS 140-3 return an error or panic.316For more information, see [FIPS 140-3 Compliance](/doc/security/fips140).317This setting is fixed at program startup time, and can't be modified318by changing the `GODEBUG` environment variable after the program starts.319320Go 1.24 changed the global [`math/rand.Seed`](/pkg/math/rand/#Seed) to be a321no-op. This behavior is controlled by the `randseednop` setting.322For Go 1.24 it defaults to `randseednop=1`.323Using `randseednop=0` reverts to the pre-Go 1.24 behavior.324325Go 1.24 added new values for the `multipathtcp` setting.326The possible values for `multipathtcp` are now:327- "0": disable MPTCP on dialers and listeners by default328- "1": enable MPTCP on dialers and listeners by default329- "2": enable MPTCP on listeners only by default330- "3": enable MPTCP on dialers only by default331332For Go 1.24, it now defaults to multipathtcp="2", thus333enabled by default on listeners. Using multipathtcp="0" reverts to the334pre-Go 1.24 behavior.335336Go 1.24 changed the behavior of `go test -json` to emit build errors as JSON337instead of text.338These new JSON events are distinguished by new `Action` values,339but can still cause problems with CI systems that aren't robust to these events.340This behavior can be controlled with the `gotestjsonbuildtext` setting.341Using `gotestjsonbuildtext=1` restores the 1.23 behavior.342This setting will be removed in a future release, Go 1.28 at the earliest.343344Go 1.24 changed [`crypto/rsa`](/pkg/crypto/rsa) to require RSA keys to be at345least 1024 bits. This behavior can be controlled with the `rsa1024min` setting.346Using `rsa1024min=0` restores the Go 1.23 behavior.347348Go 1.24 introduced a mechanism for enabling platform specific Data Independent349Timing (DIT) modes in the [`crypto/subtle`](/pkg/crypto/subtle) package. This350mode can be enabled for an entire program with the `dataindependenttiming` setting.351For Go 1.24 it defaults to `dataindependenttiming=0`. There is no change in default352behavior from Go 1.23 when `dataindependenttiming` is unset.353Using `dataindependenttiming=1` enables the DIT mode for the entire Go program.354When enabled, DIT will be enabled when calling into C from Go. When enabled,355calling into Go code from C will enable DIT, and disable it before returning to356C if it was not enabled when Go code was entered.357This currently only affects arm64 programs. For all other platforms it is a no-op.358359Go 1.24 removed the `x509sha1` setting.  `crypto/x509` no longer supports verifying360signatures on certificates that use SHA-1 based signature algorithms.361362Go 1.24 changes the default value of the [`x509usepolicies`363setting.](/pkg/crypto/x509/#CreateCertificate) from `0` to `1`. When marshalling364certificates, policies are now taken from the365[`Certificate.Policies`](/pkg/crypto/x509/#Certificate.Policies) field rather366than the367[`Certificate.PolicyIdentifiers`](/pkg/crypto/x509/#Certificate.PolicyIdentifiers)368field by default.369370Go 1.24 enabled the post-quantum key exchange mechanism371X25519MLKEM768 by default. The default can be reverted using the372[`tlsmlkem` setting](/pkg/crypto/tls/#Config.CurvePreferences).373This can be useful when dealing with buggy TLS servers that do not handle large records correctly,374causing a timeout during the handshake (see [TLS post-quantum TL;DR fail](https://tldr.fail/)).375Go 1.24 also removed X25519Kyber768Draft00 and the Go 1.23 `tlskyber` setting.376377Go 1.24 made [`ParsePKCS1PrivateKey`](/pkg/crypto/x509/#ParsePKCS1PrivateKey)378use and validate the CRT parameters in the encoded private key. This behavior379can be controlled with the `x509rsacrt` setting. Using `x509rsacrt=0` restores380the Go 1.23 behavior.381382### Go 1.23383384Go 1.23 changed the channels created by package time to be unbuffered385(synchronous), which makes correct use of the [`Timer.Stop`](/pkg/time/#Timer.Stop)386and [`Timer.Reset`](/pkg/time/#Timer.Reset) method results much easier.387The [`asynctimerchan` setting](/pkg/time/#NewTimer) disables this change.388There are no runtime metrics for this change.389This setting will be removed in Go 1.27.390391Go 1.23 changed the mode bits reported by [`os.Lstat`](/pkg/os#Lstat) and [`os.Stat`](/pkg/os#Stat)392for reparse points, which can be controlled with the `winsymlink` setting.393As of Go 1.23 (`winsymlink=1`), mount points no longer have [`os.ModeSymlink`](/pkg/os#ModeSymlink)394set, and reparse points that are not symlinks, Unix sockets, or dedup files now395always have [`os.ModeIrregular`](/pkg/os#ModeIrregular) set. As a result of these changes,396[`filepath.EvalSymlinks`](/pkg/path/filepath#EvalSymlinks) no longer evaluates397mount points, which was a source of many inconsistencies and bugs.398At previous versions (`winsymlink=0`), mount points are treated as symlinks,399and other reparse points with non-default [`os.ModeType`](/pkg/os#ModeType) bits400(such as [`os.ModeDir`](/pkg/os#ModeDir)) do not have the `ModeIrregular` bit set.401402Go 1.23 changed [`os.Readlink`](/pkg/os#Readlink) and [`filepath.EvalSymlinks`](/pkg/path/filepath#EvalSymlinks)403to avoid trying to normalize volumes to drive letters, which was not always even possible.404This behavior is controlled by the `winreadlinkvolume` setting.405For Go 1.23, it defaults to `winreadlinkvolume=1`.406Previous versions default to `winreadlinkvolume=0`.407408Go 1.23 enabled the experimental post-quantum key exchange mechanism409X25519Kyber768Draft00 by default. The default can be reverted using the410[`tlskyber` setting](/pkg/crypto/tls/#Config.CurvePreferences).411This can be useful when dealing with buggy TLS servers that do not handle large records correctly,412causing a timeout during the handshake (see [TLS post-quantum TL;DR fail](https://tldr.fail/)).413414Go 1.23 changed the behavior of415[crypto/x509.ParseCertificate](/pkg/crypto/x509/#ParseCertificate) to reject416serial numbers that are negative. This change can be reverted with417the [`x509negativeserial` setting](/pkg/crypto/x509/#ParseCertificate).418419Go 1.23 re-enabled support in html/template for ECMAScript 6 template literals by default.420The [`jstmpllitinterp` setting](/pkg/html/template#hdr-Security_Model) no longer has421any effect.422423Go 1.23 changed the default TLS cipher suites used by clients and servers when424not explicitly configured, removing 3DES cipher suites. The default can be reverted425using the [`tls3des` setting](/pkg/crypto/tls/#Config.CipherSuites).426This setting will be removed in Go 1.27.427428Go 1.23 changed the behavior of [`tls.X509KeyPair`](/pkg/crypto/tls#X509KeyPair)429and [`tls.LoadX509KeyPair`](/pkg/crypto/tls#LoadX509KeyPair) to populate the430Leaf field of the returned [`tls.Certificate`](/pkg/crypto/tls#Certificate).431This behavior is controlled by the `x509keypairleaf` setting. For Go 1.23, it432defaults to `x509keypairleaf=1`. Previous versions default to433`x509keypairleaf=0`.434This setting will be removed in Go 1.27.435436Go 1.23 changed437[`net/http.ServeContent`](/pkg/net/http#ServeContent),438[`net/http.ServeFile`](/pkg/net/http#ServeFile), and439[`net/http.ServeFS`](/pkg/net/http#ServeFS) to440remove Cache-Control, Content-Encoding, Etag, and Last-Modified headers441when serving an error. This behavior is controlled by442the [`httpservecontentkeepheaders` setting](/pkg/net/http#ServeContent).443Using `httpservecontentkeepheaders=1` restores the pre-Go 1.23 behavior.444445### Go 1.22446447Go 1.22 adds a configurable limit to control the maximum acceptable RSA key size448that can be used in TLS handshakes, controlled by the [`tlsmaxrsasize` setting](/pkg/crypto/tls#Conn.Handshake).449The default is tlsmaxrsasize=8192, limiting RSA to 8192-bit keys. To avoid450denial of service attacks, this setting and default was backported to Go4511.19.13, Go 1.20.8, and Go 1.21.1.452453Go 1.22 made it an error for a request or response read by a net/http454client or server to have an empty Content-Length header.455This behavior is controlled by the `httplaxcontentlength` setting.456457Go 1.22 changed the behavior of ServeMux to accept extended458patterns and unescape both patterns and request paths by segment.459This behavior can be controlled by the460[`httpmuxgo121` setting](/pkg/net/http/#ServeMux).461462Go 1.22 added the [Alias type](/pkg/go/types#Alias) to [go/types](/pkg/go/types)463for the explicit representation of [type aliases](/ref/spec#Type_declarations).464Whether the type checker produces `Alias` types or not is controlled by the465[`gotypesalias` setting](/pkg/go/types#Alias).466For Go 1.22 it defaults to `gotypesalias=0`.467For Go 1.23, `gotypesalias=1` will become the default.468This setting will be removed in Go 1.27.469470Go 1.22 changed the default minimum TLS version supported by both servers471and clients to TLS 1.2. The default can be reverted to TLS 1.0 using the472[`tls10server` setting](/pkg/crypto/tls/#Config).473This setting will be removed in Go 1.27.474475Go 1.22 changed the default TLS cipher suites used by clients and servers when476not explicitly configured, removing the cipher suites which used RSA based key477exchange. The default can be reverted using the [`tlsrsakex` setting](/pkg/crypto/tls/#Config).478This setting will be removed in Go 1.27.479480Go 1.22 disabled481[`ConnectionState.ExportKeyingMaterial`](/pkg/crypto/tls/#ConnectionState.ExportKeyingMaterial)482when the connection supports neither TLS 1.3 nor Extended Master Secret483(implemented in Go 1.21). It can be reenabled with the [`tlsunsafeekm`484setting](/pkg/crypto/tls/#ConnectionState.ExportKeyingMaterial).485This setting will be removed in Go 1.27.486487Go 1.22 changed how the runtime interacts with transparent huge pages on Linux.488In particular, a common default Linux kernel configuration can result in489significant memory overheads, and Go 1.22 no longer works around this default.490To work around this issue without adjusting kernel settings, transparent huge491pages can be disabled for Go memory with the492[`disablethp` setting](/pkg/runtime#hdr-Environment_Variables).493This behavior was backported to Go 1.21.1, but the setting is only available494starting with Go 1.21.6.495This setting may be removed in a future release, and users impacted by this issue496should adjust their Linux configuration according to the recommendations in the497[GC guide](/doc/gc-guide#Linux_transparent_huge_pages), or switch to a Linux498distribution that disables transparent huge pages altogether.499500Go 1.22 added contention on runtime-internal locks to the [`mutex`501profile](/pkg/runtime/pprof#Profile). Contention on these locks is always502reported at `runtime._LostContendedRuntimeLock`. Complete stack traces of503runtime locks can be enabled with the [`runtimecontentionstacks`504setting](/pkg/runtime#hdr-Environment_Variables). These stack traces have505non-standard semantics, see setting documentation for details.506507Go 1.22 added a new [`crypto/x509.Certificate`](/pkg/crypto/x509/#Certificate)508field, [`Policies`](/pkg/crypto/x509/#Certificate.Policies), which supports509certificate policy OIDs with components larger than 31 bits. By default this510field is only used during parsing, when it is populated with policy OIDs, but511not used during marshaling. It can be used to marshal these larger OIDs, instead512of the existing PolicyIdentifiers field, by using the513[`x509usepolicies` setting](/pkg/crypto/x509/#CreateCertificate).514515516### Go 1.21517518Go 1.21 made it a run-time error to call `panic` with a nil interface value,519controlled by the [`panicnil` setting](/pkg/builtin/#panic).520521Go 1.21 made it an error for html/template actions to appear inside of an ECMAScript 6522template literal, controlled by the523[`jstmpllitinterp` setting](/pkg/html/template#hdr-Security_Model).524This behavior was backported to Go 1.19.8+ and Go 1.20.3+.525526Go 1.21 introduced a limit on the maximum number of MIME headers and multipart527forms, controlled by the528[`multipartmaxheaders` and `multipartmaxparts` settings](/pkg/mime/multipart#hdr-Limits)529respectively.530This behavior was backported to Go 1.19.8+ and Go 1.20.3+.531532Go 1.21 adds the support of Multipath TCP but it is only used if the application533explicitly asked for it. This behavior can be controlled by the534[`multipathtcp` setting](/pkg/net#Dialer.SetMultipathTCP).535536There is no plan to remove any of these settings.537538### Go 1.20539540Go 1.20 introduced support for rejecting insecure paths in tar and zip archives,541controlled by the [`tarinsecurepath` setting](/pkg/archive/tar/#Reader.Next)542and the [`zipinsecurepath` setting](/pkg/archive/zip/#NewReader).543These default to `tarinsecurepath=1` and `zipinsecurepath=1`,544preserving the behavior of earlier versions of Go.545A future version of Go may change the defaults to546`tarinsecurepath=0` and `zipinsecurepath=0`.547548Go 1.20 introduced automatic seeding of the549[`math/rand`](/pkg/math/rand) global random number generator,550controlled by the [`randautoseed` setting](/pkg/math/rand/#Seed).551552Go 1.20 introduced the concept of fallback roots for use during certificate verification,553controlled by the [`x509usefallbackroots` setting](/pkg/crypto/x509/#SetFallbackRoots).554555Go 1.20 removed the preinstalled `.a` files for the standard library556from the Go distribution.557Installations now build and cache the standard library like558packages in other modules.559The [`installgoroot` setting](/cmd/go#hdr-Compile_and_install_packages_and_dependencies)560restores the installation and use of preinstalled `.a` files.561562There is no plan to remove any of these settings.563564### Go 1.19565566Go 1.19 made it an error for path lookups to resolve to binaries in the current directory,567controlled by the [`execerrdot` setting](/pkg/os/exec#hdr-Executables_in_the_current_directory).568There is no plan to remove this setting.569570Go 1.19 started sending EDNS0 additional headers on DNS requests.571This can reportedly break the DNS server provided on some routers,572such as CenturyLink Zyxel C3000Z.573This can be changed by the [`netedns0` setting](/pkg/net#hdr-Name_Resolution).574This setting is available in Go 1.21.12, Go 1.22.5, Go 1.23, and later.575There is no plan to remove this setting.576577### Go 1.18578579Go 1.18 removed support for SHA1 in most X.509 certificates,580controlled by the [`x509sha1` setting](/pkg/crypto/x509#InsecureAlgorithmError).581This setting was removed in Go 1.24.582583### Go 1.10584585Go 1.10 changed how build caching worked and added test caching, along586with the [`gocacheverify`, `gocachehash`, and `gocachetest` settings](/cmd/go/#hdr-Build_and_test_caching).587There is no plan to remove these settings.588589### Go 1.6590591Go 1.6 introduced transparent support for HTTP/2,592controlled by the [`http2client`, `http2server`, and `http2debug` settings](/pkg/net/http/#hdr-HTTP_2).593There is no plan to remove these settings.594595### Go 1.5596597Go 1.5 introduced a pure Go DNS resolver,598controlled by the [`netdns` setting](/pkg/net/#hdr-Name_Resolution).599There is no plan to remove this setting.