A Go major release is supported until two newer major releases are out, which works out to about a year. With Go 1.27 released on 19 August 2026, Go 1.26 and 1.27 are the supported lines. Go 1.25 has dropped out of support.
The rule
The Go release policy page says each major Go release is supported until there are two newer major releases. The page's example is that Go 1.5 was supported until Go 1.7 was released. Critical problems, including critical security problems, are fixed in supported releases through minor revisions such as 1.26.1.
The page does not state a cadence, but the dates it lists show a major release about every six months, in February and August.
Where each line stands
| Major | Initial release | Last patch listed | Date of that patch | Supported? |
|---|---|---|---|---|
| 1.27 | 2026-08-19 | 1.27.2 | 2026-10-08 | Yes |
| 1.26 | 2026-02-10 | 1.26.9 | 2026-10-08 | Yes |
| 1.25 | 2025-08-12 | 1.25.14 | 2026-08-19 | No, ended with 1.27 |
| 1.24 | 2025-02-11 | 1.24.13 | 2026-02-04 | No |
The last row shows how it looks in practice. The final patch for a line lands when the second newer major ships, and then the line goes quiet.
What the security fixes cover
The release history shows that minor revisions carry security fixes to the go command and to standard library packages. The page lists, for the 1.26.3 revision, fixes touching html/template, net, net/http, net/mail and syscall among others. A Go program statically links the standard library, so a fix only reaches you when you rebuild with a patched toolchain. This is a difference from runtimes you install once on a server.
What to do
- Track two numbers per service: the Go version in
go.modand the toolchain used in CI. - Rebuild on every patch. A patch to the standard library does nothing until you rebuild and redeploy binaries.
- Upgrade twice a year or once a year. Each Go release you skip shortens your window by half.
- Use two supported lines at most across the organisation.
For how the go and toolchain lines behave, read go.mod toolchain line and GOTOOLCHAIN explained.
Try it yourself
The SCA dependency inventory demo lists packages and versions. For a Go service, the standard library version baked into a binary matters as much as module versions, so look at how versions are reported.
Click through it at your own pace, or open it full screen.
Safeguard scans Go modules and can build an SBOM for a Go project. The free scan is at gold.safeguard.sh/scan.
Quick check
Is Go 1.25 still supported?
No. Under the two newer releases rule, it ended when Go 1.27 shipped.
Do I need to upgrade Go to get a standard library fix?
You need to rebuild with a toolchain that contains the fix. That usually means a patch revision of a supported major.
Sources
Last reviewed: 19 October 2026.
