The ResponseController type provides a clearer, more discoverable way to add per-handler controls. Two such controls also added in Go 1.20 are SetReadDeadline and SetWriteDeadline, which allow setting per-request read and write deadlines. For example:

func RequestHandler(w ResponseWriter, r *Request) {
  rc := http.NewResponseController(w)
  rc.SetWriteDeadline(0) // disable Server.WriteTimeout when sending a large response
  io.Copy(w, bigData)
}

New ReverseProxy Rewrite hook

The httputil.ReverseProxy forwarding proxy includes a new Rewrite hook function, superseding the previous Director hook.

The Rewrite hook accepts a ProxyRequest parameter, which includes both the inbound request received by the proxy and the outbound request that it will send. Unlike Director hooks, which only operate on the outbound request, this permits Rewrite hooks to avoid certain scenarios where a malicious inbound request may cause headers added by the hook to be removed before forwarding. See issue #50580.

The ProxyRequest.SetURL method routes the outbound request to a provided destination and supersedes the NewSingleHostReverseProxy function. Unlike NewSingleHostReverseProxy, SetURL also sets the Host header of the outbound request.

The ProxyRequest.SetXForwarded method sets the X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Proto headers of the outbound request. When using a Rewrite, these headers are not added by default.

An example of a Rewrite hook using these features is:

proxyHandler := &httputil.ReverseProxy{
  Rewrite: func(r *httputil.ProxyRequest) {
    r.SetURL(outboundURL) // Forward request to outboundURL.
    r.SetXForwarded()     // Set X-Forwarded-* headers.
    r.Out.Header.Set("X-Additional-Header", "header set by the proxy")
  },
}

Minor changes to the library

As always, there are various minor changes and updates to the library, made with the Go 1 promise of compatibility in mind. There are also various performance improvements, not enumerated here.

TODO: complete this section

archive/zip

Reading from a directory file that contains file data will now return an error. The zip specification does not permit directory files to contain file data, so this change only affects reading from invalid archives.

bytes

TODO: https://go.dev/cl/407176: strings, bytes: add CutPrefix and CutSuffix

TODO: https://go.dev/cl/359675: bytes: add Clone function

context

TODO: https://go.dev/cl/375977: context: add APIs for writing and reading cancelation cause; modified api/next/51365.txt

crypto/ed25519

TODO: https://go.dev/cl/373076: crypto/ed25519: implement Ed25519ph in Sign and VerifyWithOptions; modified api/next/31804.txt

crypto/elliptic

TODO: https://go.dev/issue/34648: automatically upgrade CurveParams for known curves and deprecate custom ones

crypto/rsa

TODO: https://go.dev/issue/19974: allow hash.Hash for OAEP and MGF1 to be specified independently

crypto/subtle

TODO: https://go.dev/issue/53021: add XORBytes

TODO: https://go.dev/cl/421435: crypto/subtle: add XORBytes; modified api/next/53021.txt

crypto/tls

TODO: https://go.dev/cl/426455: crypto/tls: use certificate cache in client

debug/elf

TODO: https://go.dev/cl/420982: debug/elf: add new-style LoongArch reloc types; modified api/next/54222.txt

TODO: https://go.dev/cl/411915: debug/elf: fix reloc number of R_PPC64_SECTOFF_LO_DS; modified api/except.txt, api/next/53356.txt

TODO: https://go.dev/cl/425555: debug/elf: define additional PPC64 ELFv2 relocations; modified api/next/54345.txt

TODO: https://go.dev/cl/429601: debug/elf: return error on reading from SHT_NOBITS sections

TODO: https://go.dev/cl/435415: debug/elf: fix typo in R_PPC64_TPREL34 and R_PPC64_DTPREL34; modified api/next/54345.txt

debug/pe

TODO: https://go.dev/cl/421357: debug/pe: add IMAGE_FILE_MACHINE_RISCV{32,64,128}; modified api/next/54251.txt

encoding/binary

The ReadVarint and ReadUvarint functions will now return io.ErrUnexpectedEOF after reading a partial value, rather than io.EOF.

encoding/xml

TODO: https://go.dev/issue/53346: Add (*Encoder).Close() to check for unclosed elements

TODO: https://go.dev/cl/424777: encoding/xml: add (*Encoder).Close

TODO: https://go.dev/cl/103875: encoding/xml: error when more than one colon in qualified names

TODO: https://go.dev/cl/107255: encoding/xml: error when closing tag does not match opening tag

errors

The new Join function returns an error wrapping a list of errors.

fmt

The Errorf function supports multiple occurrances of the %w format verb.

TODO: https://go.dev/issue/51668: add FormatString(State) string

TODO: https://go.dev/cl/400875: fmt: add a function to recover the original format string given a State; modified api/next/51668.txt

go/ast

TODO: https://go.dev/cl/426091: go/ast: add Range token.Pos to RangeStmt

TODO: https://go.dev/cl/427955: go/ast: record start and end of file in File.File{Start,End}; modified api/next/53202.txt

go/build

TODO: https://go.dev/cl/421434: go/build: add GO$GOARCH-based ToolTags

go/token

TODO: https://go.dev/cl/410114: go/token: add (*FileSet).RemoveFile(*File) method

io

TODO: https://go.dev/issue/45899: add OffsetWriter, NewOffsetWriter

TODO: https://go.dev/cl/406776: io: add OffsetWriter, NewOffsetWriter; modified api/next/45899.txt

io/fs

TODO: https://go.dev/cl/363814: path/filepath, io/fs: add SkipAll; modified api/next/47209.txt

math/rand

TODO: https://go.dev/issue/54880: seed global generator randomly

TODO: https://go.dev/cl/436955: math/rand: deprecate Read

mime

The ParseMediaType function now allows duplicate parameter names, so long as the values of the names are the same.

mime/multipart

Methods of the Reader type now wrap errors returned by the underlying io.Reader.

net

TODO: https://go.dev/issue/50101: make LookupCNAME consistent between Unix and Windows, document

TODO: https://go.dev/issue/53482: add FlagRunning to the Flags of struct Interface, to exactly reflect the states of an interface or NIC

TODO: https://go.dev/issue/55301: Add ControlContext to Dialer

TODO: https://go.dev/cl/413454: net: add FlagRunning to exactly reflect the states of an interface.; modified api/next/53482.txt

TODO: https://go.dev/cl/428955: net: set AD bit in DNS queries when trust-ad in resolv.conf

TODO: https://go.dev/cl/444955: net: add ControlContext to Dialer; modified api/next/55301.txt

TODO: https://go.dev/cl/446179: net: unify CNAME handling across ports

TODO: https://go.dev/cl/448075: net: auto-reload the /etc/nsswitch.conf on unix systems

net/http

The new ResponseController type provides access to extended per-request functionality not handled by the ResponseWriter interface.

The new ResponseController.SetReadDeadline and ResponseController.SetWriteDeadline methods permit setting per-request read and write deadlines.

The ResponseWriter.WriteHeader function now supports sending 1xx status codes.

The new Server.DisableGeneralOptionsHandler configuration setting allows disabling the default OPTIONS * handler.

The new Transport.OnProxyConnectResponse hook is called when a Transport receives an HTTP response from a proxy for a CONNECT request.

The HTTP server now accepts HEAD requests containing a body, rather than rejecting them as invalid.

HTTP/2 stream errors returned by net/http functions may be converted to a "golang.org/x/net/http2".StreamError using errors.As.

Leading and trailing spaces are trimmed from cookie names, rather than being rejected as invalid. For example, a cookie setting of "name =value" is now accepted as setting the cookie "name".