Go 1.27 promotes encoding/json/v2 and jsontext from experiment to stable

What happened

With the Go 1.27 release, the encoding/json/v2 package and its companion encoding/json/jsontext have reached stable status and are open to general use, Go reported. The 4 November 2026 post had seven authors, among them Joe Tsai, Damien Neil, Daniel Martí and Michael Pratt. It follows an experimental version of the API introduced the previous year, which was refined after further feedback.

The authors said the original encoding/json package has proven flexible but carries flaws that users have flagged over the years. It tolerates invalid UTF-8, which RFC 8259 forbids. It also accepts objects with repeated member names, a weakness attackers have abused in the past, for example in CVE-2017-12635. In addition, it matches field names without regard to case and encodes nil slices and maps as null.

According to the post, these behaviors could not be corrected without breaking the Go 1 compatibility promise. The same applies to performance limits such as buffering whole values in memory and quadratic slowdowns when custom methods call Marshal or Unmarshal recursively. The new design splits the work in two: jsontext handles JSON syntax without relying on reflection, while json/v2 maps JSON values to Go types.

Context

Go has shipped JSON support in its standard library since before Go 1.0, and the authors describe JSON as the most widely used data format on the internet. Because the problems stem from the existing API itself, they chose a separate v2 namespace rather than adding parallel functions such as MarshalV2 inside the original package. A survey cited in the post found most Go users want nil slices and maps encoded as empty arrays or objects.