Go

How Go versioning, EOL & security support work

Go ships a new major release roughly once or twice a year, each adding a new minor version number such as 1.25 or 1.26. Go's release policy is notably narrower than most runtimes about how many versions it supports at once: each release is supported until there are two newer major releases. That means only the current release and the one immediately before it are ever under support.

Security bugs in Go are reported privately by email to security@golang.org, and confirmed issues are fixed only in the two currently supported releases before disclosure. Go also maintains a public Go Vulnerability Database, queried by the govulncheck tool. Because Go supports only two majors at a time, falling behind by even one extra release means running a version the Go team will no longer patch.

Sources: Go Release Policy, Go Vulnerability Management

Data sourced from endoflife.date.