On October 8, 2026, Docker Engine 29.9.0 updated its Go runtime and closed five CVEs that let an HTTP/2 client crash the daemon or exhaust its memory, while enabling lazy-pull for remote snapshotters. If your Docker API is reachable from the network, schedule the upgrade; otherwise, use the moment to check your exposure.

On August 19, 2026, the Go team released version 1.27, six months after 1.26. It adds generic methods, an encoding/json/v2 package with stricter defaults, and the ML-DSA post-quantum scheme wired into TLS 1.3.