Goa v3.35.0

Goa v3.35.0 requires Go 1.27.3 so generated services pick up critical standard-library certificate-chain and HTTP/2 security fixes automatically, cuts goa gen time by 6.5x across real-world multi-service repositories, expands OneOf union modeling across HTTP, JSON-RPC, gRPC, and OpenAPI, and adds per-service HTTP JSON field mapping with BodyFieldName.

Why Goa v3.35.0 Requires Go 1.27.3

Goa services sit directly on the edge of TLS, HTTP/2, HTTP/1, and gRPC traffic. Declaring go 1.27.3 in goa.design/goa/v3/go.mod means Go's minimum version selection enforces Go 1.27.3 or newer whenever you upgrade Goa, ensuring production services cannot silently build and ship against vulnerable standard-library packages (#4067, #4068).

Go 1.27.3: Distrusting compromised intermediate CA keys in crypto/x509 (CVE-2026-111943)

Go 1.27.3 is an emergency security release for crypto/x509 (CVE-2026-111943 / go.dev/issue/79291) following root-store distrust of intermediate Certificate Authorities under the eMudhra (emSign) hierarchy after audit and compliance failures. Rather than waiting for operating system root-store updates—which static and distroless container images often lack or delay—Go 1.27.3 hardcodes a blocklist of 8 distrusted intermediate CA SubjectPublicKeyInfo (SPKI) SHA-256 hashes directly into crypto/x509 (verify.go, root_darwin.go, and root_windows.go).

When any certificate in a candidate verification chain matches one of those SPKI hashes, x509.Certificate.Verify rejects the chain across Linux/Unix root bundles, macOS Security framework verification, and Windows CryptoAPI verification (x509: no valid chains built). Upgrading to Go 1.27.3 ensures outbound TLS clients and mutual-TLS servers in Goa services immediately distrust certificates issued by those intermediate keys.

Go 1.27.2: 15 standard-library and toolchain security fixes

Requiring Go 1.27.3 also ensures every Goa service includes the 15 security fixes shipped in Go 1.27.2 across the HTTP, TLS, MIME, and template packages that back generated transports:

• HTTP/2 server crash and denial-of-service fixes (net/http): Fixes an HPACK header encoder race condition between concurrent frame writes and write timeouts that could corrupt connections or crash HTTP/2 servers (CVE-2026-97032), four HTTP/2 resource-exhaustion vectors triggered by control-frame floods (CVE-2026-78659), empty DATA frames (CVE-2026-78660), buffered RST_STREAM frames (CVE-2026-78667), and unthrottled peer SETTINGS frames (CVE-2026-78669), as well as double flow-control window refunds (CVE-2026-78663).
• HTTP/1 CONNECT request desynchronization (net/http): Prevents pipelined data sent after an HTTP/1 CONNECT request from being parsed as a separate request on the server connection (CVE-2026-56866, CVE-2026-94439).
• Multipart and trailing-header size limits (net/textproto, mime/multipart): Enforces header count and byte limits when reading chunked trailers and multipart preambles (CVE-2026-94440).
• TLS Encrypted Client Hello handling (crypto/tls): Rejects malformed Encrypted Client Hello (ECH) extensions cleanly during TLS handshakes (CVE-2026-97031).
• Template escaping, os.Root, and cmd/go hardening: Fixes URL attribute escaping in <meta> tags (CVE-2026-94448) and JavaScript template literal interpolation (CVE-2026-97030) in html/template, blocks junction directory traversal in os.Root on Windows (CVE-2026-56857), and prevents cmd/go checksum database bypasses via crafted Git configuration or branch names (CVE-2026-94444, CVE-2026-94447).

Highlights

6.5x faster goa gen and 6.4x faster test suite (#4042, #4043, #4058, #4059, #4060, #4061, #4062, #4064, #4067). Regenerating all 19 official Goa example services drops from ~92s to ~14s. Goa now parses its embedded text/template bundles once per process and clones them per file section, replaces its four-pass Go source import/format pipeline (ast.File -> format.Node -> imports.Process -> format.Source) with a single AST unused-import prune followed by a single format.Node pass, and eliminates repeated allocations across prepared-design audits, HTTP type graph traversal, and object conversion planning. Generator test suites also batch generated-code compilation per package, cutting go test ./... across Goa from ~358s to ~56s.

Flat and tagless OneOf JSON representations (#4035, #4037). OneOf unions gain two new wire shapes for HTTP, JSON-RPC, and OpenAPI without giving up Go union safety (Type() and Value()):

• Flat object unions (Meta("oneof:flat", "true"), #4035): Object-only unions whose branches each have a distinct required discriminator field serialize directly as flat JSON objects without an outer wrapper key.
• Tagless unions by JSON kind (Meta("struct:tag:json", "-"), #4037): Unions whose branches have distinct JSON value kinds (string, number, boolean, array, object) serialize directly as the underlying JSON value without a wrapper object or discriminator field.

Collection branches, result views, and raw JSON in OneOf unions (#4036, #4038, #4039, #4045, #4046).

• OneOf unions used over gRPC now support ArrayOf and MapOf branches by generating synthetic repeated/map wrapper messages in .proto and round-tripping them automatically (#4046).
• Result-type views now propagate through nested OneOf branches and collections across service projections, HTTP codecs, and OpenAPI schemas (#4036).
• Named user types and tagged unions using Meta("struct:field:type", "json.RawMessage", "encoding/json") preserve raw JSON bytes end-to-end across HTTP, JSON-RPC, and gRPC without intermediate any decoding (#4045).
• Generator plugins can render shared union packages directly via codegen/service.AddUnionTypes and inspect union branch metadata with .Values in templates (#4038, #4039).

Per-service HTTP JSON field names with BodyFieldName (#4056, #4057). When multiple HTTP services or methods share a single Goa Type but need different JSON property names on the wire, BodyFieldName("Attr", "wire_name") inside the HTTP block remaps the JSON field name and OpenAPI schema for that service or method without duplicating the design type.

Fixes

• Forwarded gRPC status preservation (#4066): When one gRPC service returns an error received from a downstream gRPC call—or an application error that implements GRPCStatus() *status.Status—generated gRPC server adapters preserve its status code and message instead of wrapping it as codes.Unknown.
• Protobuf generation for inline objects, cross-package RPCs, and reserved fields (#4040, #4044, #4047, #4048): Inline Object fields inside user types emit dedicated nested protobuf messages instead of invalid message field types (#4048); RPC signatures qualify message references imported from Meta("protoc:include", ...) packages (#4047); protobuf message field reservations survive gRPC finalization (#4040); and gRPC conversion planning retains service layouts consistently (#4044).
• HTTP and OpenAPI parameter and schema accuracy (#4051, #4052, #4053, #4054, #4055, #4065): Mapped path parameters (Param("attr:url_name")) preserve both the payload attribute identity and the HTTP path parameter name across HTTP servers, clients, and OpenAPI (#4052, #4053); MinLength/MaxLength on MapOf emit minProperties/maxProperties in OpenAPI v2 and v3 (#4055); primitive field transformation helpers honor nil guards (#4054) and deduplicate cleanly through the transform registry (#4051); and prepared-design snapshots retain shared service paths (#4065).
• External package conversion consistency (#4041): Generated conversion helpers referencing types in external packages via Meta("struct:pkg:path", ...) keep package imports and type declarations consistent across services.

Dependencies

• Minimum Go toolchain updated to go 1.27.3 across goa, examples, and plugins, including CI matrices (#4067).
• Updated github.com/go-chi/chi/v5 to v5.5.0, golang.org/x/net to v0.61.0, golang.org/x/tools to v0.52.0, golang.org/x/mod to v0.42.0, golang.org/x/sync to v0.24.0, golang.org/x/sys to v0.49.0, and golang.org/x/text to v0.43.0.

Upgrade Notes

1. Install Go 1.27.3 or newer before upgrading goa.design/goa/v3 to v3.35.0, and update go 1.27.3 in your module's go.mod and CI/container build images.
2. Install the v3.35.0 CLI and regenerate:

   go install goa.design/goa/v3/cmd/goa@v3.35.0
   goa gen <module>/design

3. Wire compatibility: Existing designs regenerate wire-compatibly except where a bug fix corrects previously broken behavior (such as nested union result views now projecting non-default views on HTTP responses, or forwarded gRPC errors preserving upstream status codes instead of codes.Unknown). Opting into Meta("oneof:flat", "true"), Meta("struct:tag:json", "-") on a OneOf, BodyFieldName, or collection branches in gRPC unions changes the wire contract for those endpoints—deploy regenerated clients and servers together. See the v3.35.0 upgrade guide for full details and rollback guidance.

Contributors

Thanks to @raphael for designing, implementing, and shipping all changes in this release.