A new Go API for JSON

Handling of invalid UTF-8 and duplicate JSON keys now produces errors instead of silent corruption or security risks.

Go's standard library has introduced a new, stable API for handling JSON with the release of encoding/json/v2 and encoding/json/jsontext in Go 1.27. This update addresses long-standing issues and limitations in the original encoding/json package, which has been part of Go for over 15 years. The new API aims to rectify behavioral flaws such as imprecise handling of JSON syntax, including issues with invalid UTF-8 and duplicate member names, and the leaking of nilness for slices and maps. It also resolves API deficiencies like difficult unmarshaling from io.Reader, inconsistent method calling for custom marshaling, and restrictive options for formatting functions. Performance limitations, including the allocation overhead of MarshalJSON and the double-parsing inherent in UnmarshalJSON, have also been targeted, along with a lack of true streaming capabilities.

The encoding/json/jsontext package, a foundational component for the new API, separates JSON syntax processing from semantic value mapping. This distinction allows for more robust and efficient handling of JSON data, as it no longer relies on Go reflection for basic syntactic operations. The jsontext package provides low-level access to JSON tokens and values, enabling developers to build custom encoding and decoding logic with greater control and performance. Its design paves the way for more predictable and secure JSON processing within Go applications.

The introduction of encoding/json/v2 signifies a major evolution in how Go developers interact with JSON. By addressing critical flaws like case-insensitive unmarshaling and inconsistent handling of nil values, the new API enhances both security and developer experience. The improved streaming capabilities and refined marshaling/unmarshaling interfaces are expected to boost performance and reduce common errors. This update is a crucial step towards modernizing Go's data interchange capabilities to meet current web standards and security demands.