go-tools

This release fixes two false positives in SA4023 that were introduced with 2026.2:

• It no longer treats unconstrained generics as never nil (#1736).
• It no longer triggers in situations that don't involve typed nils (#1737).

Added support for Go 1.27

This release updates Staticcheck’s database of deprecated standard library APIs to cover Go 1.27. Furthermore, it adds support for two new language features: generic methods and struct initializers with direct references to embedded fields

Support for GOCACHEPROG

Staticcheck now supports the same GOCACHEPROG environment variable and protocol as the go tool. This allows users to provide their own implementation of the build/fact/diagnostic cache.

Case-insensitive check names

All places that accept names of checks, such as the -checks and -explain flags, ignore directives, and the checks setting in configuration files now ignore the case of the provided names. That is, SA1000, sa1000, and sA1000 all refer to the same check.

Performance improvements for some packages

We have made changes to better support code with very complex control flow graphs, such as the output of wasm2go. In one particularly pathological case, memory usage was reduced from 10 GiB to 1.5 GiB and wall time from 73 s to 13 s.

Checks

New checks

One new check has been added. SA9010 flags statements of the form defer foo() where foo returns a function. Usually, functions like that expect the user to defer calling the returned function.

For example:

// Start starts a thing. The returned function has to be called once the thing
// is no longer needed.
func Start() func() {
	// do some work here
	return func() {
		// undo some work here
	}
}

func user() {
	// This is doubly wrong! It won't call Start until this function returns,
	// and then it won't call the function returned by Start.
	defer Start()
	...
}

Changed checks

The following checks have been improved:

• SA1019 now flags uses of deprecated fields in struct initializers. Additionally, it is more consistent in the way diagnostics are formatted.
• SA1026 and SA9005 now check calls to MarshalIdent functions, too.
• SA4003 now checks comparisons involving generics.
• SA4006 has gained support for compound operators (+=, ^=, etc) as well as postfix increment and decrement.
• SA4023 has been reimplemented. As a result, it may find new issues in existing code, but also miss issues it has found before.
• SA5011 has been disabled due to internal changes. It is unclear whether it will be enabled again in the future. As an alternative, gopls contains the nilness analyzer, which has similar checks.
• SA6005 emits a clearer diagnostic when the result of strings.EqualFold has to be inverted.
• Documentation has been added to several checks (SA1002, SA1012,

This is a release candidate of Staticcheck 2026.2. It has been built with Go 1.27rc1 and supports analyzing Go 1.27 code.

Added support for Go 1.27

This release updates Staticcheck’s database of deprecated standard library APIs to cover Go 1.27. Furthermore, it adds support for two new language features: generic methods and struct initializers with direct references to embedded fields

Support for GOCACHEPROG

Staticcheck now supports the same GOCACHEPROG environment variable and protocol as the go tool. This allows users to provide their own implementation of the build/fact/diagnostic cache.

Case-insensitive check names

All places that accept names of checks, such as the -checks and -explain flags, ignore directives, and the checks setting in configuration files now ignore the case of the provided names. That is, SA1000, sa1000, and sA1000 all refer to the same check.

Performance improvements for some packages

We have made changes to better support code with very complex control flow graphs, such as the output of wasm2go. In one particularly pathological case, memory usage was reduced from 10 GiB to 1.5 GiB and wall time from 73 s to 13 s.

Checks

New checks

One new check has been added. SA9010 flags statements of the form defer foo() where foo returns a function. Usually, functions like that expect the user to defer calling the returned function.

For example:

// Start starts a thing. The returned function has to be called once the thing
// is no longer needed.
func Start() func() {
	// do some work here
	return func() {
		// undo some work here
	}
}

func user() {
	// This is doubly wrong! It won't call Start until this function returns,
	// and then it won't call the function returned by Start.
	defer Start()
	...
}

Changed checks

The following checks have been improved:

• SA1019 now flags uses of deprecated fields in struct initializers. Additionally, it is more consistent in the way diagnostics are formatted.
• SA1026 and SA9005 now check calls to MarshalIdent functions, too.
• SA4003 now checks comparisons involving generics.
• SA4006 has gained support for compound operators (+=, ^=, etc) as well as postfix increment and decrement.
• SA4023 has been reimplemented. As a result, it may find new issues in existing code, but also miss issues it has found before.
• SA5011 has been disabled due to internal changes. It is unclear whether it will be enabled again in the future. As an alternative, gopls contains the nilness analyzer, which has similar checks.
• SA6005 emits a clearer diagnostic when the result of strings.EqualFold has to be inverted.
• Documentation has been added to several checks (SA1002, [SA1012](https://sta

Improved Go 1.25 and Go 1.26 support

This release updates Staticcheck’s database of deprecated standard library APIs to cover the Go 1.25 and Go 1.26 releases, as well as to add some crypto/elliptic deprecations from Go 1.21 that were missing. Furthermore, it adds support for new(expr), which was added in Go 1.26.

Other changes

• Version mismatch checks have been relaxed and no longer care about mismatches in the patch level. For example, Staticcheck built with Go 1.26.0 will be able to check code using Go 1.26.1.
• Staticcheck no longer opens staticcheck.conf files that aren’t regular files (or symlinks to regular files). See this gomodfs issue for the motivation behind this change.
• Staticcheck now exits with a non-zero status code if it encountered an invalid configuration file.

Checks

Changed checks

The following checks have been improved:

• SA1026 no longer panics when checking code that tries to marshal named functions (issue 1660).
• SA4000 no longer flags var _ = T{} == T{}, a pattern used to ensure that type T is comparable (issue 1670).
• SA4000 now correctly skips structs containing floats.
• SA4000 now skips functions from the math/rand/v2 package.
• SA4003 now skips over generated files.
• SA4030 now also checks uses of math/rand/v2.
• SA5008 has been updated with better support for encoding/json/v2.
• SA5010 no longer tries to reason about generics, to avoid false positives.
• ST1019 no longer flags duplicate imports of unsafe, mainly to play nice with cgo.
• ST1003 and QF1002 now emit more concise positions, benefitting users of gopls (issue 1647).
• ST1019 now allows importing the same package twice, once using a blank import (issue 1688).
• QF1008 no longer offers to delete all embedded fields from a selector expression. Even when two fields are individually superfluous, removing both might change the semantics of the code (issue 1682).
• QF1012 now detects more uses of bytes.Buffer (issue 1097).
• A bug in the intermediate representation was fixed, affecting the behavior of various checks (issue 1654).