Go 1.6.3 now available.

Change effective on 19 July 2016

Heroku has added support for Go v1.6.3.

This is now the default version of Go when go1.6 is specified in an application’s Godeps/Godeps.json file (for godep), $GOVERSION (for GB) environment variable, or vendor/vendor.json file (for govendor) and will be used on next push.

This version of Go includes a security fix to input validation in the CGI packages resulting in the HTTP_PROXY environment variable being set by the incoming Proxy header. This is unlikely to affect users of Go on Heroku though as Heroku does not run Go applications as CGI scripts.

For more information, see our Dev Center article on Heroku Go Support and please open a ticket if you have any questions.