Go 1.6.3 now available.
Change effective on 19 July 2016
Heroku has added support for Go v1.6.3.
This is now the default version of Go when
go1.6 is specified in an application’s
Godeps/Godeps.json file (for godep),
$GOVERSION (for GB) environment variable, or
vendor/vendor.json file (for govendor) and will be used on next push.
This version of Go includes a security fix to input validation in the CGI packages resulting in the HTTP_PROXY environment variable being set by the incoming Proxy header. This is unlikely to affect users of Go on Heroku though as Heroku does not run Go applications as CGI scripts.