Goa Files

Goa v3.27.0 adds first-class support for standard Bearer token authentication and improves generated code in a few places that matter when real projects turn on stricter typing and linting.

Highlights

• Added BearerSecurity and BearerToken for APIs that use the standard Authorization: Bearer format without needing JWT-specific DSL names. This gives generic bearer-token APIs clearer designs, generated code, and OpenAPI output. (#3925)
• Fixed HTTP path and query parameter generation for string-based custom field types that implement encoding.TextUnmarshaler, including optional query params and validation edge cases. (#3926)
• Improved OpenAPI v2 schema generation so named parameter and header aliases map to the right primitive schemas. (#3919)

Fixes

• Restored errors.Is(err, flag.ErrHelp) in generated example clients so help handling keeps working correctly after the JSON-RPC merge. (#3927)
• Wrapped generated CLI ParseEndpoint errors so downstream projects using wrapcheck can keep generated CLIs lint-clean. (#3928)

Dependencies And Examples

• Refreshed Goa dependencies, including gRPC, OpenTelemetry, golang.org/x/*, and related transitive modules.
• Refreshed the examples and plugins repositories for this release and published matching v3.27.0 tags.

Upgrade Notes

• Goa's module metadata now targets Go 1.25 after the dependency refresh. Use Go 1.25 or newer when building this release from source.
• If you model generic bearer-token authentication, prefer the new BearerSecurity DSL over JWT-specific helpers when the token is not specifically a JWT.

Contributors

Thank you to @raphael, @sevein, @sbryzak, and @stakahashy for the code, fixes, documentation, and release work in this version.