v0.16.0

This release adds support for Go 1.26 and drops support for Go 1.25.

A number of fixes are also included:

• Fix a number of bugs relating to obfuscating generic struct types
• Fix a bug where using -tiny would cause GODEBUG knobs to be ignored
• Improve the reflect detection to support gin templates

Consider becoming a sponsor if you benefit from the work that went into this release!

v0.15.0

This release adds support for Go 1.25 and drops support for Go 1.23 and Go 1.24.

Literal obfuscation is improved slightly so that deobfuscation via static analysis is not as easy to achieve.

Attempting to obfuscate packages which inject function headers into the runtime via //go:linkname now fails in a very clear way, as such packages like github.com/bytedance/sonic/loader cannot work with an obfuscated runtime.

A number of fixes are also included:

• Fix obfuscating packages whose Go files all import C
• Fix builds where GOROOT is a symbolic link
• Fix control flow obfuscation on packages importing unsafe
• Fix a regression where build flags were not obeyed in garble reverse

v0.14.2

This bugfix release fixes a number of issues and continues support for Go 1.23 and 1.24.

Toolchain upgrades via GOTOOLCHAIN now work correctly; the transparent upgrade could lead to "linked object header mismatch" errors as garble was accidentally mixing the original and upgraded toolchain versions.

garble -debugdir now refuses to delete a non-empty directory if its contents were not created by a previous -debugdir invocation. This should prevent mistakes which could lead to losing important files.

Function intrinsics were not being picked up correctly from Go 1.24; this could lead to degraded performance for some users, as obfuscating their names prevented the toolchain from optimizing them.

v0.14.1

This release adds support for Go 1.24 and continues support for Go 1.23.

v0.14.0

This release drops support for Go 1.22 and continues support for Go 1.23.

@lu4p improved the compatibility with reflection of Go types by collecting the set of all types used with reflection during the entire build, and then inject the de-obfuscation of their names in the link step. Thanks to this, many more Go packages should work out of the box, and the README caveat suggesting the use of "reflection hints" is removed.

@mvdan replaced our own tracking of type aliases, necessary given that the alias name becomes a field name when embedded into a struct type. We now rely entirely on upstream Go's tracking of aliases in go/types. Note that this means that Garble now requires Go 1.23.5 or later, given that alias tracking did not work properly in previous Go versions.

A number of fixes are also included:

• Reduce the amount of info fetched from go list -json for a ~2% speed-up
• Package names and paths are now obfuscated separately
• Hashing of struct types to obfuscate field names is now better implemented
• Fix a panic which could occur when using structs as type parameters

v0.13.0

This release drops support for Go 1.21 and adds support for Go 1.23.

A number of fixes are also included:

• Fix obfuscation errors when arch-dependent struct padding is used
• Fix a failure when using garble inside a go.work workspace
• Fail early and clearly if the Go version is too new
• Rewrite the main go generate script from Bash to Go and improve it

v0.12.1

This bugfix release fixes a regression in v0.12.0 that broke x/sys/unix. See #830.

v0.12.0

This release continues support for Go 1.21 and includes fixes for Go 1.22, now that the final 1.22.0 release is out.

@lu4p improved the detection of types used with reflection to track make calls too, fixing more cannot use T1 as T2 errors when obfuscating types. See #690.

@pagran added a trash block generator to the control flow obfuscator. See #825.

A number of bugfixes are also included:

• Avoid an error when building for GOOS=ios - #816
• Prevent the shuffle literal obfuscation from being optimized away - #819
• Support inline comments in assembly #include lines - #812

v0.11.0

This release drops support for Go 1.20, continues support for Go 1.21, and adds initial support for the upcoming Go 1.22.

@lu4p and @mvdan improved the code using SSA to detect which types are used with reflection, which should fix a number of errors such as cannot use T1 as T2 or cannot convert T1 to T2. See: #685, #763, #782, #785, #807.

@pagran added experimental support for control flow obfuscation, which should provide stronger obfuscation of function bodies when enabled. See the documentation at docs/CONTROLFLOW.md. See #462.

A number of bugfixes are also included:

• Avoid panicking on a struct embedding a builtin alias - #798
• Strip struct field tags when hashing struct types for type identity - #801

v0.10.1

This bugfix release continues support for Go 1.20 and the upcoming 1.21, and features:

• Avoid obfuscating local types used for reflection, like in go-spew - #765