go1.16.12 (released 2021-12-09) includes security fixes to the net/http and syscall packages. See the Go 1.16.12 milestone on our issue tracker for details.
I appreciated the reminder to read the bonus terms before opting in; that small step can save a lot of frustration.