Skip to content

Update module github.com/quic-go/quic-go to v0.62.0 - #123

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-quic-go-quic-go-0.x
Open

Update module github.com/quic-go/quic-go to v0.62.0#123
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-quic-go-quic-go-0.x

Conversation

@renovate

@renovate renovate Bot commented Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
github.com/quic-go/quic-go v0.59.1 → v0.62.0 age confidence

Release Notes

quic-go/quic-go (github.com/quic-go/quic-go)

v0.62.0

Compare Source

This release adds support for stream priorities based on RFC 9218:

  • SendStream and Stream now expose SetPriority, allowing applications to set the urgency and incremental scheduling behavior of stream data. Retransmissions are prioritized over new stream data and respect stream priorities: #​5770, #​5774
  • HTTP/3 servers now apply priorities from request Priority headers and PRIORITY_UPDATE frames. Priority updates are also recorded in qlog for both HTTP/3 and QUIC streams: #​5783, #​5789, #​5790, #​5795

Notable Changes

  • http3.Stream and http3.RequestStream now expose TryWriteAll, which queues a complete DATA frame without blocking or returns quic.ErrWouldBlock without queueing anything: #​5765
  • Reliable Stream Resets are now advertised using both the draft-09 and legacy draft-07 transport parameters, restoring interoperability with Safari for WebTransport: #​5782, thanks to @​0xFA11

Breaking Changes

  • quic-go now requires Go 1.26 or newer: #​5801

Notable Fixes

  • Connections now reject unread CRYPTO data as soon as TLS advances to the next encryption level, instead of waiting until the previous keys are discarded: #​5824
  • http3: servers now reject 0-RTT when their current SETTINGS are incompatible with those stored in the session ticket, preventing early requests from relying on settings the server no longer supports: #​5771
  • http3: requests containing userinfo in :authority are now rejected for HTTP and HTTPS URIs: #​5825
  • http3: request schemes are now normalized to lowercase: #​5826
  • http3: request methods are now validated as HTTP tokens; unknown methods with valid syntax remain accepted: #​5827
  • http3: Host is now used for HTTP and HTTPS requests when :authority is omitted, while conflicting Host and :authority values are rejected: #​5828
  • http3: regular CONNECT requests containing :scheme are now rejected: #​5829
  • http3: requests containing duplicate Host header fields are now rejected: #​5830
  • http3: empty pseudo-header fields are no longer treated as omitted, ensuring duplicate fields and CONNECT requirements are validated correctly: #​5833
  • http3: successful CONNECT responses are no longer transparently gzip-decoded, preserving tunnel data and the Content-Encoding header: #​5834
  • Conn.NextConnection now returns the connection context's error if the connection closes before the handshake completes: #​5764, thanks to @​floating-cat
  • Closing a validated path now retires its connection ID, without racing connection shutdown and panicking: #​5798, #​5823, thanks to @​tlstpierre
  • OpenBSD now requests a supported 2 MiB socket buffer size and correctly verifies the configured size, avoiding ineffective buffer increases and spurious warnings: #​5787, thanks to @​the-sarge

Changelog

New Contributors

Full Changelog: quic-go/quic-go@v0.61.0...v0.62.0

v0.61.0

Compare Source

This release adds new stream APIs intended for application protocols that perform their own flow-control accounting, such as WebTransport:

  • SendStream and Stream now expose TryWriteAll, which queues an entire buffer without blocking or returns ErrWouldBlock without queueing anything: #​5704
  • SendStream and Stream now expose WriteWithLimit, allowing higher-level protocols to apply an additional send limit while data is packetized: #​5753
  • ReceiveStream and Stream now expose SetReceiveFinalSizeCallback, which reports the final receive-side stream size once it is learned from a FIN or RESET_STREAM frame: #​5752

Support for the RESET_STREAM_AT extension was updated to draft-09, while retaining support for the draft-07 codepoint for backwards compatibility: #​5724

Breaking Changes

  • http3: ParseCapsule was replaced by the stateful CapsuleParser and CapsuleReader APIs. Each capsule payload must now be consumed or discarded before advancing to the next capsule: #​5729
  • The StreamID.Type and StreamID.InitiatedBy methods were removed because they exposed internal types: #​5744
  • qlog: datagram IDs were replaced by CRC32c payload checksums. The JSON field is now datagram_payload_checksum instead of datagram_id, and the corresponding exported qlog types were renamed: #​5758

Notable Fixes

  • Transport parameter parsing is around 27% faster and now reliably rejects duplicate transport parameters: #​5712
  • Session tickets containing unknown transport parameters are now rejected during restoration, preventing 0-RTT resumption when an endpoint no longer understands an extension recorded in the ticket: #​5714
  • RESET_STREAM_AT negotiation is now applied correctly to streams opened before transport parameters are received during 0-RTT: #​5715
  • RESET_STREAM_AT support is now cleared after 0-RTT rejection, preventing new streams from inheriting the rejected connection's setting: #​5716
  • Pending stream control frames from a rejected 0-RTT attempt are now discarded instead of being sent after rejection: #​5717
  • Remembered RESET_STREAM_AT support is now validated across 0-RTT resumption: #​5722
  • http3: receiving a GOAWAY now unblocks pending OpenStreamSync calls and prevents new request streams from being opened: #​5730
  • http3: invalid header values are no longer included in validation errors, avoiding accidental exposure of sensitive values when errors are logged: #​5742

Changelog

Full Changelog: quic-go/quic-go@v0.60.0...v0.61.0

v0.60.0

Compare Source

Starting with v0.60.0, quic-go is ready for use in FIPS 140-3 environments when built with Go 1.26 or newer and used with the Go Cryptographic Module. See FIPS140.md for details.

This required a number of changes:

  • switch QUIC HKDF usage to the standard library crypto/hkdf: #​5461
  • use the Go standard library's TLS 1.3 AES-GCM implementation for QUIC packet protection AEADs: #​5624
  • use cipher.NewGCMWithRandomNonce for address validation token encryption: #​5625
  • disable FIPS 140-3 enforcement for the Retry packet integrity tag, which is outside the FIPS 140-3 scope: #​5630
  • disable FIPS 140-3 enforcement for Initial packet protection, whose secrets are derived from public RFC constants: #​5640
  • guard the internal ChaCha20-Poly1305 code path so it is not used in FIPS 140-3 mode: #​5633
  • add FIPS / non-FIPS data transfer integration tests, including Retry and key updates: #​5646

Breaking Changes

  • quic-go now requires Go 1.25 or newer: #​5561

Notable Fixes

  • path probe packets now correctly pass the OOB data (needed to select the correct network interface in some system configurations): #​5544, thanks to @​on-keyday
  • cancel the Stream and SendStream context when the connection is closed: #​5556, thanks to @​zvdy
  • http3: validate Extended CONNECT ``:protocol` pseudo-header values according to HTTP token syntax: #​5639
  • http3: always set http.Request.Scheme and http.Request.Host: #​5554, thanks to @​qiulaidongfeng
  • http3: fixed a nil pointer dereference when Server.Logger is unset: #​5671
  • fix maximum datagram size estimation after MTU discovery: #​5650, thanks to @​jinq0123
  • OpenStreamSync now reliably returns the context error when the context is cancelled: #​5660

Behind the scenes

In the last couple of months, we have reworked our fuzz setup and the integration into OSS-Fuzz: First of all, all fuzzers were rewritten to Go native fuzzing (#​5592, #​5599, #​5600, #​5603, #​5613). We also added new fuzzers for the HTTP/3 frame parser (#​5595), HTTP/3 request, response and trailer decoding (#​5602) and the STREAM / CRYPTO frame sorter (#​5620).

Since native Go fuzzing uses a different seed corpus format, we now use the newly implemented go-ossfuzz-seeds library to generate OSS-Fuzz compatible seed corpus files from f.Add calls.

We also enable ClusterFuzzLite batch fuzzing (#​5605), including. a seed corpus (#​5607). Fuzz coverage for both ClusterFuzzLite batch fuzzing (#​5641) and for OSS-Fuzz fuzzing (#​5655) is now submitted to Codecov.

Changelog

New Contributors

Full Changelog: quic-go/quic-go@v0.59.0...v0.60.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.24.0 -> 1.26.0
golang.org/x/crypto v0.41.0 -> v0.54.0
golang.org/x/net v0.43.0 -> v0.56.0
golang.org/x/sys v0.41.0 -> v0.47.0

@codecov

codecov Bot commented Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 51.03%. Comparing base (55ca5d9) to head (bf0e99e).

Additional details and impacted files 
@@           Coverage Diff           @@
##             main     #123   +/-   ##
=======================================
  Coverage   51.03%   51.03%           
=======================================
  Files          11       11           
  Lines         337      337           
=======================================
  Hits          172      172           
  Misses        147      147           
  Partials       18       18
Flag Coverage Δ
go 51.03% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@renovate
renovate Bot force-pushed the renovate/github.com-quic-go-quic-go-0.x branch from f458b01 to f2b1172 Compare July 26, 2026 00:24
@renovate
renovate Bot force-pushed the renovate/github.com-quic-go-quic-go-0.x branch from f2b1172 to b2e0aae Compare August 4, 2026 01:42
@renovate renovate Bot changed the title Update module github.com/quic-go/quic-go to v0.61.0 Update module github.com/quic-go/quic-go to v0.61.0 - autoclosed Aug 9, 2026
@renovate renovate Bot closed this Aug 9, 2026
@renovate
renovate Bot deleted the renovate/github.com-quic-go-quic-go-0.x branch August 9, 2026 08:29
@renovate renovate Bot changed the title Update module github.com/quic-go/quic-go to v0.61.0 - autoclosed Update module github.com/quic-go/quic-go to v0.61.0 Aug 9, 2026
@renovate renovate Bot reopened this Aug 9, 2026
@renovate
renovate Bot force-pushed the renovate/github.com-quic-go-quic-go-0.x branch 2 times, most recently from 8e6c3ee to a835233 Compare August 13, 2026 22:07
@renovate
renovate Bot force-pushed the renovate/github.com-quic-go-quic-go-0.x branch 2 times, most recently from ca39927 to bf0e99e Compare August 19, 2026 22:13
@renovate
renovate Bot force-pushed the renovate/github.com-quic-go-quic-go-0.x branch from bf0e99e to 7aa8284 Compare August 30, 2026 10:08
@renovate renovate Bot changed the title Update module github.com/quic-go/quic-go to v0.61.0 Update module github.com/quic-go/quic-go to v0.62.0 Aug 30, 2026
@renovate
renovate Bot force-pushed the renovate/github.com-quic-go-quic-go-0.x branch from 7aa8284 to 5cb06c5 Compare September 14, 2026 21:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@renovate-approve renovate-approve[bot] renovate-approve[bot] approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants