Skip to content

Bump github.com/quic-go/quic-go from 0.61.0 to 0.62.0 - #3332

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/github.com/quic-go/quic-go-0.62.0
Open

Bump github.com/quic-go/quic-go from 0.61.0 to 0.62.0#3332
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/github.com/quic-go/quic-go-0.62.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 3, 2026

Copy link
Copy Markdown
Contributor

Bumps github.com/quic-go/quic-go from 0.61.0 to 0.62.0.

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.62.0

This release adds support for stream priorities based on RFC 9218:

  • SendStream and Stream now expose SetPriority, allowing applications to set the urgency and incremental scheduling behavior of stream data. Retransmissions are prioritized over new stream data and respect stream priorities: #5770, #5774
  • HTTP/3 servers now apply priorities from request Priority headers and PRIORITY_UPDATE frames. Priority updates are also recorded in qlog for both HTTP/3 and QUIC streams: #5783, #5789, #5790, #5795

Notable Changes

  • http3.Stream and http3.RequestStream now expose TryWriteAll, which queues a complete DATA frame without blocking or returns quic.ErrWouldBlock without queueing anything: #5765
  • Reliable Stream Resets are now advertised using both the draft-09 and legacy draft-07 transport parameters, restoring interoperability with Safari for WebTransport: #5782, thanks to @​0xFA11

Breaking Changes

  • quic-go now requires Go 1.26 or newer: #5801

Notable Fixes

  • Connections now reject unread CRYPTO data as soon as TLS advances to the next encryption level, instead of waiting until the previous keys are discarded: #5824
  • http3: servers now reject 0-RTT when their current SETTINGS are incompatible with those stored in the session ticket, preventing early requests from relying on settings the server no longer supports: #5771
  • http3: requests containing userinfo in :authority are now rejected for HTTP and HTTPS URIs: #5825
  • http3: request schemes are now normalized to lowercase: #5826
  • http3: request methods are now validated as HTTP tokens; unknown methods with valid syntax remain accepted: #5827
  • http3: Host is now used for HTTP and HTTPS requests when :authority is omitted, while conflicting Host and :authority values are rejected: #5828
  • http3: regular CONNECT requests containing :scheme are now rejected: #5829
  • http3: requests containing duplicate Host header fields are now rejected: #5830
  • http3: empty pseudo-header fields are no longer treated as omitted, ensuring duplicate fields and CONNECT requirements are validated correctly: #5833
  • http3: successful CONNECT responses are no longer transparently gzip-decoded, preserving tunnel data and the Content-Encoding header: #5834
  • Conn.NextConnection now returns the connection context's error if the connection closes before the handshake completes: #5764, thanks to @​floating-cat
  • Closing a validated path now retires its connection ID, without racing connection shutdown and panicking: #5798, #5823, thanks to @​tlstpierre
  • OpenBSD now requests a supported 2 MiB socket buffer size and correctly verifies the configured size, avoiding ineffective buffer increases and spurious warnings: #5787, thanks to @​the-sarge

Changelog

... (truncated)

Commits
  • 793f74d add an integration test for stream priorities (#5835)
  • eb1fe05 http3: don't use gzip to decompress successful CONNECT responses (#5834)
  • 1e19960 http3: distinguish empty pseudo-header fields from omitted ones (#5833)
  • 1818db9 http3: reject duplicate Host header fields (#5830)
  • 74b7cb7 http3: support Host when :authority is omitted (#5828)
  • 4aac58a http3: reject regular CONNECT requests with :scheme (#5829)
  • a2aaf58 http3: validate request method syntax (#5827)
  • cb8e1ec http3: normalize request schemes to lowercase (#5826)
  • 148fd03 http3: reject userinfo subcomponent in URIs (#5825)
  • 1d6a463 check for unread CRYPTO data when advancing encryption levels (#5824)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) from 0.61.0 to 0.62.0.
- [Release notes](https://github.com/quic-go/quic-go/releases)
- [Commits](quic-go/quic-go@v0.61.0...v0.62.0)

---
updated-dependencies:
- dependency-name: github.com/quic-go/quic-go
  dependency-version: 0.62.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Sep 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants