Skip to content

chore(deps): bump github.com/quic-go/quic-go from 0.61.0 to 0.62.0 - #1174

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/quic-go/quic-go-0.62.0
Closed

chore(deps): bump github.com/quic-go/quic-go from 0.61.0 to 0.62.0#1174
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/quic-go/quic-go-0.62.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps github.com/quic-go/quic-go from 0.61.0 to 0.62.0.

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.62.0

This release adds support for stream priorities based on RFC 9218:

  • SendStream and Stream now expose SetPriority, allowing applications to set the urgency and incremental scheduling behavior of stream data. Retransmissions are prioritized over new stream data and respect stream priorities: #5770, #5774
  • HTTP/3 servers now apply priorities from request Priority headers and PRIORITY_UPDATE frames. Priority updates are also recorded in qlog for both HTTP/3 and QUIC streams: #5783, #5789, #5790, #5795

Notable Changes

  • http3.Stream and http3.RequestStream now expose TryWriteAll, which queues a complete DATA frame without blocking or returns quic.ErrWouldBlock without queueing anything: #5765
  • Reliable Stream Resets are now advertised using both the draft-09 and legacy draft-07 transport parameters, restoring interoperability with Safari for WebTransport: #5782, thanks to @​0xFA11

Breaking Changes

  • quic-go now requires Go 1.26 or newer: #5801

Notable Fixes

  • Connections now reject unread CRYPTO data as soon as TLS advances to the next encryption level, instead of waiting until the previous keys are discarded: #5824
  • http3: servers now reject 0-RTT when their current SETTINGS are incompatible with those stored in the session ticket, preventing early requests from relying on settings the server no longer supports: #5771
  • http3: requests containing userinfo in :authority are now rejected for HTTP and HTTPS URIs: #5825
  • http3: request schemes are now normalized to lowercase: #5826
  • http3: request methods are now validated as HTTP tokens; unknown methods with valid syntax remain accepted: #5827
  • http3: Host is now used for HTTP and HTTPS requests when :authority is omitted, while conflicting Host and :authority values are rejected: #5828
  • http3: regular CONNECT requests containing :scheme are now rejected: #5829
  • http3: requests containing duplicate Host header fields are now rejected: #5830
  • http3: empty pseudo-header fields are no longer treated as omitted, ensuring duplicate fields and CONNECT requirements are validated correctly: #5833
  • http3: successful CONNECT responses are no longer transparently gzip-decoded, preserving tunnel data and the Content-Encoding header: #5834
  • Conn.NextConnection now returns the connection context's error if the connection closes before the handshake completes: #5764, thanks to @​floating-cat
  • Closing a validated path now retires its connection ID, without racing connection shutdown and panicking: #5798, #5823, thanks to @​tlstpierre
  • OpenBSD now requests a supported 2 MiB socket buffer size and correctly verifies the configured size, avoiding ineffective buffer increases and spurious warnings: #5787, thanks to @​the-sarge

Changelog

... (truncated)

Commits
  • 793f74d add an integration test for stream priorities (#5835)
  • eb1fe05 http3: don't use gzip to decompress successful CONNECT responses (#5834)
  • 1e19960 http3: distinguish empty pseudo-header fields from omitted ones (#5833)
  • 1818db9 http3: reject duplicate Host header fields (#5830)
  • 74b7cb7 http3: support Host when :authority is omitted (#5828)
  • 4aac58a http3: reject regular CONNECT requests with :scheme (#5829)
  • a2aaf58 http3: validate request method syntax (#5827)
  • cb8e1ec http3: normalize request schemes to lowercase (#5826)
  • 148fd03 http3: reject userinfo subcomponent in URIs (#5825)
  • 1d6a463 check for unread CRYPTO data when advancing encryption levels (#5824)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps): bump github.com/quic-go/quic-go from 0.61.0 to 0.62.0
3aea2e7 
Bumps [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) from 0.61.0 to 0.62.0.
- [Release notes](https://github.com/quic-go/quic-go/releases)
- [Commits](quic-go/quic-go@v0.61.0...v0.62.0)

---
updated-dependencies:
- dependency-name: github.com/quic-go/quic-go
  dependency-version: 0.62.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 2, 2026
@dependabot
dependabot Bot requested a review from ryanfowler as a code owner September 2, 2026 13:03
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 2, 2026
@ryanfowler

ryanfowler commented Sep 3, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@ryanfowler
ryanfowler enabled auto-merge September 3, 2026 00:33
@dependabot @github

dependabot Bot commented on behalf of github Sep 3, 2026

Copy link
Copy Markdown
Contributor Author

Looks like github.com/quic-go/quic-go is up-to-date now, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 3, 2026
auto-merge was automatically disabled September 3, 2026 00:34

Pull request was closed

@dependabot
dependabot Bot deleted the dependabot/go_modules/github.com/quic-go/quic-go-0.62.0 branch September 3, 2026 00:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ryanfowler ryanfowler ryanfowler approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ryanfowler