Skip to content

build(deps): bump the go-deps group with 2 updates - #36

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-deps-47f946497d
Closed

build(deps): bump the go-deps group with 2 updates#36
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-deps-47f946497d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-deps group with 2 updates: github.com/quic-go/quic-go and github.com/quic-go/webtransport-go.

Updates github.com/quic-go/quic-go from 0.61.0 to 0.62.0

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.62.0

This release adds support for stream priorities based on RFC 9218:

  • SendStream and Stream now expose SetPriority, allowing applications to set the urgency and incremental scheduling behavior of stream data. Retransmissions are prioritized over new stream data and respect stream priorities: #5770, #5774
  • HTTP/3 servers now apply priorities from request Priority headers and PRIORITY_UPDATE frames. Priority updates are also recorded in qlog for both HTTP/3 and QUIC streams: #5783, #5789, #5790, #5795

Notable Changes

  • http3.Stream and http3.RequestStream now expose TryWriteAll, which queues a complete DATA frame without blocking or returns quic.ErrWouldBlock without queueing anything: #5765
  • Reliable Stream Resets are now advertised using both the draft-09 and legacy draft-07 transport parameters, restoring interoperability with Safari for WebTransport: #5782, thanks to @​0xFA11

Breaking Changes

  • quic-go now requires Go 1.26 or newer: #5801

Notable Fixes

  • Connections now reject unread CRYPTO data as soon as TLS advances to the next encryption level, instead of waiting until the previous keys are discarded: #5824
  • http3: servers now reject 0-RTT when their current SETTINGS are incompatible with those stored in the session ticket, preventing early requests from relying on settings the server no longer supports: #5771
  • http3: requests containing userinfo in :authority are now rejected for HTTP and HTTPS URIs: #5825
  • http3: request schemes are now normalized to lowercase: #5826
  • http3: request methods are now validated as HTTP tokens; unknown methods with valid syntax remain accepted: #5827
  • http3: Host is now used for HTTP and HTTPS requests when :authority is omitted, while conflicting Host and :authority values are rejected: #5828
  • http3: regular CONNECT requests containing :scheme are now rejected: #5829
  • http3: requests containing duplicate Host header fields are now rejected: #5830
  • http3: empty pseudo-header fields are no longer treated as omitted, ensuring duplicate fields and CONNECT requirements are validated correctly: #5833
  • http3: successful CONNECT responses are no longer transparently gzip-decoded, preserving tunnel data and the Content-Encoding header: #5834
  • Conn.NextConnection now returns the connection context's error if the connection closes before the handshake completes: #5764, thanks to @​floating-cat
  • Closing a validated path now retires its connection ID, without racing connection shutdown and panicking: #5798, #5823, thanks to @​tlstpierre
  • OpenBSD now requests a supported 2 MiB socket buffer size and correctly verifies the configured size, avoiding ineffective buffer increases and spurious warnings: #5787, thanks to @​the-sarge

Changelog

... (truncated)

Commits
  • 793f74d add an integration test for stream priorities (#5835)
  • eb1fe05 http3: don't use gzip to decompress successful CONNECT responses (#5834)
  • 1e19960 http3: distinguish empty pseudo-header fields from omitted ones (#5833)
  • 1818db9 http3: reject duplicate Host header fields (#5830)
  • 74b7cb7 http3: support Host when :authority is omitted (#5828)
  • 4aac58a http3: reject regular CONNECT requests with :scheme (#5829)
  • a2aaf58 http3: validate request method syntax (#5827)
  • cb8e1ec http3: normalize request schemes to lowercase (#5826)
  • 148fd03 http3: reject userinfo subcomponent in URIs (#5825)
  • 1d6a463 check for unread CRYPTO data when advancing encryption levels (#5824)
  • Additional commits viewable in compare view

Updates github.com/quic-go/webtransport-go from 0.12.0 to 0.13.0

Release notes

Sourced from github.com/quic-go/webtransport-go's releases.

v0.13.0

This release updates quic-go to v0.62.0, and now requires Go 1.26 or newer.

Other Changes

  • WT_CLOSE_SESSION capsules are now queued without blocking on flow control. The complete capsule is queued or the stream is canceled: #362

Changelog

Full Changelog: quic-go/webtransport-go@v0.12.0...v0.13.0

Commits
  • 58c37d9 update quic-go to v0.62.0, use TryWriteAll API to send WT_CLOSE_SESSION (#362)
  • 2238750 update to Go 1.27, drop Go 1.25 (#363)
  • c89ef60 ci: bump browser-actions/setup-chrome from 2.1.2 to 2.2.0 (#360)
  • 6df05d3 update github.com/dunglas/httpsfv to v1.1.1 (#358)
  • 79e2f9d ci: bump docker/setup-buildx-action from 4.2.0 to 4.3.0 (#361)
  • 6b58994 ci: bump docker/login-action from 4.5.1 to 4.6.0 (#357)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go-deps group with 2 updates: [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) and [github.com/quic-go/webtransport-go](https://github.com/quic-go/webtransport-go).


Updates `github.com/quic-go/quic-go` from 0.61.0 to 0.62.0
- [Release notes](https://github.com/quic-go/quic-go/releases)
- [Commits](quic-go/quic-go@v0.61.0...v0.62.0)

Updates `github.com/quic-go/webtransport-go` from 0.12.0 to 0.13.0
- [Release notes](https://github.com/quic-go/webtransport-go/releases)
- [Commits](quic-go/webtransport-go@v0.12.0...v0.13.0)

---
updated-dependencies:
- dependency-name: github.com/quic-go/quic-go
  dependency-version: 0.62.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/quic-go/webtransport-go
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 2, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 4, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 4, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/go-deps-47f946497d branch September 4, 2026 21:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants