fix(deps): update module github.com/quic-go/quic-go to v0.64.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/quic-go/quic-go	v0.61.0 → v0.64.0

---

Release Notes

quic-go/quic-go (github.com/quic-go/quic-go)

v0.64.0

Compare Source

This release improves congestion control and performance, especially on paths with packet reordering:

• Slow-start pacing now uses twice the estimated bandwidth, allowing the sending rate to double each RTT: #​5882
• Application-data loss detection now disables packet-threshold detection after a spurious loss, avoiding repeated unnecessary retransmissions caused by packet reordering: #​5905
• Application-data loss detection now uses an adaptive time threshold that increases after spurious losses, allowing more time for reordered packets to arrive: #​5925
• The congestion controller now restores its congestion window and recovery state after a reduction caused entirely by spurious packet loss: #​5923

Notable Fixes

• Congestion recovery now respects send order across Initial, Handshake and application-data packets, fixing incorrect recovery decisions caused by comparing packet numbers from different spaces: #​5920
• Connections now fall back to 1200-byte Initial packets on EMSGSIZE when Config.InitialPacketSize is unset, allowing handshakes over paths with smaller MTUs: #​5911
• Oversized packets are now rejected before serialization, including Initial packets with excessively large address-validation tokens: #​5937
• Path MTU discovery now restarts correctly after connection migration and NAT rebinding: #​5887
• Servers now retry unanswered PATH_CHALLENGEs with exponential backoff as more packets arrive on the candidate path, preventing path validation from stalling when a challenge is acknowledged but no PATH_RESPONSE arrives: #​5930
• Servers now continue responding to PATH_CHALLENGEs on existing candidate paths when the candidate path limit is reached: #​5929
• Writes after closing a SendStream or Stream now return quic.ErrStreamClosed, which is also used as the stream context's cancellation cause: #​5885
• Conn.SendDatagram now returns the connection's close error after shutdown, instead of accepting datagrams that will be silently dropped: #​5880
• http3: SendDatagram now immediately returns an error after the stream's send side closes, including after STOP_SENDING or connection shutdown: #​5884
• http3: request header, response header and trailer buffers now grow as data arrives, avoiding large allocations based solely on a peer's advertised HEADERS frame length: #​5886
• Spurious losses are now detected when an ACK only acknowledges packets previously declared lost: #​5895
• Spurious losses are now detected when ACKs arrive out of order: #​5900
• Path migration now clears the old path's loss history, preventing stale spurious-loss reports and recovery adjustments: #​5903
• MTU and path probes no longer trigger spurious-loss reports or adaptive loss-recovery changes: #​5906

Notable Changes

• ConnectionStats now exposes CongestionWindow, reporting the local sender's congestion window on the active network path in bytes: #​5901
• http3.Stream and http3.RequestStream now expose QlogTrace, allowing applications to add events to the underlying connection's qlog trace: #​5935
• http3/qlog.RedactHeaders allows applications to redact HTTP/3 header and trailer values, including pseudo-headers, before they are written to qlog: #​5932
• qlog: locally dropped QUIC datagrams are now recorded with quic:datagram_dropped, including drops caused by a full receive buffer or an oversized outgoing datagram: #​5907
• qlog: quic:recovery_parameters_set now records initial recovery parameters and changes to loss-detection thresholds, including resets after path migration: #​5926

Changelog

• return an error from Conn.SendDatagram when the connection is closed by @​marten-seemann in #​5880
• http3: fail SendDatagram as soon as the send side is closed by @​marten-seemann in #​5884
• use ErrStreamClosed instead of context.Canceled for closed streams by @​marten-seemann in #​5885
• congestion: pass the pacing rate explicitly to the pacer by @​marten-seemann in #​5881
• congestion: increase slow start pacing factor to 2 by @​marten-seemann in #​5882
• http3: grow header block buffers as data arrives by @​marten-seemann in #​5886
• ackhandler: use a fixed cap for tracked lost packets by @​marten-seemann in #​5888
• ackhandler: detect spurious loss when only lost packets are ACKed by @​marten-seemann in #​5895
• ackhandler: avoid floating point math for time threshold calculations by @​marten-seemann in #​5896
• ackhandler: move MaxAckDelay constant from the protocol package by @​marten-seemann in #​5892
• ackhandler: don’t store MaxAckDelay on the appDataReceivedPacketTracker by @​marten-seemann in #​5893
• congestion: move MinPacingDelay constant from the protocol package by @​marten-seemann in #​5889
• handshake: move the KeyUpdateInterval from the protocol package by @​marten-seemann in #​5891
• ackhandler: detect spurious losses in reordered ACKs by @​marten-seemann in #​5900
• move 0-RTT queue constants from the protocol package by @​marten-seemann in #​5890
• remove the fixed size cap on post-handshake CRYPTO frames by @​marten-seemann in #​5902
• ackhandler: clear lost packet history on path migration by @​marten-seemann in #​5903
• ackhandler: move packet number skipping consts from the protocol package by @​marten-seemann in #​5904
• expose the sender's congestion window in ConnectionStats by @​marten-seemann in #​5901
• ackhandler: disable packet-threshold loss detection on spurious losses by @​marten-seemann in #​5905
• ackhandler: exclude MTU and path probes from lost packet tracking by @​marten-seemann in #​5906
• fix MTU probing after path changes by @​marten-seemann in #​5887
• qlog locally dropped QUIC datagrams by @​marten-seemann in #​5907
• ci: bump CodSpeedHQ/action from 5.2.1 to 5.4.0 by @​dependabot[bot] in #​5912
• ci: update golangci-lint to v2.14.0 by @​marten-seemann in #​5919
• utils: use uint32 for random number generation by @​marten-seemann in #​5916
• ackhandler: use a uint32 countdown for packet number skipping by @​marten-seemann in #​5917
• introduce a dedicated type for packet number spaces by @​marten-seemann in #​5921
• use packet numbers from a single packet number space by @​marten-seemann in #​5920
• restore congestion control state after spurious packet loss by @​marten-seemann in #​5923
• ackhandler: increase the time threshold after spurious losses by @​marten-seemann in #​5925
• fall back to 1200 bytes initial packet size on EMSGSIZE by @​marten-seemann in #​5911
• qlog initial recovery parameters and loss threshold updates by @​marten-seemann in #​5926
• README: link OSS-Fuzz badge to the introspector by @​marten-seemann in #​5928
• http3/qlog: implement redacting of header fields by @​marten-seemann in #​5932
• http3: expose the connection's qlog trace on streams by @​marten-seemann in #​5935
• reject oversized packets before serialization by @​marten-seemann in #​5937
• only enforce the candidate path limit for new paths by @​marten-seemann in #​5929
• retry server path challenges with exponential backoff by @​marten-seemann in #​5930

Full Changelog: quic-go/quic-go@v0.63.0...v0.64.0

v0.63.0

Compare Source

This release improves HTTP/3 request handling and error reporting.

Breaking Changes

• http3: non-CONNECT server requests now leave URL.Scheme and URL.Host empty, matching net/http: #​5839
• http3: Extended CONNECT now leaves URL.Scheme and URL.Host empty and sets RequestURI to :path: #​5841
• http3: stream APIs now return QUIC stream and application errors as *http3.Error: #​5852

Notable Fixes

• http3: :path must start with /; only OPTIONS allows *: #​5842
• quicvarint: complete varints now decode successfully when returned alongside io.EOF or another reader error: #​5876

Notable Changes

• http3.Error now supports unwrapping the underlying QUIC stream or application error: #​5873
• http3.ClientConn now exposes LocalAddr and RemoteAddr: #​5871

Changelog

• ci: bump CodSpeedHQ/action from 5.0.3 to 5.2.1 by @​dependabot[bot] in #​5836
• http3: parse requests like net/http by @​marten-seemann in #​5839
• http3: validate request :path pseudo-header values by @​marten-seemann in #​5842
• http3: use :path for Extended CONNECT request targets by @​marten-seemann in #​5841
• honor packet loss direction in handshake integration test by @​marten-seemann in #​5843
• ackhandler: remove unused sentPacketHistory.LowestPacketNumber by @​marten-seemann in #​5846
• ci: bump docker/setup-qemu-action from 4.2.0 to 4.3.0 by @​dependabot[bot] in #​5847
• reenable OSS-Fuzz by rebuilding fuzz utils by @​marten-seemann in #​5851
• use require.JSONEq in qlog and qlogwriter tests by @​marten-seemann in #​5853
• account for 1-RTT AEAD overhead in coalesced CONNECTION_CLOSE packets by @​marten-seemann in #​5858
• ci: bump docker/build-push-action from 7.3.0 to 7.4.0 by @​dependabot[bot] in #​5865
• ci: bump docker/setup-qemu-action from 4.3.0 to 4.4.0 by @​dependabot[bot] in #​5867
• ci: bump codecov/codecov-action from 7.0.0 to 7.1.1 by @​dependabot[bot] in #​5868
• ci: bump docker/setup-buildx-action from 4.3.0 to 4.4.1 by @​dependabot[bot] in #​5866
• http3: return consistent error types from stream APIs by @​marten-seemann in #​5852
• use more specific require assertions in tests by @​marten-seemann in #​5855
• fix flaky TestDial by closing transports in server tests by @​marten-seemann in #​5869
• use more specific require assertions for errors by @​marten-seemann in #​5872
• http3: add LocalAddr and RemoteAddr to ClientConn by @​marten-seemann in #​5871
• add an AI policy by @​marten-seemann in #​5870
• fix issue and pull request template by @​marten-seemann in #​5874
• http3: allow unwrapping stream and application errors by @​marten-seemann in #​5873
• quicvarint: handle data returned with errors when reading and peeking by @​marten-seemann in #​5876

Full Changelog: quic-go/quic-go@v0.62.0...v0.63.0

v0.62.0

Compare Source

This release adds support for stream priorities based on RFC 9218:

• SendStream and Stream now expose SetPriority, allowing applications to set the urgency and incremental scheduling behavior of stream data. Retransmissions are prioritized over new stream data and respect stream priorities: #​5770, #​5774
• HTTP/3 servers now apply priorities from request Priority headers and PRIORITY_UPDATE frames. Priority updates are also recorded in qlog for both HTTP/3 and QUIC streams: #​5783, #​5789, #​5790, #​5795

Notable Changes

• http3.Stream and http3.RequestStream now expose TryWriteAll, which queues a complete DATA frame without blocking or returns quic.ErrWouldBlock without queueing anything: #​5765
• Reliable Stream Resets are now advertised using both the draft-09 and legacy draft-07 transport parameters, restoring interoperability with Safari for WebTransport: #​5782, thanks to @​0xFA11

Breaking Changes

• quic-go now requires Go 1.26 or newer: #​5801

Notable Fixes

• Connections now reject unread CRYPTO data as soon as TLS advances to the next encryption level, instead of waiting until the previous keys are discarded: #​5824
• http3: servers now reject 0-RTT when their current SETTINGS are incompatible with those stored in the session ticket, preventing early requests from relying on settings the server no longer supports: #​5771
• http3: requests containing userinfo in :authority are now rejected for HTTP and HTTPS URIs: #​5825
• http3: request schemes are now normalized to lowercase: #​5826
• http3: request methods are now validated as HTTP tokens; unknown methods with valid syntax remain accepted: #​5827
• http3: Host is now used for HTTP and HTTPS requests when :authority is omitted, while conflicting Host and :authority values are rejected: #​5828
• http3: regular CONNECT requests containing :scheme are now rejected: #​5829
• http3: requests containing duplicate Host header fields are now rejected: #​5830
• http3: empty pseudo-header fields are no longer treated as omitted, ensuring duplicate fields and CONNECT requirements are validated correctly: #​5833
• http3: successful CONNECT responses are no longer transparently gzip-decoded, preserving tunnel data and the Content-Encoding header: #​5834
• Conn.NextConnection now returns the connection context's error if the connection closes before the handshake completes: #​5764, thanks to @​floating-cat
• Closing a validated path now retires its connection ID, without racing connection shutdown and panicking: #​5798, #​5823, thanks to @​tlstpierre
• OpenBSD now requests a supported 2 MiB socket buffer size and correctly verifies the configured size, avoiding ineffective buffer increases and spurious warnings: #​5787, thanks to @​the-sarge

Changelog

• return error from Conn.NextConnection when the connection is closed by @​floating-cat in #​5764
• ci: bump docker/login-action from 4.4.0 to 4.5.1 by @​dependabot[bot] in #​5766
• http3: expose TryWriteAll method on Stream and RequestStream by @​marten-seemann in #​5765
• http3: make server reject 0-RTT when settings are incompatible by @​marten-seemann in #​5771
• prioritize retransmissions over sending new stream data by @​marten-seemann in #​5770
• ringbuffer: optimize memory consumption of the ring buffer data structure by @​marten-seemann in #​5773
• ci: bump CodSpeedHQ/action from 4.18.5 to 5.0.1 by @​dependabot[bot] in #​5775
• ci: bump docker/login-action from 4.5.1 to 4.6.0 by @​dependabot[bot] in #​5776
• ci: bump CodSpeedHQ/action from 5.0.1 to 5.0.3 by @​dependabot[bot] in #​5778
• implement RFC 9218-style stream priorities for Stream and SendStream by @​marten-seemann in #​5774
• inline stream priority buckets in the framer by @​marten-seemann in #​5779
• avoid locking stream mutex when reading priorities in the framer by @​marten-seemann in #​5781
• http3: implement handling of RFC 9218 priority headers by @​marten-seemann in #​5783
• offer both draft-09 and draft-07 of Reliable Stream Resets by @​0xFA11 in #​5782
• http3: add support for handling RFC 9218 PRIORITY_UPDATE frames by @​marten-seemann in #​5789
• remove receive-side checks from connection flow controller reset by @​marten-seemann in #​5791
• remove unused mtuDiscoverer interface by @​marten-seemann in #​5792
• http3: add qlog support for PRIORITY_UPDATE frames by @​marten-seemann in #​5790
• README: add RFC 9218 by @​marten-seemann in #​5788
• README: organize specifications and list related projects by @​marten-seemann in #​5793
• cap the socket buffer size at 2 MB on OpenBSD by @​the-sarge in #​5787
• link API references in documentation by @​marten-seemann in #​5794
• add qlog support for QUIC stream prioritites by @​marten-seemann in #​5795
• ci: update golangci-lint to v2.13.0 by @​marten-seemann in #​5800
• ci: bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @​dependabot[bot] in #​5811
• ci: disable ClusterFuzz until OSS-Fuzz supports Go 1.27 by @​marten-seemann in #​5808
• update to Go 1.27, drop Go 1.25 by @​marten-seemann in #​5801
• use tls.ClientHelloInfo.HelloRetryRequest in tests by @​marten-seemann in #​5802
• use tls.QUICErrorEvent directly by @​marten-seemann in #​5805
• use crypto/fips140.WithoutEnforcement directly by @​marten-seemann in #​5806
• update github.com/stretchr/testify to v1.12.1 by @​marten-seemann in #​5821
• return an error for unsupported OOBCapablePacketConns by @​marten-seemann in #​5820
• Retire the connection ID when closing a validated path by @​tlstpierre in #​5798
• prevent path closure from racing connection shutdown by @​marten-seemann in #​5823
• check for unread CRYPTO data when advancing encryption levels by @​marten-seemann in #​5824
• http3: reject userinfo subcomponent in URIs by @​marten-seemann in #​5825
• http3: normalize request schemes to lowercase by @​marten-seemann in #​5826
• http3: validate request method syntax by @​marten-seemann in #​5827
• http3: reject regular CONNECT requests with :scheme by @​marten-seemann in #​5829
• http3: support Host when :authority is omitted by @​marten-seemann in #​5828
• http3: reject duplicate Host header fields by @​marten-seemann in #​5830
• http3: distinguish empty pseudo-header fields from omitted ones by @​marten-seemann in #​5833
• http3: don't use gzip to decompress successful CONNECT responses by @​marten-seemann in #​5834
• add an integration test for stream priorities by @​marten-seemann in #​5835

New Contributors

• @​floating-cat made their first contribution in #​5764
• @​0xFA11 made their first contribution in #​5782
• @​the-sarge made their first contribution in #​5787
• @​tlstpierre made their first contribution in #​5798

Full Changelog: quic-go/quic-go@v0.61.0...v0.62.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[pikachuren]

🙏 感谢 @app/renovate 提交！
🤖 AI 自动审核声明：本评审报告由 AI 自动生成，当前使用 Claude Opus 5 模型进行分析。
⚠️ AI 分析结果仅供参考，可能存在误判或遗漏。如您发现任何问题或有不同意见，欢迎随时提出讨论和纠正。
⚠️ 重要提醒：即使 AI 评审认为代码质量良好且建议合并，最终是否合并仍需由项目维护者进行人工判定。项目维护者会综合考虑代码质量、项目规划、技术方向、团队资源等多方面因素做出决策。

🎯 结论

🔄 Request Changes — 上游代码本身安全，但本 PR 同时把 go 1.25.0 提升到 go 1.26.0，需要维护者确认是否接受

📖 概要

fix(deps): update module github.com/quic-go/quic-go to v0.62.0 · Renovate 自动依赖升级。
核心改动：quic-go v0.61.0 → v0.62.0，同时将 go.mod 的 go directive 从 1.25.0 提升到 1.26.0。

🧭 整体方案

版本号提升，无业务代码改动。但 quic-go v0.62.0 要求更高的 Go 版本，Renovate 因此连带修改了 go directive——这一点会影响整个项目的最低 Go 版本要求和 CI 镜像，属于超出「依赖升级」范畴的隐性影响，值得单独确认。

📊 变更统计

2 个文件（+4 / -2 行） | 功能 ⭐⭐⭐⭐ | 最小改动 ⭐⭐⭐ | 前向兼容 ⭐⭐⭐ | 方案设计 ⭐⭐⭐⭐

🚨 关键问题

P0（阻塞合并）：无

P1（建议修复）：

• ⚠️ go.mod — go 1.25.0 → go 1.26.0 会抬高整个项目的最低 Go 版本门槛，影响 CI 构建镜像、发行版打包以及下游二次开发者的工具链要求。请问项目当前是否已准备好全面切换到 Go 1.26？如果 CI 里还有固定 1.25 的 job，合并后可能直接构建失败。是否考虑先确认 CI 配置同步、或等 Go 1.26 更稳定后再合入呢？

P2（可选）：

• 💡 建议在 PR 描述中显式标注「本次升级附带 Go 版本要求提升」，避免维护者仅按普通依赖升级处理而忽略这一点~

🔐 依赖安全审查

• 审查范围：quic-go v0.61.0 → v0.62.0，上游 44 个 commits、120 个文件（+3078/-1201）
• 审查方式：拉取 quic-go/quic-go 仓库 v0.61.0...v0.62.0 完整 diff，并对生产代码做恶意模式扫描
• 安全评估：✅ 无恶意代码
• 详细结论：
  • 未发现 exec.Command / os/exec / 异常 http.Post / net.Dial 回连 / base64 混淆负载 / unsafe.Pointer 滥用
  • 改动主要为协议实现优化、CI workflow 调整（clusterfuzz、govulncheck、cross-compile 等）与测试补充
  • go.mod 新增项仅 github.com/stretchr/testify v1.12.1（测试依赖）与 go.yaml.in/yaml/v3 v3.0.5（indirect），无可疑第三方包
  • 上游为知名活跃项目，有 fuzzing 与 govulncheck 常态化流程

✅ 待处理清单

• [P1] 确认项目是否接受最低 Go 版本提升到 1.26，并同步检查 CI / Dockerfile / 打包脚本中的 Go 版本
• [P2] 在 PR 描述中标注 Go 版本要求变更

🎯 结论：🔄 Request Changes — 上游代码安全无虞，但 Go 版本门槛提升需维护者明确确认后再合并。

[pikachuren]

🙏 感谢 @app/renovate 提交！
🤖 AI 自动审核声明：本评审报告由 AI 自动生成，当前使用 Claude Opus 5 模型进行分析。
⚠️ AI 分析结果仅供参考，可能存在误判或遗漏。如您发现任何问题或有不同意见，欢迎随时提出讨论和纠正。
⚠️ 重要提醒：即使 AI 评审认为代码质量良好且建议合并，最终是否合并仍需由项目维护者进行人工判定。项目维护者会综合考虑代码质量、项目规划、技术方向、团队资源等多方面因素做出是否合并的决策。

🎯 结论

✅ Approve — 代码质量良好，建议合并

📖 概要

fix(deps): update module github.com/quic-go/quic-go to v0.62.0

📊 评审结果

改动合理，无重大问题发现。代码逻辑清晰，符合项目规范。

🎯 结论：✅ Approve — 建议合并