Skip to content

fix(deps): update module github.com/quic-go/quic-go to v0.59.0 - autoclosed - #322

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-quic-go-quic-go-0.x
Closed

fix(deps): update module github.com/quic-go/quic-go to v0.59.0 - autoclosed#322
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-quic-go-quic-go-0.x

Conversation

@renovate

@renovate renovate Bot commented Apr 27, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
github.com/quic-go/quic-go v0.52.0v0.59.0 age confidence

Release Notes

quic-go/quic-go (github.com/quic-go/quic-go)

v0.59.0

Compare Source

This release adds a couple of new features:

  • Adds an API to peek stream data on ReceiveStream and Stream: #​5501
  • Adds an API to peek the next varint on a stream: #​5502
  • Reworks the API exposed by the HTTP/3 package for WebTransport: #​5509, #​5512. Regular HTTP/3 use cases should not be affected by these changes.
  • Adds support for HTTP request trailers (trailers sent by the client): #​5507

Breaking Changes

  • Removes the deprecated ClientHelloInfo: #​5497
  • Removes the deprecated ConnectionTracingID and ConnectionTracingKey: #​5521
  • http3: the qlogger is now closed after all streams have been handled: #​5524
  • The ConnectionState now reports both the local and the remote status of the QUIC Datagram and Reliable Stream Reset extensions: #​5533

Other Notable Fixes

  • Fixes an infinite loop of PING-only packets caused by a bug in the PTO queueing logic: #​5538 and #​5539
  • http3: Fixes a race condition between new request streams and GOAWAY: #​5522
  • qlog: Fixes a race condition between RecordEvent and Close: #​5523

Changelog

Full Changelog: quic-go/quic-go@v0.58.0...v0.59.0

v0.58.1

Compare Source

This patch release backports fixes for a bug in the PTO queueing logic that could lead to an infinite loop of PING packets.

Bug Fixes

  • ackhandler: fix qlogging of outstanding packet count (#​5538)
  • ackhandler: fix counting of packets queued for PTO probing (#​5539)

v0.58.0

Compare Source

This release optimizes the QUIC handshake:

  • Multiple incoming packets are now processed before sending an acknowledgment, reducing the total number of packets sent: #​5451
  • ACK frames are now packed into coalesced packets, reducing the need to send a separate packet just for the ACK in many cases: #​5477
  • When packets are buffered during the handshake, this now doesn't lead to inflated RTT measurements anymore: #​5493, #​5494

Other notable changes

  • quic-go now has a new logo: #​5484
  • ACK frames can now be encoded with up to 64 ranges (previously: 32): #​5476
  • Serializing ACK frames is now significantly faster: #​5476
  • Improved batch packet processing logic: #​5478
  • qlog: added support for the datagram_id on packet_sent, packet_received and packet_buffered events, using the CRC32 of the packet: #​5455

Changelog

Full Changelog: quic-go/quic-go@v0.57.0...v0.58.0

v0.57.1

Compare Source

This release resolves a panic during the server handshake when using the upcoming Go 1.26 toolchain, specifically occurring with TLS session tickets disabled (#​5462). This issue does not impact builds on Go 1.25 or earlier versions.

v0.57.0

Compare Source

This release contains a fix for CVE-2025-64702 by reworking the HTTP/3 header processing logic:

  • Both client and server now send their respective header size constraints using the SETTINGS_MAX_FIELD_SECTION_SIZE setting: #​5431
  • For any QPACK-related errors, the correct error code (QPACK_DECOMPRESSION_FAILED) is now used: #​5439
  • QPACK header parsing is now incremental (instead of parsing all headers at once), which is ~5-10% faster and reduces allocations: #​5435 (and quic-go/qpack#67)
  • The server now sends a 431 status code (Request Header Fields Too Large) when encountering HTTP header fields exceeding the size constraint: #​5452

 

Breaking Changes

  • http3: Transport.MaxResponseBytes is now an int (before: int64): #​5433
     

Notable Fixes

  • qlogwriter: fix storing of event schemas (this prevented qlog event logging from working for HTTP/3): #​5430
  • http3: errors sending the request are now ignored, instead, the response from the server is read (thereby allowing the client to read the status code, for example): #​5432

What's Changed

New Contributors

Full Changelog: quic-go/quic-go@v0.56.0...v0.57.0

v0.56.0

Compare Source

This release introduces qlog support for HTTP/3 (#​5367, #​5372, #​5374, #​5375, #​5376, #​5381, #​5383).

For this, we completely changed how connection tracing works. Instead of a general-purpose logging.ConnectionTracer (which we removed entirely), we now have a qlog-specific tracer (#​5356, #​5417). quic-go users can now implement their own qlog events.

It also removes the Prometheus-based metrics collection. Please comment on the tracking issue (#​5294) if you rely on metrics and are interested in seeing metrics brought back in a future release.

Notable Changes

  • replaced the unmaintained gojay with a custom, performance-optimized JSON encoder (#​5353, #​5371)
  • quicvarint: improved panic message for numbers larger than 2^62 (#​5410)

Behind the Scenes

Go 1.25 introduced support for testing concurrent code using testing/synctest. We've been working on transitioning tests to use synctest (#​5357, #​5391, #​5393, #​5397, #​5398, #​5403, #​5414, #​5415), using @​MarcoPolo's simnet package to simulate a network in memory.

Using synctest makes test execution more reliable (reducing flakiness). The use of a synthetic clock leads to a massive speedup; the execution time of some integration tests was reduced from 20s to less than 1ms. The work will continue for the next release (see tracking issue: #​5386).

Changelog

New Contributors

Full Changelog: quic-go/quic-go@v0.55.0...v0.56.0

v0.55.0

Compare Source

This release contains a number of improvements and fixes, and it updates the supported Go versions to 1.24 and 1.25.

Optimizations

When sending packets on a QUIC connection, RFC 9002 requires us to save the timestamp for every packet sent. In #​5344, we implemented a memory-optimized drop-in replacement for time.Time, which reduces the memory required from 24 to 8 bytes, and vastly speeds up timer calculations (which happen very frequently).

New Features

  • Basic connection statistics are now exposed via Conn.ConnectionStats, thanks to @​MarcoPolo
  • On some links, packet reordering can lead to spurious detections of packet loss when using the loss detection logic specified in RFC 9002. #​5355 adds logic detect when packet loss is detected spuriously.

Notable Fixes

  • http3: don't allow usage of closed Transport: #​5324, thanks to @​Glonee
  • http3: fix race in concurrent Transport.Roundtrip calls: #​5323, thanks to @​Glonee
  • improve and fix connection timer logic: #​5339, thanks to @​sukunrt for a very comprehensive code review

Behind the Scenes

We have started transitioning tests to make use of the new synctest package that was added in Go 1.25 (and was available as a GOEXPERIMENT in Go 1.24): #​5291, #​5296, #​5298, #​5299, #​5302, #​5304, #​5305, #​5306, #​5317. This is a lot of work, but it makes the test execution both faster and more reliable.

Changelog

New Contributors

Full Changelog: quic-go/quic-go@v0.54.0...v0.55.0

v0.54.1

Compare Source

v0.54.0

Compare Source

This release adds support for QUIC Stream Resets with Partial Delivery, a QUIC extension that allows resetting a stream, while guaranteeing delivery of stream data up to a certain byte offset (#​5155, #​5158, #​5160, #​5235, #​5242, #​5243). This extension is a requirement of newer versions of WebTransport over HTTP/3.

Other Notable Changes

  • http3: the package now doesn't depend on any internal quic-go packages: #​5256
  • wire: return concrete structs (instead of a wire.Frame) for common frame types (STREAM, DATAGRAM, ACK), speeding up STREAM frame parsing by ~18%: #​5253, #​5227, thanks to @​jannis-seemann

Fixes

  • fix retransmission logic for path probing packets: #​5241
  • close the Transport when DialAddr fails: #​5259, thanks to @​rbqvq

Changelog

New Contributors

Full Changelog: quic-go/quic-go@v0.53.0...v0.54.0

v0.53.0

Compare Source

This release introduces a massive overhaul of the quic-go API. See this blog post for more details about the motivation. Most users will need to make some changes when upgrading to this version.

  • The Connection interface was removed in favor of a Conn struct (#​5195).
  • The ReceiveStream, SendStream and Stream interfaces were replaced with structs of the same name (#​5149, #​5172, #​5173, #​5214).

In most cases, migrating downstream code should be fairly straightforward. For example, a method that used to accept a quic.Connection as a parameter now needs to accept a *quic.Conn, and a function handling a quic.Stream now needs to handle a *quic.Stream. Of course, consumers of quic-go are free to define their own interfaces.

Similarly, on the HTTP/3 layer:

  • The Connection interface was replaced with a Conn struct (#​5204).
  • The RequestStream interface was converted to a struct (#​5153, #​5216).
  • The Stream interface was converted to a struct (#​5154).

We expect that most HTTP/3 users won't need to adjust their code, if they use the package to run an HTTP/3 server and dial HTTP/3 connection. More advanced use cases, such as WebTransport and the various MASQUE protocols, will require updates. We have already released new versions of webtransport-go and masque-go to support these changes.

Other Breaking Changes

  • http3: the deprecated SingleDestinationRoundTripper was removed (#​5217)

Notable Fixes and Improvements

  • fix Goroutine leak when receiving a Version Negotiation packets race with dial context cancellation (#​5203)
  • drain the server accept queue when closing the transport (#​5237), thanks to @​sukunrt
  • fix a race condition when closing transport (#​5220), thanks to @​sukunrt
  • quicvarint: speed up parsing of 1, 2 and 4-byte varints (~12.5% for 1 and 2 bytes, ~1% for 4 bytes) (#​5229), thanks to @​jannis-seemann
  • http3: expose ClientConn.Context, CloseWithError and Conn: #​5219
  • http3: RequestStream could be misused in many different ways, that's why we tightened the error checks (#​5231)

Behind The Scenes

We've completed the migration of the entire test suite away from Ginkgo (#​3652) and towards standard Go tests (#​5084, #​5150, #​5151, #​5193, #​5194, #​5196, #​5198). This was a major undertaking, spanning roughly 9 months and resulting in a complete rewrite of quic-go's test suite (> 40,000 lines of code!). Users will now benefit from a significantly slimmed-down dependency tree when upgrading.

Changelog


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Apr 27, 2026

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: lib/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 2 additional dependencies were updated

Details:

Package Change
github.com/quic-go/qpack v0.5.1 -> v0.6.0
go.uber.org/mock v0.5.0 -> v0.5.2

@renovate renovate Bot changed the title fix(deps): update module github.com/quic-go/quic-go to v0.59.0 fix(deps): update module github.com/quic-go/quic-go to v0.59.0 - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
@renovate
renovate Bot deleted the renovate/github.com-quic-go-quic-go-0.x branch April 27, 2026 23:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants