Skip to content

Bump github.com/quic-go/quic-go from 0.48.2 to 0.57.0#95

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/quic-go/quic-go-0.57.0
Closed

Bump github.com/quic-go/quic-go from 0.48.2 to 0.57.0#95
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/quic-go/quic-go-0.57.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Dec 11, 2025

Copy link
Copy Markdown
Contributor

Bumps github.com/quic-go/quic-go from 0.48.2 to 0.57.0.

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.57.0

This release contains a fix for CVE-2025-64702 by reworking the HTTP/3 header processing logic:

  • Both client and server now send their respective header size constraints using the SETTINGS_MAX_FIELD_SECTION_SIZE setting: #5431
  • For any QPACK-related errors, the correct error code (QPACK_DECOMPRESSION_FAILED) is now used: #5439
  • QPACK header parsing is now incremental (instead of parsing all headers at once), which is ~5-10% faster and reduces allocations: #5435 (and quic-go/qpack#67)
  • The server now sends a 431 status code (Request Header Fields Too Large) when encountering HTTP header fields exceeding the size constraint: #5452

 

Breaking Changes

  • http3: Transport.MaxResponseBytes is now an int (before: int64): #5433  

Notable Fixes

  • qlogwriter: fix storing of event schemas (this prevented qlog event logging from working for HTTP/3): #5430
  • http3: errors sending the request are now ignored, instead, the response from the server is read (thereby allowing the client to read the status code, for example): #5432

What's Changed

New Contributors

Full Changelog: quic-go/quic-go@v0.56.0...v0.57.0

v0.56.0

This release introduces qlog support for HTTP/3 (#5367, #5372, #5374, #5375, #5376, #5381, #5383).

For this, we completely changed how connection tracing works. Instead of a general-purpose logging.ConnectionTracer (which we removed entirely), we now have a qlog-specific tracer (#5356, #5417). quic-go users can now implement their own qlog events.

It also removes the Prometheus-based metrics collection. Please comment on the tracking issue (#5294) if you rely on metrics and are interested in seeing metrics brought back in a future release.

Notable Changes

  • replaced the unmaintained gojay with a custom, performance-optimized JSON encoder (#5353, #5371)

... (truncated)

Commits
  • 5b2d212 http3: limit size of decompressed headers (#5452)
  • e80b378 qlogwriter: use synctest to make tests deterministic (#5454)
  • d43c589 README: add nodepass to list of projects (#5448)
  • ca2835d don’t arm connection timer for connection ID retirement (#5449)
  • e84ebae ackhandler: don’t generate an immediate ACK for the first packet (#5447)
  • d4d168f add documentation for Conn.NextConnection (#5442)
  • 4cdebbe http3: use QPACK_DECOMPRESSION_FAILED for QPACK errors (#5439)
  • b7886d5 update qpack to v0.6.0 (#5434)
  • 2fc9705 http3: add a benchmark for header parsing (#5435)
  • dafdd6f http3: make Transport.MaxResponseBytes an int (#5433)
  • Additional commits viewable in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) from 0.48.2 to 0.57.0.
- [Release notes](https://github.com/quic-go/quic-go/releases)
- [Commits](quic-go/quic-go@v0.48.2...v0.57.0)

---
updated-dependencies:
- dependency-name: github.com/quic-go/quic-go
  dependency-version: 0.57.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Dec 11, 2025
lens0021 added a commit that referenced this pull request Jul 1, 2026
…1.25 (#98)

Consolidates all open Dependabot PRs into one update. Bumping caddy to
2.11.4 pulls its transitive deps (quic-go, smallstep/certificates,
golang.org/x/crypto, golang.org/x/net, edwards25519) via go mod tidy,
superseding the individual indirect-dependency PRs.

caddy 2.11.x requires Go 1.25, so the CI matrix is replaced with
go-version-file: go.mod, and the GitHub Actions are bumped
(checkout v4->v6, setup-go v5->v6).

Also fixes a non-constant format string flagged by go vet on Go 1.24+.

Supersedes #74, #85, #87, #89, #90, #92, #93, #94, #95, #96, #97.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@lens0021

lens0021 commented Jul 1, 2026

Copy link
Copy Markdown
Member

@dependabot rebase

@github-actions

github-actions Bot commented Jul 1, 2026

Copy link
Copy Markdown

Your PR title must follow the Conventional Commits format.

Details:

No release type found in pull request title "Bump github.com/quic-go/quic-go from 0.48.2 to 0.57.0". Add a prefix to indicate what kind of release this pull request corresponds to. For reference, see https://www.conventionalcommits.org/

Available types:
 - feat: A new feature
 - fix: A bug fix
 - docs: Documentation only changes
 - style: Changes that do not affect the meaning of the code (white-space, formatting, missing semi-colons, etc)
 - refactor: A code change that neither fixes a bug nor adds a feature
 - perf: A code change that improves performance
 - test: Adding missing tests or correcting existing tests
 - build: Changes that affect the build system or external dependencies (example scopes: gulp, broccoli, npm)
 - ci: Changes to our CI configuration files and scripts (example scopes: Travis, Circle, BrowserStack, SauceLabs)
 - chore: Other changes that don't modify src or test files
 - revert: Reverts a previous commit

@dependabot @github

dependabot Bot commented on behalf of github Jul 1, 2026

Copy link
Copy Markdown
Contributor Author

Looks like github.com/quic-go/quic-go is up-to-date now, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 1, 2026
@dependabot dependabot Bot deleted the dependabot/go_modules/github.com/quic-go/quic-go-0.57.0 branch July 1, 2026 13:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant