chore(deps): update module github.com/quic-go/quic-go to v0.61.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/quic-go/quic-go	v0.60.0 → v0.61.0

---

Release Notes

quic-go/quic-go (github.com/quic-go/quic-go)

v0.61.0

Compare Source

This release adds new stream APIs intended for application protocols that perform their own flow-control accounting, such as WebTransport:

• SendStream and Stream now expose TryWriteAll, which queues an entire buffer without blocking or returns ErrWouldBlock without queueing anything: #​5704
• SendStream and Stream now expose WriteWithLimit, allowing higher-level protocols to apply an additional send limit while data is packetized: #​5753
• ReceiveStream and Stream now expose SetReceiveFinalSizeCallback, which reports the final receive-side stream size once it is learned from a FIN or RESET_STREAM frame: #​5752

Support for the RESET_STREAM_AT extension was updated to draft-09, while retaining support for the draft-07 codepoint for backwards compatibility: #​5724

Breaking Changes

• http3: ParseCapsule was replaced by the stateful CapsuleParser and CapsuleReader APIs. Each capsule payload must now be consumed or discarded before advancing to the next capsule: #​5729
• The StreamID.Type and StreamID.InitiatedBy methods were removed because they exposed internal types: #​5744
• qlog: datagram IDs were replaced by CRC32c payload checksums. The JSON field is now datagram_payload_checksum instead of datagram_id, and the corresponding exported qlog types were renamed: #​5758

Notable Fixes

• Transport parameter parsing is around 27% faster and now reliably rejects duplicate transport parameters: #​5712
• Session tickets containing unknown transport parameters are now rejected during restoration, preventing 0-RTT resumption when an endpoint no longer understands an extension recorded in the ticket: #​5714
• RESET_STREAM_AT negotiation is now applied correctly to streams opened before transport parameters are received during 0-RTT: #​5715
• RESET_STREAM_AT support is now cleared after 0-RTT rejection, preventing new streams from inheriting the rejected connection's setting: #​5716
• Pending stream control frames from a rejected 0-RTT attempt are now discarded instead of being sent after rejection: #​5717
• Remembered RESET_STREAM_AT support is now validated across 0-RTT resumption: #​5722
• http3: receiving a GOAWAY now unblocks pending OpenStreamSync calls and prevents new request streams from being opened: #​5730
• http3: invalid header values are no longer included in validation errors, avoiding accidental exposure of sensitive values when errors are logged: #​5742

Changelog

• ci: bump codecov/codecov-action from 6.0.1 to 7.0.0 by @​dependabot[bot] in #​5677
• ci: add Go 1.27rc1 to tested Go versions by @​marten-seemann in #​5682
• handshake: use new tls.QUICConfig.ClientHelloInfoConn API, avoid cloning tls.Config by @​marten-seemann in #​5571
• ci: bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​5684
• move FIPS integration tests to a separate Go module by @​marten-seemann in #​5691
• ci: bump actions/cache from 5 to 6 by @​dependabot[bot] in #​5694
• ci: bump CodSpeedHQ/action from 4.15.1 to 4.18.1 by @​dependabot[bot] in #​5695
• ci: only run Codspeed benchmarks for the integration tests by @​marten-seemann in #​5701
• dissolve the flowcontrol package into the quic package by @​marten-seemann in #​5702
• protocol: remove unused AtomicByteCount type by @​marten-seemann in #​5703
• implement a method on the SendStream to send data immediately by @​marten-seemann in #​5704
• add a method to query for the final size of a receive stream by @​marten-seemann in #​5693
• ci: bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​5706
• ci: bump docker/login-action from 4.2.0 to 4.4.0 by @​dependabot[bot] in #​5708
• ci: bump docker/build-push-action from 7.2.0 to 7.3.0 by @​dependabot[bot] in #​5707
• ci: bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​5710
• ci: bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by @​dependabot[bot] in #​5709
• wire: speed up transport parameter parsing by using slices.Sort by @​marten-seemann in #​5712
• wire: reject unknown transport params on session ticket restore by @​marten-seemann in #​5714
• fix RESET_STREAM_AT negotiation after 0-RTT for existing streams by @​marten-seemann in #​5715
• clear stream control frames on 0-RTT rejection by @​marten-seemann in #​5717
• simnet: fix flaky TestMTUEnforcement by @​marten-seemann in #​5719
• validate RESET_STREAM_AT across 0-RTT resumption by @​marten-seemann in #​5722
• http3: avoid race initializing server idle timer by @​marten-seemann in #​5725
• reset RESET_STREAM_AT support after 0-RTT rejection by @​marten-seemann in #​5716
• fix flaky TestHTTPServerIdleTimeout by @​marten-seemann in #​5726
• fix flaky TestHTTPSettings by @​marten-seemann in #​5727
• add support for RESET_STREAM_AT draft-09 by @​marten-seemann in #​5724
• http3: implement a stricter API for capsule parsing by @​marten-seemann in #​5729
• http3: unblock pending calls to OpenStreamSync on GOAWAY by @​marten-seemann in #​5730
• handshake: simplify code by using bytes.CutPrefix by @​marten-seemann in #​5732
• ci: bump CodSpeedHQ/action from 4.18.1 to 4.18.5 by @​dependabot[bot] in #​5733
• remove unneeded underflow checks in the flow controller by @​marten-seemann in #​5738
• protocol: avoid exposing methods on the StreamID by @​marten-seemann in #​5744
• http3: avoid logging of invalid header values by @​marten-seemann in #​5742
• ci: don’t cancel interop Docker image builds on master by @​marten-seemann in #​5746
• use the StreamID alias on Stream.StreamID and ReceiveStream.StreamID by @​marten-seemann in #​5745
• rename SendStream.WriteImmediately to TryWriteAll by @​marten-seemann in #​5747
• ci: run Codspeed on pull requests and on master by @​marten-seemann in #​5748
• update golang.org/x/crypto to v0.54.0 by @​marten-seemann in #​5749
• rename ReceiveStream.WaitForFinalSize to WaitForReceiveFinalSize by @​marten-seemann in #​5750
• fix flaky TestDatagramSizeLimitWithMTUDiscovery by @​marten-seemann in #​5751
• ci: bump actions/setup-go from 6 to 7 by @​dependabot[bot] in #​5756
• replace receive stream final size wait with callback by @​marten-seemann in #​5752
• qlog: replace datagram IDs with CRC32c payload checksums by @​marten-seemann in #​5758
• guard qlogger when dropping malformed short-header packets by @​marten-seemann in #​5759
• add SendStream.WriteWithLimit for higher-level flow control by @​marten-seemann in #​5753

Full Changelog: quic-go/quic-go@v0.60.0...v0.61.0

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.