Skip to content

chore(deps): bump the go-tls-go group across 1 directory with 2 updates - #287

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/evaders/go-tls/go-tls-go-48b75caf0e
Closed

chore(deps): bump the go-tls-go group across 1 directory with 2 updates#287
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/evaders/go-tls/go-tls-go-48b75caf0e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the go-tls-go group with 2 updates in the /evaders/go-tls directory: github.com/quic-go/quic-go and golang.org/x/net.

Updates github.com/quic-go/quic-go from 0.60.0 to 0.61.0

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.61.0

This release adds new stream APIs intended for application protocols that perform their own flow-control accounting, such as WebTransport:

  • SendStream and Stream now expose TryWriteAll, which queues an entire buffer without blocking or returns ErrWouldBlock without queueing anything: #5704
  • SendStream and Stream now expose WriteWithLimit, allowing higher-level protocols to apply an additional send limit while data is packetized: #5753
  • ReceiveStream and Stream now expose SetReceiveFinalSizeCallback, which reports the final receive-side stream size once it is learned from a FIN or RESET_STREAM frame: #5752

Support for the RESET_STREAM_AT extension was updated to draft-09, while retaining support for the draft-07 codepoint for backwards compatibility: #5724

Breaking Changes

  • http3: ParseCapsule was replaced by the stateful CapsuleParser and CapsuleReader APIs. Each capsule payload must now be consumed or discarded before advancing to the next capsule: #5729
  • The StreamID.Type and StreamID.InitiatedBy methods were removed because they exposed internal types: #5744
  • qlog: datagram IDs were replaced by CRC32c payload checksums. The JSON field is now datagram_payload_checksum instead of datagram_id, and the corresponding exported qlog types were renamed: #5758

Notable Fixes

  • Transport parameter parsing is around 27% faster and now reliably rejects duplicate transport parameters: #5712
  • Session tickets containing unknown transport parameters are now rejected during restoration, preventing 0-RTT resumption when an endpoint no longer understands an extension recorded in the ticket: #5714
  • RESET_STREAM_AT negotiation is now applied correctly to streams opened before transport parameters are received during 0-RTT: #5715
  • RESET_STREAM_AT support is now cleared after 0-RTT rejection, preventing new streams from inheriting the rejected connection's setting: #5716
  • Pending stream control frames from a rejected 0-RTT attempt are now discarded instead of being sent after rejection: #5717
  • Remembered RESET_STREAM_AT support is now validated across 0-RTT resumption: #5722
  • http3: receiving a GOAWAY now unblocks pending OpenStreamSync calls and prevents new request streams from being opened: #5730
  • http3: invalid header values are no longer included in validation errors, avoiding accidental exposure of sensitive values when errors are logged: #5742

Changelog

... (truncated)

Commits
  • 579ee19 add SendStream.WriteWithLimit for higher-level flow control (#5753)
  • b1e850a guard qlogger when dropping malformed short-header packets (#5759)
  • 2d093f1 qlog: replace datagram IDs with CRC32c payload checksums (#5758)
  • 4e52cbd replace receive stream final size wait with callback (#5752)
  • 353abe2 ci: bump actions/setup-go from 6 to 7 (#5756)
  • fbfa1d5 fix flaky TestDatagramSizeLimitWithMTUDiscovery (#5751)
  • 124e085 rename ReceiveStream.WaitForFinalSize to WaitForReceiveFinalSize (#5750)
  • a8ac06a update golang.org/x/crypto to v0.54.0 (#5749)
  • bc8d524 ci: run Codspeed on pull requests and on master (#5748)
  • dab2973 rename SendStream.WriteImmediately to TryWriteAll (#5747)
  • Additional commits viewable in compare view

Updates golang.org/x/net from 0.57.0 to 0.58.0

Commits
  • acc78e0 go.mod: update golang.org/x dependencies
  • 90d10f0 internal/http3: delete invalid Content-Length if declared in server handler
  • 08abf4d internal/http3: infer headers when Content-Encoding is set but is empty
  • 8d10596 http2: avoid deadlocks in wrapped ClientConn state callback
  • 99c3b0a http2/hpack: build the table lookup maps lazily, only for encoders
  • 5a920b1 http3: rework registration to allow using a fake network
  • 7fd2842 quic: return an error from Accept after PacketConn reader exits
  • 825111d quic: avoid busy-loop when keep-alive is blocked by congestion control
  • a02ddfa http/httpproxy: prioritize lowercase proxy environment variables
  • 574e5eb quic: halt conn goroutines on close when listener exits early
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the go-tls-go group across 1 directory with 2 updates
4636acc 
Bumps the go-tls-go group with 2 updates in the /evaders/go-tls directory: [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) and [golang.org/x/net](https://github.com/golang/net).


Updates `github.com/quic-go/quic-go` from 0.60.0 to 0.61.0
- [Release notes](https://github.com/quic-go/quic-go/releases)
- [Commits](quic-go/quic-go@v0.60.0...v0.61.0)

Updates `golang.org/x/net` from 0.57.0 to 0.58.0
- [Commits](golang/net@v0.57.0...v0.58.0)

---
updated-dependencies:
- dependency-name: github.com/quic-go/quic-go
  dependency-version: 0.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-tls-go
- dependency-name: golang.org/x/net
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-tls-go
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 20, 2026
@dependabot
dependabot Bot requested a review from datascry as a code owner August 20, 2026 01:14
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 20, 2026
@datascry datascry mentioned this pull request Aug 23, 2026
Merged
datascry added a commit that referenced this pull request Aug 23, 2026
@datascry
chore(repo): bump quic-go, x/net, x/crypto and x/image across the go …
24a86ab 
…modules

Applies dependabot #281, #282, #283, #286 and #287 locally so the commits stay
datascry-authored:

  - edge, evaders/go-tls:      quic-go v0.60.0 -> v0.61.0, x/net v0.57.0 -> v0.58.0
  - arena:                     x/image v0.44.0 -> v0.45.0
  - evaders/h2-rapid-reset:    x/net v0.57.0 -> v0.58.0
  - evaders/pow:               x/crypto v0.54.0 -> v0.55.0

Indirects follow through tidy (x/crypto, x/mod, x/text, x/tools). Each module was
verified in golang:1.26-alpine with gofmt, go vet and go test: edge, arena,
evaders/pow and evaders/go-tls all pass with coverage unchanged. arena and
evaders/pow needed the repo root mounted rather than the module dir, because
arena's `replace` points at ../evaders/pow.
@dependabot @github

dependabot Bot commented on behalf of github Aug 23, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 23, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/evaders/go-tls/go-tls-go-48b75caf0e branch August 23, 2026 02:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@datascry datascry Awaiting requested review from datascry datascry is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants