fix(deps): update module github.com/quic-go/quic-go to v0.59.1 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/quic-go/quic-go	v0.35.1 → v0.59.1

---

quic-go's path validation mechanism can be exploited to cause denial of service

CVE-2023-49295 / GHSA-ppxx-5m9h-6vxf

More information

Details

An attacker can cause its peer to run out of memory sending a large number of PATH_CHALLENGE frames. The receiver is supposed to respond to each PATH_CHALLENGE frame with a PATH_RESPONSE frame. The attacker can prevent the receiver from sending out (the vast majority of) these PATH_RESPONSE frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate.

I published a more detailed description of the attack and its mitigation in this blog post: https://seemann.io/posts/2023-12-18-exploiting-quics-path-validation/

There's no way to mitigate this attack, please update quic-go to a version that contains the fix.

Severity

• CVSS Score: 6.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

References

• https://github.com/quic-go/quic-go/security/advisories/GHSA-ppxx-5m9h-6vxf
• https://github.com/quic-go/quic-go/commit/17fc98c2d81dbe685c19702dc694a9d606ac56dc
• https://github.com/quic-go/quic-go/commit/21609ddfeff93668c7625a85eb09f1541fdad965
• https://github.com/quic-go/quic-go/commit/3a9c18bcd27a01c551ac9bf8bd2b4bded77c189a
• https://github.com/quic-go/quic-go/commit/554d543b50b917369fb1394cc5396d928166cf49
• https://github.com/quic-go/quic-go/commit/6cc3d58935426191296171a6c0d1ee965e10534e
• https://github.com/quic-go/quic-go/commit/9aaefe19fc3dc8c8917cc87e6128bb56d9e9e6cc
• https://github.com/quic-go/quic-go/commit/a0ffa757499913f7be69aa78f573a6aee3430ae4
• https://github.com/quic-go/quic-go/commit/d7aa627ebde91cf799ada2a07443faa9b1e5abb8
• https://nvd.nist.gov/vuln/detail/CVE-2023-49295
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G5RSHDTVMYAIGYVVFGKTMFHAZJMA3EVV
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZE7IOKXX5AATU2WR3V76X5Y3A44QAATG
• https://seemann.io/posts/2023-12-18-exploiting-quics-path-validation
• https://github.com/advisories/GHSA-ppxx-5m9h-6vxf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack

CVE-2024-22189 / GHSA-c33x-xqrf-c478

More information

Details

An attacker can cause its peer to run out of memory by sending a large number of NEW_CONNECTION_ID frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a RETIRE_CONNECTION_ID frame. The attacker can prevent the receiver from sending out (the vast majority of) these RETIRE_CONNECTION_ID frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate.

I published a more detailed description of the attack and its mitigation in this blog post: https://seemann.io/posts/2024-03-19-exploiting-quics-connection-id-management/.
I also presented this attack in the IETF QUIC working group session at IETF 119: https://youtu.be/JqXtYcZAtIA?si=nJ31QKLBSTRXY35U&t=3683

There's no way to mitigate this attack, please update quic-go to a version that contains the fix.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/quic-go/quic-go/security/advisories/GHSA-c33x-xqrf-c478
• https://github.com/quic-go/quic-go/commit/4a99b816ae3ab03ae5449d15aac45147c85ed47a
• https://seemann.io/posts/2024-03-19-exploiting-quics-connection-id-management
• https://www.youtube.com/watch?v=JqXtYcZAtIA&t=3683s
• https://nvd.nist.gov/vuln/detail/CVE-2024-22189
• https://github.com/advisories/GHSA-c33x-xqrf-c478

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

quic-go affected by an ICMP Packet Too Large Injection Attack on Linux

CVE-2024-53259 / GHSA-px8v-pp82-rcvr

More information

Details

Impact

An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IP_PMTUDISC_DO, the kernel would then return a "message too large" error on sendmsg, i.e. when quic-go attempts to send a packet that exceeds the MTU claimed in that ICMP packet.

By setting this value to smaller than 1200 bytes (the minimum MTU for QUIC), the attacker can disrupt a QUIC connection. Crucially, this can be done after completion of the handshake, thereby circumventing any TCP fallback that might be implemented on the application layer (for example, many browsers fall back to HTTP over TCP if they're unable to establish a QUIC connection).

As far as I understand, the kernel tracks the MTU per 4-tuple, so the attacker needs to at least know the client's IP and port tuple to mount an attack (assuming that it knows the server's IP and port).

Patches

The fix is easy: Use IP_PMTUDISC_PROBE instead of IP_PMTUDISC_DO. This socket option only sets the DF bit, but disables the kernel's MTU tracking.

Has the problem been patched? What versions should users upgrade to?

Fixed in https://github.com/quic-go/quic-go/pull/4729
Released in https://github.com/quic-go/quic-go/releases/tag/v0.48.2

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Use iptables to drop ICMP Unreachable packets.

References

Are there any links users can visit to find out more?

This bug was discovered while doing research for my new IETF draft on IP fragmentation: https://datatracker.ietf.org/doc/draft-seemann-tsvwg-udp-fragmentation/

Severity

• CVSS Score: 6.0 / 10 (Medium)
• Vector String: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/quic-go/quic-go/security/advisories/GHSA-px8v-pp82-rcvr
• https://github.com/quic-go/quic-go/pull/4729
• https://github.com/quic-go/quic-go/commit/ca31dd355cbe5fc6c5807992d9d1149c66c96a50
• https://github.com/quic-go/quic-go/releases/tag/v0.48.2
• https://nvd.nist.gov/vuln/detail/CVE-2024-53259
• https://github.com/advisories/GHSA-px8v-pp82-rcvr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

quic-go: Panic occurs when queuing undecryptable packets after handshake completion

CVE-2025-59530 / GHSA-47m2-4cr7-mhcw

More information

Details

Summary

A misbehaving or malicious server can trigger an assertion in a quic-go client (and crash the process) by sending a premature HANDSHAKE_DONE frame during the handshake.

Impact

A misbehaving or malicious server can cause a denial-of-service (DoS) attack on the quic-go client by triggering an assertion failure, leading to a process crash. This requires no authentication and can be exploited during the handshake phase. Observed in the wild with certain server implementations (e.g. Solana's Firedancer QUIC).

Affected Versions

• All versions prior to v0.49.1 (for the 0.49 branch)
• Versions v0.50.0 to v0.54.0 (inclusive)
• Fixed in v0.49.1, v0.54.1, and v0.55.0 onward

Users are recommended to upgrade to the latest patched version in their respective maintenance branch or to v0.55.0 or later.

Details

For a regular 1-RTT handshake, QUIC uses three sets of keys to encrypt / decrypt QUIC packets:

• Initial keys (derived from a static key and the connection ID)
• Handshake keys (derived from the client's and server's key shares in the TLS handshake)
• 1-RTT keys (derived when the TLS handshake finishes)

On the client side, Initial keys are discarded when the first Handshake packet is sent. Handshake keys are discarded when the server's HANDSHAKE_DONE frame is received, as specified in section 4.9.2 of RFC 9001. Crucially, Initial keys are always dropped before Handshake keys in a standard handshake.

Due to packet reordering, it is possible to receive a packet with a higher encryption level before the key for that encryption level has been derived. For example, the server's Handshake packets (containing, among others, the TLS certificate) might arrive before the server's Initial packet (which contains the TLS ServerHello). In that case, the client queues the Handshake packets and decrypts them as soon as it has processed the ServerHello and derived Handshake keys.

After completion of the handshake, Initial and Handshake packets are not needed anymore and will be dropped. quic-go implements an assertion that no packets are queued after completion of the handshake.

A misbehaving or malicious server can trigger this assertion, and thereby cause a panic, by sending a HANDSHAKE_DONE frame before actually completing the handshake. In that case, Handshake keys would be dropped before Initial keys.

This can only happen if the server implementation is misbehaving: the server can only complete the handshake after receiving the client's TLS Finished message (which is sent in Handshake packets).

The Fix

quic-go needs to be able to handle misbehaving server implementations, including those that prematurely send a HANDSHAKE_DONE frame. We now discard Initial keys when receiving a HANDSHAKE_DONE frame, thereby correctly handling premature HANDSHAKE_DONE frames. The fix was implemented in https://github.com/quic-go/quic-go/pull/5354.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/quic-go/quic-go/security/advisories/GHSA-47m2-4cr7-mhcw
• https://github.com/quic-go/quic-go/pull/5354
• https://github.com/quic-go/quic-go/commit/bc5bccf10fd02728eef150683eb4dfaa5c0e749c
• https://github.com/quic-go/quic-go/commit/ce7c9ea8834b9d2ed79efa9269467f02c0895d42
• https://github.com/quic-go/quic-go/blob/v0.55.0/connection.go#L2682-L2685
• https://nvd.nist.gov/vuln/detail/CVE-2025-59530
• https://pkg.go.dev/vuln/GO-2025-4017
• https://github.com/advisories/GHSA-47m2-4cr7-mhcw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

quic-go HTTP/3 QPACK Header Expansion DoS

CVE-2025-64702 / GHSA-g754-hx8w-x2g6

More information

Details

Summary

An attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion.

Impact

A misbehaving or malicious peer can cause a denial-of-service (DoS) attack on quic-go's HTTP/3 servers or clients by triggering excessive memory allocation, potentially leading to crashes or exhaustion. It affects both servers and clients due to symmetric header construction.

Details

In HTTP/3, headers are compressed using QPACK (RFC 9204). quic-go's HTTP/3 server (and client) decodes the QPACK-encoded HEADERS frame into header fields, then constructs an http.Request (or response).

http3.Server.MaxHeaderBytes and http3.Transport.MaxResponseHeaderBytes, respectively, limit encoded HEADERS frame size (default: 1 MB server, 10 MB client), but not decoded size. A maliciously crafted HEADERS frame can expand to ~50x the encoded size using QPACK static table entries with long names / values.

RFC 9114 requires enforcing decoded field section size limits via SETTINGS, which quic-go did not do.

The Fix

quic-go now enforces RFC 9114 decoded field section size limits, sending SETTINGS_MAX_FIELD_SECTION_SIZE and using incremental QPACK decoding to check the header size after each entry, aborting early on violations with HTTP 431 (on the server side) and stream reset (on the client side).

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/quic-go/quic-go/security/advisories/GHSA-g754-hx8w-x2g6
• https://github.com/quic-go/quic-go/commit/5b2d2129f8315da41e01eff0a847ab38a34e83a8
• https://nvd.nist.gov/vuln/detail/CVE-2025-64702
• https://github.com/advisories/GHSA-g754-hx8w-x2g6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion

CVE-2026-40898 / GHSA-vvgj-x9jq-8cj9

More information

Details

Summary

An attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large trailer field section with many unique field names and/or large values. The implementation builds an http.Header for the corresponding http.Request or http.Response, while only enforcing limits on the size of the QPACK-compressed HEADERS frame, not on the decoded field section. This can lead to memory exhaustion.

This is very similar to CVE-2025-64702. The difference is that this issue uses HTTP trailers, rather than HTTP headers, as the attack vector.

Impact

A misbehaving or malicious peer can cause a denial-of-service (DoS) attack against quic-go's HTTP/3 servers or clients by triggering excessive memory allocation, potentially leading to crashes or resource exhaustion. This affects both servers and clients due to symmetric header construction.

Details

In HTTP/3, field sections are compressed using QPACK (RFC 9204). Field sections are used for both HTTP headers and trailers. quic-go's HTTP/3 server and client decode the QPACK-encoded HEADERS frame into header fields, then construct an http.Request or http.Response.

http3.Server.MaxHeaderBytes and http3.Transport.MaxResponseHeaderBytes limit the encoded HEADERS frame size, with defaults of 1 MB for servers and 10 MB for clients. However, they did not limit the decoded field section size. A maliciously crafted HEADERS frame carrying trailers can expand to about 50x the encoded size using QPACK static table entries with long names and/or values.

RFC 9114 requires endpoints to enforce decoded field section size limits via SETTINGS, which quic-go did not do for trailers.

The Fix

quic-go now enforces RFC 9114 decoded field section size limits for trailers as well. It incrementally decodes QPACK entries and checks the field section size after each entry, aborting the stream if an entry causes the limit to be exceeded.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9
• https://github.com/quic-go/quic-go/pull/5642
• https://github.com/quic-go/quic-go/commit/c56e8c79d1627cc1ed6005b421b4b0adadd83665
• https://github.com/advisories/GHSA-g754-hx8w-x2g6
• https://github.com/quic-go/quic-go/releases/tag/v0.59.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-40898
• https://github.com/advisories/GHSA-vvgj-x9jq-8cj9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

quic-go/quic-go (github.com/quic-go/quic-go)

v0.59.1

Compare Source

This patch release backports #​5642, which adds validation for HTTP/3 trailers.

v0.59.0

Compare Source

This release adds a couple of new features:

• Adds an API to peek stream data on ReceiveStream and Stream: #​5501
• Adds an API to peek the next varint on a stream: #​5502
• Reworks the API exposed by the HTTP/3 package for WebTransport: #​5509, #​5512. Regular HTTP/3 use cases should not be affected by these changes.
• Adds support for HTTP request trailers (trailers sent by the client): #​5507

Breaking Changes

• Removes the deprecated ClientHelloInfo: #​5497
• Removes the deprecated ConnectionTracingID and ConnectionTracingKey: #​5521
• http3: the qlogger is now closed after all streams have been handled: #​5524
• The ConnectionState now reports both the local and the remote status of the QUIC Datagram and Reliable Stream Reset extensions: #​5533

Other Notable Fixes

• Fixes an infinite loop of PING-only packets caused by a bug in the PTO queueing logic: #​5538 and #​5539
• http3: Fixes a race condition between new request streams and GOAWAY: #​5522
• qlog: Fixes a race condition between RecordEvent and Close: #​5523

Changelog

• remove deprecated ClientHelloInfo by @​marten-seemann in #​5497
• expose SetReliableBoundary method on the Stream by @​marten-seemann in #​5498
• simplify ReceiveStream.Read implementation by @​marten-seemann in #​5500
• ci: use codecov-action instead of codecov/test-results-action by @​Copilot in #​5504
• http3: add support for request trailers by @​marten-seemann in #​5507
• http3: remove stream hijacking API by @​marten-seemann in #​5508
• http3: remove Hijacker, add Settingser interface by @​marten-seemann in #​5509
• implement a stream peeking API by @​marten-seemann in #​5501
• ci: fix Codecov upload by untracking integrationtests before removal by @​marten-seemann in #​5511
• quicvarint: implement function to peek the next varint by @​marten-seemann in #​5502
• http3: implement new API to allow fine-grained control of connections by @​marten-seemann in #​5512
• remove deprecated ConnectionTracingID and ConnectionTracingKey by @​marten-seemann in #​5521
• http3: fix race between new streams and GOAWAY by @​marten-seemann in #​5522
• qlogwriter: fix race between RecordEvent and Close by @​marten-seemann in #​5523
• polish the security policy by @​marten-seemann in #​5526
• http3: close qlogger after all streams have been handled by @​marten-seemann in #​5524
• fix flaky TestHTTP3Qlog by @​marten-seemann in #​5532
• expose local and remote settings in ConnectionState by @​marten-seemann in #​5533
• ackhandler: fix qlogging of outstanding packet count by @​marten-seemann in #​5538
• ackhandler: fix counting of packets queued for PTO probing by @​marten-seemann in #​5539

Full Changelog: quic-go/quic-go@v0.58.0...v0.59.0

v0.58.1

Compare Source

This patch release backports fixes for a bug in the PTO queueing logic that could lead to an infinite loop of PING packets.

Bug Fixes

• ackhandler: fix qlogging of outstanding packet count (#​5538)
• ackhandler: fix counting of packets queued for PTO probing (#​5539)

v0.58.0

Compare Source

This release optimizes the QUIC handshake:

• Multiple incoming packets are now processed before sending an acknowledgment, reducing the total number of packets sent: #​5451
• ACK frames are now packed into coalesced packets, reducing the need to send a separate packet just for the ACK in many cases: #​5477
• When packets are buffered during the handshake, this now doesn't lead to inflated RTT measurements anymore: #​5493, #​5494

Other notable changes

• quic-go now has a new logo: #​5484
• ACK frames can now be encoded with up to 64 ranges (previously: 32): #​5476
• Serializing ACK frames is now significantly faster: #​5476
• Improved batch packet processing logic: #​5478
• qlog: added support for the datagram_id on packet_sent, packet_received and packet_buffered events, using the CRC32 of the packet: #​5455

Changelog

• qlog: add a DebugEvent by @​marten-seemann in #​5456
• qlog the datagram_id for long header and coalesced packets by @​marten-seemann in #​5455
• build(deps): bump actions/checkout from 5 to 6 by @​dependabot[bot] in #​5458
• handshake: pass cipherSuite by value instead of pointer by @​marten-seemann in #​5459
• handshake: add a benchmark for token decoding by @​marten-seemann in #​5460
• use synctest in the session resumption test by @​marten-seemann in #​5424
• handshake: fix QUIC events with session tickets disabled on Go 1.26 by @​marten-seemann in #​5462
• fix flaky TestConnectionCongestionControl by @​Copilot in #​5467
• simnet: move latency configuration to Router, simplify queueing logic by @​marten-seemann in #​5463
• use synctest for the RTT and reordering tests by @​marten-seemann in #​5464
• use synctest for 0-RTT integration tests by @​marten-seemann in #​5465
• allow processing of multiple packets before handshake completion by @​marten-seemann in #​5451
• ackhandler: disentangle ReceivedPacketHandler and SentPacketHandler by @​marten-seemann in #​5469
• refactor connection tests to remove ReceivedPacketHandler mock by @​marten-seemann in #​5468
• ackhandler: remove ReceivedPacketHandler interface, use struct directly by @​marten-seemann in #​5472
• wire: add a function to trunctate an ACK frame by @​marten-seemann in #​5476
• allow packing of ACKs in coalesced packets by @​marten-seemann in #​5477
• improve batch packet processing logic by @​marten-seemann in #​5478
• build(deps): bump actions/cache from 4 to 5 by @​dependabot[bot] in #​5482
• build(deps): bump actions/upload-artifact from 5 to 6 by @​dependabot[bot] in #​5483
• update the logo by @​marten-seemann in #​5484
• ci: add Go 1.26rc1 to tested Go versions by @​marten-seemann in #​5486
• utils: make TestAddTimestamp work in all time zones by @​marten-seemann in #​5492
• ackhandler: record RTT measurements for non-ack-eliciting packets by @​marten-seemann in #​5494
• ackhandler: only generate RTT sample for the last ack-eliciting packet by @​marten-seemann in #​5493

Full Changelog: quic-go/quic-go@v0.57.0...v0.58.0

v0.57.1

Compare Source

This release resolves a panic during the server handshake when using the upcoming Go 1.26 toolchain, specifically occurring with TLS session tickets disabled (#​5462). This issue does not impact builds on Go 1.25 or earlier versions.

v0.57.0

Compare Source

This release contains a fix for CVE-2025-64702 by reworking the HTTP/3 header processing logic:

• Both client and server now send their respective header size constraints using the SETTINGS_MAX_FIELD_SECTION_SIZE setting: #​5431
• For any QPACK-related errors, the correct error code (QPACK_DECOMPRESSION_FAILED) is now used: #​5439
• QPACK header parsing is now incremental (instead of parsing all headers at once), which is ~5-10% faster and reduces allocations: #​5435 (and quic-go/qpack#67)
• The server now sends a 431 status code (Request Header Fields Too Large) when encountering HTTP header fields exceeding the size constraint: #​5452

 

Breaking Changes

• http3: Transport.MaxResponseBytes is now an int (before: int64): #​5433
   

Notable Fixes

• qlogwriter: fix storing of event schemas (this prevented qlog event logging from working for HTTP/3): #​5430
• http3: errors sending the request are now ignored, instead, the response from the server is read (thereby allowing the client to read the status code, for example): #​5432

What's Changed

• build(deps): bump golangci/golangci-lint-action from 8 to 9 by @​dependabot[bot] in #​5426
• qlogwriter: fix storing of event schemas by @​marten-seemann in #​5430
• http3: send SETTINGS_MAX_FIELD_SECTION_SIZE in the SETTINGS frame by @​marten-seemann in #​5431
• http3: read response after encountering error sending the request by @​marten-seemann in #​5432
• http3: make Transport.MaxResponseBytes an int by @​marten-seemann in #​5433
• http3: add a benchmark for header parsing by @​marten-seemann in #​5435
• update qpack to v0.6.0 by @​marten-seemann in #​5434
• http3: use QPACK_DECOMPRESSION_FAILED for QPACK errors by @​marten-seemann in #​5439
• add documentation for Conn.NextConnection by @​marten-seemann in #​5442
• ackhandler: don’t generate an immediate ACK for the first packet by @​marten-seemann in #​5447
• don’t arm connection timer for connection ID retirement by @​marten-seemann in #​5449
• README: add nodepass to list of projects by @​yosebyte in #​5448
• qlogwriter: use synctest to make tests deterministic by @​marten-seemann in #​5454
• http3: limit size of decompressed headers by @​marten-seemann in #​5452

New Contributors

• @​yosebyte made their first contribution in #​5448

Full Changelog: quic-go/quic-go@v0.56.0...v0.57.0

v0.56.0

Compare Source

This release introduces qlog support for HTTP/3 (#​5367, #​5372, #​5374, #​5375, #​5376, #​5381, #​5383).

For this, we completely changed how connection tracing works. Instead of a general-purpose logging.ConnectionTracer (which we removed entirely), we now have a qlog-specific tracer (#​5356, #​5417). quic-go users can now implement their own qlog events.

It also removes the Prometheus-based metrics collection. Please comment on the tracking issue (#​5294) if you rely on metrics and are interested in seeing metrics brought back in a future release.

Notable Changes

• replaced the unmaintained gojay with a custom, performance-optimized JSON encoder (#​5353, #​5371)
• quicvarint: improved panic message for numbers larger than 2^62 (#​5410)

Behind the Scenes

Go 1.25 introduced support for testing concurrent code using testing/synctest. We've been working on transitioning tests to use synctest (#​5357, #​5391, #​5393, #​5397, #​5398, #​5403, #​5414, #​5415), using @​MarcoPolo's simnet package to simulate a network in memory.

Using synctest makes test execution more reliable (reducing flakiness). The use of a synthetic clock leads to a massive speedup; the execution time of some integration tests was reduced from 20s to less than 1ms. The work will continue for the next release (see tracking issue: #​5386).

Changelog

• qlog: implement a minimal jsontext-like JSON encoder by @​marten-seemann in #​5353
• ci: remove 386 (32 bit x86) by @​MarcoPolo in #​5352
• use synctest in more connection tests by @​marten-seemann in #​5357
• qlog: split serializiation and event definitions, remove logging abstraction by @​marten-seemann in #​5356
• qlogwriter: implement the draft-12 trace header by @​marten-seemann in #​5360
• qlogwriter: add support for event_schemas in the trace header by @​marten-seemann in #​5361
• qlogwriter: pass the event time to Event.Encode by @​marten-seemann in #​5362
• ackhandler: fix qlogging of alarm timer expiration time by @​marten-seemann in #​5363
• qlog: privatize Encode functions of non-Event structs by @​marten-seemann in #​5364
• fix qlogging of the short header payload length by @​marten-seemann in #​5365
• ci: include OS and Go version in Codecov test report upload by @​marten-seemann in #​5370
• http3: add basic server-side qlog support by @​marten-seemann in #​5367
• jsontext: add support for encoding null by @​marten-seemann in #​5371
• qlog: use PathEndpointInfo in connection_started by @​marten-seemann in #​5368
• http3: fix qlog encoding of frame_parsed and frame_created events by @​marten-seemann in #​5372
• http3: add basic client-side qlog support by @​marten-seemann in #​5374
• readme: update oss-fuzz link by @​kriztalz in #​5377
• http3: qlog sent and received GOAWAY frames by @​marten-seemann in #​5376
• http3: qlog sent and received DATAGRAMs by @​marten-seemann in #​5375
• http3: move qlogging of frames into the frame parser by @​marten-seemann in #​5378
• http3: qlog sent and received SETTINGS frames by @​marten-seemann in #​5379
• http3: qlog the frame length and payload length of parsed frames by @​marten-seemann in #​5380
• http3: qlog reserved, unsupported and unknown frames by @​marten-seemann in #​5381
• http3: add the qlog event schema to trace header by @​marten-seemann in #​5383
• use default RTT (100ms) for 0-RTT if no prior estimate by @​marten-seemann in #​5388
• congestion: avoid overflows when calculating pacer budget by @​marten-seemann in #​5390
• add simnet package to simulate a net.PacketConn in memory by @​marten-seemann in #​5385
• use synctest for transport tests by @​marten-seemann in #​5391
• use simnet in CONNECTION_CLOSE retransmission test by @​marten-seemann in #​5395
• use synctest for the packet drop test by @​marten-seemann in #​5393
• use synctest for the handshake drop test by @​marten-seemann in #​5397
• use synctest for the datagram test by @​marten-seemann in #​5398
• use synctest for the timeout tests by @​marten-seemann in #​5403
• fix flaky TestConnectionUnpackFailureDropped by @​Copilot in #​5382
• fix flaky TestServerTransportClose by @​Copilot in #​5407
• ci: use gcassert to check that quicvarint.Len is inlined by @​marten-seemann in #​5409
• quicvarint: improve panic message for numbers larger 2^62 by @​marten-seemann in #​5410
• ci: bump actions/upload-artifact from 4 to 5 by @​dependabot[bot] in #​5411
• ci: update golangci-lint to v2.6.0 by @​marten-seemann in #​5412
• qlog: rename owner to initiator by @​marten-seemann in #​5416
• use synctest for the stateless reset tests by @​marten-seemann in #​5415
• ackhandler: fix qlogging of RTT values by @​marten-seemann in #​5418
• qlog: rework the ConnectionClosed event by @​marten-seemann in #​5417
• qlog: split the PTO count updates ouf of the MetricsUpdated event by @​marten-seemann in #​5421

New Contributors

• @​kriztalz made their first contribution in #​5377
• @​Copilot made their first contribution in #​5382

Full Changelog: quic-go/quic-go@v0.55.0...v0.56.0

v0.55.0

Compare Source

This release contains a number of improvements and fixes, and it updates the supported Go versions to 1.24 and 1.25.

Optimizations

When sending packets on a QUIC connection, RFC 9002 requires us to save the timestamp for every packet sent. In #​5344, we implemented a memory-optimized drop-in replacement for time.Time, which reduces the memory required from 24 to 8 bytes, and vastly speeds up timer calculations (which happen very frequently).

New Features

• Basic connection statistics are now exposed via Conn.ConnectionStats, thanks to @​MarcoPolo
• On some links, packet reordering can lead to spurious detections of packet loss when using the loss detection logic specified in RFC 9002. #​5355 adds logic detect when packet loss is detected spuriously.

Notable Fixes

• http3: don't allow usage of closed Transport: #​5324, thanks to @​Glonee
• http3: fix race in concurrent Transport.Roundtrip calls: #​5323, thanks to @​Glonee
• improve and fix connection timer logic: #​5339, thanks to @​sukunrt for a very comprehensive code review

Behind the Scenes

We have started transitioning tests to make use of the new synctest package that was added in Go 1.25 (and was available as a GOEXPERIMENT in Go 1.24): #​5291, #​5296, #​5298, #​5299, #​5302, #​5304, #​5305, #​5306, #​5317. This is a lot of work, but it makes the test execution both faster and more reliable.

Changelog

• wire: implement parsing and writing of the ACK_FREQUENCY frame by @​marten-seemann in #​5264
• wire: implement parsing and writing of the IMMEDIATE_ACK frame by @​marten-seemann in #​5265
• fuzzing: fix timeout in frame parser by @​jannis-seemann in #​5268
• wire: add support for the min_ack_delay transport parameter by @​marten-seemann in #​5266
• fix missing log statement for STREAM, DATAGRAM and ACK by @​jannis-seemann in #​5273
• qlog: add support for ACK_FREQUENCY and IMMEDIATE_ACK frames by @​marten-seemann in #​5276
• ackhandler: remove unused time from receivedPacketHandler.ReceivedPacket by @​marten-seemann in #​5277
• quicvarint: extend benchmark to use quicvarint.Reader by @​marten-seemann in #​5278
• quicvarint: tolerate empty reads of the underlying io.Reader by @​bemasc in #​5275
• http3: fix documentation for Server.ServeListener by @​WeidiDeng in #​5282
• expose connection stats via Conn.ConnectionStats by @​marten-seemann in #​5281
• ackhandler: generalize check for missing packets below threshold by [@​marten-seemann](https://redirec

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 4 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.20 -> 1.22
golang.org/x/net	v0.11.0 -> v0.28.0
golang.org/x/crypto	v0.10.0 -> v0.26.0
golang.org/x/exp	v0.0.0-20230522175609-2e198f4a06a1 -> v0.0.0-20240506185415-9bf2ced13842
golang.org/x/mod	v0.11.0 -> v0.18.0

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​quic-go/​quic-go@​v0.35.1 ⏵ v0.59.1	+1	+27
	golang.org/​x/​net@​v0.11.0 ⏵ v0.43.0	+1	+27

View full report

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.20 -> 1.24
golang.org/x/net	v0.11.0 -> v0.43.0
golang.org/x/crypto	v0.10.0 -> v0.41.0