Skip to content

chore(deps): bump github.com/quic-go/quic-go from 0.60.0 to 0.61.0 in /evaders/go-tls in the go-tls-go group - #276

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/evaders/go-tls/go-tls-go-bf0c0d0d33
Open

chore(deps): bump github.com/quic-go/quic-go from 0.60.0 to 0.61.0 in /evaders/go-tls in the go-tls-go group#276
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/evaders/go-tls/go-tls-go-bf0c0d0d33

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 30, 2026

Copy link
Copy Markdown

Bumps the go-tls-go group in /evaders/go-tls with 1 update: github.com/quic-go/quic-go.

Updates github.com/quic-go/quic-go from 0.60.0 to 0.61.0

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.61.0

This release adds new stream APIs intended for application protocols that perform their own flow-control accounting, such as WebTransport:

  • SendStream and Stream now expose TryWriteAll, which queues an entire buffer without blocking or returns ErrWouldBlock without queueing anything: #5704
  • SendStream and Stream now expose WriteWithLimit, allowing higher-level protocols to apply an additional send limit while data is packetized: #5753
  • ReceiveStream and Stream now expose SetReceiveFinalSizeCallback, which reports the final receive-side stream size once it is learned from a FIN or RESET_STREAM frame: #5752

Support for the RESET_STREAM_AT extension was updated to draft-09, while retaining support for the draft-07 codepoint for backwards compatibility: #5724

Breaking Changes

  • http3: ParseCapsule was replaced by the stateful CapsuleParser and CapsuleReader APIs. Each capsule payload must now be consumed or discarded before advancing to the next capsule: #5729
  • The StreamID.Type and StreamID.InitiatedBy methods were removed because they exposed internal types: #5744
  • qlog: datagram IDs were replaced by CRC32c payload checksums. The JSON field is now datagram_payload_checksum instead of datagram_id, and the corresponding exported qlog types were renamed: #5758

Notable Fixes

  • Transport parameter parsing is around 27% faster and now reliably rejects duplicate transport parameters: #5712
  • Session tickets containing unknown transport parameters are now rejected during restoration, preventing 0-RTT resumption when an endpoint no longer understands an extension recorded in the ticket: #5714
  • RESET_STREAM_AT negotiation is now applied correctly to streams opened before transport parameters are received during 0-RTT: #5715
  • RESET_STREAM_AT support is now cleared after 0-RTT rejection, preventing new streams from inheriting the rejected connection's setting: #5716
  • Pending stream control frames from a rejected 0-RTT attempt are now discarded instead of being sent after rejection: #5717
  • Remembered RESET_STREAM_AT support is now validated across 0-RTT resumption: #5722
  • http3: receiving a GOAWAY now unblocks pending OpenStreamSync calls and prevents new request streams from being opened: #5730
  • http3: invalid header values are no longer included in validation errors, avoiding accidental exposure of sensitive values when errors are logged: #5742

Changelog

... (truncated)

Commits
  • 579ee19 add SendStream.WriteWithLimit for higher-level flow control (#5753)
  • b1e850a guard qlogger when dropping malformed short-header packets (#5759)
  • 2d093f1 qlog: replace datagram IDs with CRC32c payload checksums (#5758)
  • 4e52cbd replace receive stream final size wait with callback (#5752)
  • 353abe2 ci: bump actions/setup-go from 6 to 7 (#5756)
  • fbfa1d5 fix flaky TestDatagramSizeLimitWithMTUDiscovery (#5751)
  • 124e085 rename ReceiveStream.WaitForFinalSize to WaitForReceiveFinalSize (#5750)
  • a8ac06a update golang.org/x/crypto to v0.54.0 (#5749)
  • bc8d524 ci: run Codspeed on pull requests and on master (#5748)
  • dab2973 rename SendStream.WriteImmediately to TryWriteAll (#5747)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump github.com/quic-go/quic-go
00ccec1 
Bumps the go-tls-go group in /evaders/go-tls with 1 update: [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go).


Updates `github.com/quic-go/quic-go` from 0.60.0 to 0.61.0
- [Release notes](https://github.com/quic-go/quic-go/releases)
- [Commits](quic-go/quic-go@v0.60.0...v0.61.0)

---
updated-dependencies:
- dependency-name: github.com/quic-go/quic-go
  dependency-version: 0.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-tls-go
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 30, 2026
@dependabot
dependabot Bot requested a review from datascry as a code owner July 30, 2026 01:13
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@datascry datascry Awaiting requested review from datascry datascry is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants