[dependabot]

Bumps github.com/quic-go/quic-go from 0.64.1 to 0.65.0.

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.65.0

This release updates qlog to the latest IETF drafts, adds explicit stream credit release, and fixes a number of HTTP/3 and connection migration bugs.

• With Config.RequireStreamCreditRelease, completed streams count towards the incoming stream limit until the application calls ReleaseStreamCredit: #5981, #5982
• qlog: events now follow draft-ietf-quic-qlog-quic-events-14 and draft-ietf-quic-qlog-h3-events-14: #6120

Breaking Changes

• http3: HTTPStreamer.HTTPStream now returns (*Stream, error), and no longer sends an implicit 200 response: #5988, #5994

Notable Fixes

• QUIC v2 key updates now use the correct quicv2 ku label: #5973
• Connections using zero-length connection IDs no longer stop receiving packets after version negotiation: #6129
• Switching paths now uses a new connection ID, fixing servers that kept sending to the old address after repeated NAT rebindings: #6015
• Clients now send PATH_RESPONSE on the path the PATH_CHALLENGE was received on: #5980
• Path.Probe now succeeds on an already validated path: #6019
• Reordered and retransmitted NEW_CONNECTION_ID frames are now handled correctly: #6009, #6007
• DATAGRAM frames no longer starve ACKs, control frames and retransmissions: #5970
• CancelRead now unblocks Read and Peek after receiving RESET_STREAM_AT: #6022
• TryWriteAll no longer copies queued data quadratically: #6042, #6043
• http3: canceling the first request to a host no longer cancels the shared dial: #6132
• http3: bodies shorter than the announced Content-Length now fail with io.ErrUnexpectedEOF: #5913
• http3: Content-Length is no longer added to 204 and 304 responses, and is now sent for requests with http.NoBody: #6032, #6029
• http3: response writes that fail partway (e.g. on a write deadline) no longer corrupt the stream: #5993, #6002, #6001, #6003
• http3: canceling an Extended CONNECT request now interrupts waiting for SETTINGS: #6020
• qlog fixes:
  • incorrect or missing values for transport parameters, packet numbers, congestion metrics, timers, connection IDs and lengths: #6050, #6054, #6059, #6060, #6074, #6077, #6091, #6023, #5969
  • stateless resets are logged as remote closures: #6063
  • concurrently recorded events are written in order: #5956
  • traces of connections abandoned after version negotiation are closed: #6130
  • http3: traces no longer close before all events are recorded: #6090, #6083, #6041

Notable Changes

• Multiple DATAGRAM frames are now packed into a single packet: #5961, #5960
• qlog: new connection_state_updated and HTTP/3 stream_type_set events, and tuples for path probing and migration: #6111, #6113, #5977, #5979
• qlog: qlog.RedactIPs redacts IP addresses and ports: #5943
• qlog: HTTP/3 connections now use qlog.DefaultConnectionTracer; http3/qlog.DefaultConnectionTracer is removed: #5966
• Reduced allocations during the handshake: #6096, #6093, #6098, #6097, #6095

Changelog

• ci: bump CodSpeedHQ/action from 5.4.0 to 5.5.0 by @​dependabot[bot] in quic-go/quic-go#5945
• qlogwriter: fix ordering of concurrently recorded events by @​marten-seemann in quic-go/quic-go#5956
• omit the length field of the last DATAGRAM frame in a packet by @​marten-seemann in quic-go/quic-go#5960
• remove obsolete curve ID helpers from handshake tests by @​marten-seemann in quic-go/quic-go#5968
• handshake: remove obsolete session ticket error workaround by @​marten-seemann in quic-go/quic-go#5967
• pack multiple DATAGRAM frames into a packet by @​marten-seemann in quic-go/quic-go#5961
• qlog: register event schemas on init, remove Trace.SupportsSchemas by @​marten-seemann in quic-go/quic-go#5966

... (truncated)

Commits

• aa265c3 http3: don't cancel a shared dial when the first request is canceled (#6132)
• 7c2906f qlog: close the trace of a connection abandoned after version negotiation (#6...
• faa3b83 remove the old connection immediately after version negotiation (#6129)
• 946bda4 ci: use a daily Go build cache for unit and integration tests (#6124)
• 99d6d1e qlog: map packet drop reasons to packet_dropped triggers (#6055)
• 91d541c ci: delete outdated cross-compilation build caches (#6122)
• 3ee97eb README: list tools supporting quic-go (#6123)
• 3316624 ci: run benchmarks for a fixed number of iterations (#6121)
• 220eda8 ci: cancel outdated PR runs (#6118)
• 0bf3ea5 qlog: update event schema URIs to quic-events-14 and h3-events-14 (#6120)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

Claude Code Review

Claude Code Review is paused for this repository because its GitHub organization is not linked to your Claude organization.

To turn it back on, one person needs both roles: owner of the GitHub organization (or the account owner, for a personal repository) and admin or owner of your Claude organization. If that is not you, pass this on to someone who is.

Open Organization settings, Git providers and click Link next to the GitHub organization's name. If it is not listed, click Enable GitHub integration or Connect your GitHub first, whichever the page shows.

New pull requests are then reviewed as before. To get a review on one that is already open, someone with write access can comment @claude review.

_{Tip: disable this comment in your organization's Code Review settings.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​quic-go/​quic-go@​v0.64.1 ⏵ v0.65.0	+1

View full report

[ChrisSchinnerl]

Closing for now since this also requires webtransport-go to release a new version