fix(deps): update module github.com/quic-go/quic-go to v0.62.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/quic-go/quic-go	v0.61.0 → v0.62.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

quic-go/quic-go (github.com/quic-go/quic-go)

v0.62.0

Compare Source

This release adds support for stream priorities based on RFC 9218:

• SendStream and Stream now expose SetPriority, allowing applications to set the urgency and incremental scheduling behavior of stream data. Retransmissions are prioritized over new stream data and respect stream priorities: #​5770, #​5774
• HTTP/3 servers now apply priorities from request Priority headers and PRIORITY_UPDATE frames. Priority updates are also recorded in qlog for both HTTP/3 and QUIC streams: #​5783, #​5789, #​5790, #​5795

Notable Changes

• http3.Stream and http3.RequestStream now expose TryWriteAll, which queues a complete DATA frame without blocking or returns quic.ErrWouldBlock without queueing anything: #​5765
• Reliable Stream Resets are now advertised using both the draft-09 and legacy draft-07 transport parameters, restoring interoperability with Safari for WebTransport: #​5782, thanks to @​0xFA11

Breaking Changes

• quic-go now requires Go 1.26 or newer: #​5801

Notable Fixes

• Connections now reject unread CRYPTO data as soon as TLS advances to the next encryption level, instead of waiting until the previous keys are discarded: #​5824
• http3: servers now reject 0-RTT when their current SETTINGS are incompatible with those stored in the session ticket, preventing early requests from relying on settings the server no longer supports: #​5771
• http3: requests containing userinfo in :authority are now rejected for HTTP and HTTPS URIs: #​5825
• http3: request schemes are now normalized to lowercase: #​5826
• http3: request methods are now validated as HTTP tokens; unknown methods with valid syntax remain accepted: #​5827
• http3: Host is now used for HTTP and HTTPS requests when :authority is omitted, while conflicting Host and :authority values are rejected: #​5828
• http3: regular CONNECT requests containing :scheme are now rejected: #​5829
• http3: requests containing duplicate Host header fields are now rejected: #​5830
• http3: empty pseudo-header fields are no longer treated as omitted, ensuring duplicate fields and CONNECT requirements are validated correctly: #​5833
• http3: successful CONNECT responses are no longer transparently gzip-decoded, preserving tunnel data and the Content-Encoding header: #​5834
• Conn.NextConnection now returns the connection context's error if the connection closes before the handshake completes: #​5764, thanks to @​floating-cat
• Closing a validated path now retires its connection ID, without racing connection shutdown and panicking: #​5798, #​5823, thanks to @​tlstpierre
• OpenBSD now requests a supported 2 MiB socket buffer size and correctly verifies the configured size, avoiding ineffective buffer increases and spurious warnings: #​5787, thanks to @​the-sarge

Changelog

• return error from Conn.NextConnection when the connection is closed by @​floating-cat in #​5764
• ci: bump docker/login-action from 4.4.0 to 4.5.1 by @​dependabot[bot] in #​5766
• http3: expose TryWriteAll method on Stream and RequestStream by @​marten-seemann in #​5765
• http3: make server reject 0-RTT when settings are incompatible by @​marten-seemann in #​5771
• prioritize retransmissions over sending new stream data by @​marten-seemann in #​5770
• ringbuffer: optimize memory consumption of the ring buffer data structure by @​marten-seemann in #​5773
• ci: bump CodSpeedHQ/action from 4.18.5 to 5.0.1 by @​dependabot[bot] in #​5775
• ci: bump docker/login-action from 4.5.1 to 4.6.0 by @​dependabot[bot] in #​5776
• ci: bump CodSpeedHQ/action from 5.0.1 to 5.0.3 by @​dependabot[bot] in #​5778
• implement RFC 9218-style stream priorities for Stream and SendStream by @​marten-seemann in #​5774
• inline stream priority buckets in the framer by @​marten-seemann in #​5779
• avoid locking stream mutex when reading priorities in the framer by @​marten-seemann in #​5781
• http3: implement handling of RFC 9218 priority headers by @​marten-seemann in #​5783
• offer both draft-09 and draft-07 of Reliable Stream Resets by @​0xFA11 in #​5782
• http3: add support for handling RFC 9218 PRIORITY_UPDATE frames by @​marten-seemann in #​5789
• remove receive-side checks from connection flow controller reset by @​marten-seemann in #​5791
• remove unused mtuDiscoverer interface by @​marten-seemann in #​5792
• http3: add qlog support for PRIORITY_UPDATE frames by @​marten-seemann in #​5790
• README: add RFC 9218 by @​marten-seemann in #​5788
• README: organize specifications and list related projects by @​marten-seemann in #​5793
• cap the socket buffer size at 2 MB on OpenBSD by @​the-sarge in #​5787
• link API references in documentation by @​marten-seemann in #​5794
• add qlog support for QUIC stream prioritites by @​marten-seemann in #​5795
• ci: update golangci-lint to v2.13.0 by @​marten-seemann in #​5800
• ci: bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @​dependabot[bot] in #​5811
• ci: disable ClusterFuzz until OSS-Fuzz supports Go 1.27 by @​marten-seemann in #​5808
• update to Go 1.27, drop Go 1.25 by @​marten-seemann in #​5801
• use tls.ClientHelloInfo.HelloRetryRequest in tests by @​marten-seemann in #​5802
• use tls.QUICErrorEvent directly by @​marten-seemann in #​5805
• use crypto/fips140.WithoutEnforcement directly by @​marten-seemann in #​5806
• update github.com/stretchr/testify to v1.12.1 by @​marten-seemann in #​5821
• return an error for unsupported OOBCapablePacketConns by @​marten-seemann in #​5820
• Retire the connection ID when closing a validated path by @​tlstpierre in #​5798
• prevent path closure from racing connection shutdown by @​marten-seemann in #​5823
• check for unread CRYPTO data when advancing encryption levels by @​marten-seemann in #​5824
• http3: reject userinfo subcomponent in URIs by @​marten-seemann in #​5825
• http3: normalize request schemes to lowercase by @​marten-seemann in #​5826
• http3: validate request method syntax by @​marten-seemann in #​5827
• http3: reject regular CONNECT requests with :scheme by @​marten-seemann in #​5829
• http3: support Host when :authority is omitted by @​marten-seemann in #​5828
• http3: reject duplicate Host header fields by @​marten-seemann in #​5830
• http3: distinguish empty pseudo-header fields from omitted ones by @​marten-seemann in #​5833
• http3: don't use gzip to decompress successful CONNECT responses by @​marten-seemann in #​5834
• add an integration test for stream priorities by @​marten-seemann in #​5835

New Contributors

• @​floating-cat made their first contribution in #​5764
• @​0xFA11 made their first contribution in #​5782
• @​the-sarge made their first contribution in #​5787
• @​tlstpierre made their first contribution in #​5798

Full Changelog: quic-go/quic-go@v0.61.0...v0.62.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.25.0 -> 1.26.0

[pikachuren]

🙏 感谢 @app/renovate 提交！
🤖 AI 自动审核声明：本评审报告由 AI 自动生成，当前使用 Claude Opus 5 模型进行分析。
⚠️ AI 分析结果仅供参考，可能存在误判或遗漏。如您发现任何问题或有不同意见，欢迎随时提出讨论和纠正。
⚠️ 重要提醒：即使 AI 评审认为代码质量良好且建议合并，最终是否合并仍需由项目维护者进行人工判定。项目维护者会综合考虑代码质量、项目规划、技术方向、团队资源等多方面因素做出决策。

🎯 结论

🔄 Request Changes — 上游代码本身安全，但本 PR 同时把 go 1.25.0 提升到 go 1.26.0，需要维护者确认是否接受

📖 概要

fix(deps): update module github.com/quic-go/quic-go to v0.62.0 · Renovate 自动依赖升级。
核心改动：quic-go v0.61.0 → v0.62.0，同时将 go.mod 的 go directive 从 1.25.0 提升到 1.26.0。

🧭 整体方案

版本号提升，无业务代码改动。但 quic-go v0.62.0 要求更高的 Go 版本，Renovate 因此连带修改了 go directive——这一点会影响整个项目的最低 Go 版本要求和 CI 镜像，属于超出「依赖升级」范畴的隐性影响，值得单独确认。

📊 变更统计

2 个文件（+4 / -2 行） | 功能 ⭐⭐⭐⭐ | 最小改动 ⭐⭐⭐ | 前向兼容 ⭐⭐⭐ | 方案设计 ⭐⭐⭐⭐

🚨 关键问题

P0（阻塞合并）：无

P1（建议修复）：

• ⚠️ go.mod — go 1.25.0 → go 1.26.0 会抬高整个项目的最低 Go 版本门槛，影响 CI 构建镜像、发行版打包以及下游二次开发者的工具链要求。请问项目当前是否已准备好全面切换到 Go 1.26？如果 CI 里还有固定 1.25 的 job，合并后可能直接构建失败。是否考虑先确认 CI 配置同步、或等 Go 1.26 更稳定后再合入呢？

P2（可选）：

• 💡 建议在 PR 描述中显式标注「本次升级附带 Go 版本要求提升」，避免维护者仅按普通依赖升级处理而忽略这一点~

🔐 依赖安全审查

• 审查范围：quic-go v0.61.0 → v0.62.0，上游 44 个 commits、120 个文件（+3078/-1201）
• 审查方式：拉取 quic-go/quic-go 仓库 v0.61.0...v0.62.0 完整 diff，并对生产代码做恶意模式扫描
• 安全评估：✅ 无恶意代码
• 详细结论：
  • 未发现 exec.Command / os/exec / 异常 http.Post / net.Dial 回连 / base64 混淆负载 / unsafe.Pointer 滥用
  • 改动主要为协议实现优化、CI workflow 调整（clusterfuzz、govulncheck、cross-compile 等）与测试补充
  • go.mod 新增项仅 github.com/stretchr/testify v1.12.1（测试依赖）与 go.yaml.in/yaml/v3 v3.0.5（indirect），无可疑第三方包
  • 上游为知名活跃项目，有 fuzzing 与 govulncheck 常态化流程

✅ 待处理清单

• [P1] 确认项目是否接受最低 Go 版本提升到 1.26，并同步检查 CI / Dockerfile / 打包脚本中的 Go 版本
• [P2] 在 PR 描述中标注 Go 版本要求变更

🎯 结论：🔄 Request Changes — 上游代码安全无虞，但 Go 版本门槛提升需维护者明确确认后再合并。