Skip to content

build(deps): bump github.com/quic-go/quic-go from 0.60.0 to 0.61.0 - #2192

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/go_modules/github.com/quic-go/quic-go-0.61.0
Jul 27, 2026
Merged

github-actions[bot] merged 1 commit into
mainfrom
dependabot/go_modules/github.com/quic-go/quic-go-0.61.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor

Bumps github.com/quic-go/quic-go from 0.60.0 to 0.61.0.

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.61.0

This release adds new stream APIs intended for application protocols that perform their own flow-control accounting, such as WebTransport:

  • SendStream and Stream now expose TryWriteAll, which queues an entire buffer without blocking or returns ErrWouldBlock without queueing anything: #5704
  • SendStream and Stream now expose WriteWithLimit, allowing higher-level protocols to apply an additional send limit while data is packetized: #5753
  • ReceiveStream and Stream now expose SetReceiveFinalSizeCallback, which reports the final receive-side stream size once it is learned from a FIN or RESET_STREAM frame: #5752

Support for the RESET_STREAM_AT extension was updated to draft-09, while retaining support for the draft-07 codepoint for backwards compatibility: #5724

Breaking Changes

  • http3: ParseCapsule was replaced by the stateful CapsuleParser and CapsuleReader APIs. Each capsule payload must now be consumed or discarded before advancing to the next capsule: #5729
  • The StreamID.Type and StreamID.InitiatedBy methods were removed because they exposed internal types: #5744
  • qlog: datagram IDs were replaced by CRC32c payload checksums. The JSON field is now datagram_payload_checksum instead of datagram_id, and the corresponding exported qlog types were renamed: #5758

Notable Fixes

  • Transport parameter parsing is around 27% faster and now reliably rejects duplicate transport parameters: #5712
  • Session tickets containing unknown transport parameters are now rejected during restoration, preventing 0-RTT resumption when an endpoint no longer understands an extension recorded in the ticket: #5714
  • RESET_STREAM_AT negotiation is now applied correctly to streams opened before transport parameters are received during 0-RTT: #5715
  • RESET_STREAM_AT support is now cleared after 0-RTT rejection, preventing new streams from inheriting the rejected connection's setting: #5716
  • Pending stream control frames from a rejected 0-RTT attempt are now discarded instead of being sent after rejection: #5717
  • Remembered RESET_STREAM_AT support is now validated across 0-RTT resumption: #5722
  • http3: receiving a GOAWAY now unblocks pending OpenStreamSync calls and prevents new request streams from being opened: #5730
  • http3: invalid header values are no longer included in validation errors, avoiding accidental exposure of sensitive values when errors are logged: #5742

Changelog

... (truncated)

Commits
  • 579ee19 add SendStream.WriteWithLimit for higher-level flow control (#5753)
  • b1e850a guard qlogger when dropping malformed short-header packets (#5759)
  • 2d093f1 qlog: replace datagram IDs with CRC32c payload checksums (#5758)
  • 4e52cbd replace receive stream final size wait with callback (#5752)
  • 353abe2 ci: bump actions/setup-go from 6 to 7 (#5756)
  • fbfa1d5 fix flaky TestDatagramSizeLimitWithMTUDiscovery (#5751)
  • 124e085 rename ReceiveStream.WaitForFinalSize to WaitForReceiveFinalSize (#5750)
  • a8ac06a update golang.org/x/crypto to v0.54.0 (#5749)
  • bc8d524 ci: run Codspeed on pull requests and on master (#5748)
  • dab2973 rename SendStream.WriteImmediately to TryWriteAll (#5747)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) from 0.60.0 to 0.61.0.
- [Release notes](https://github.com/quic-go/quic-go/releases)
- [Commits](quic-go/quic-go@v0.60.0...v0.61.0)

---
updated-dependencies:
- dependency-name: github.com/quic-go/quic-go
  dependency-version: 0.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jul 27, 2026
@github-actions
github-actions Bot enabled auto-merge (squash) July 27, 2026 04:52
@github-actions
github-actions Bot merged commit 82777ca into main Jul 27, 2026
20 checks passed
@github-actions
github-actions Bot deleted the dependabot/go_modules/github.com/quic-go/quic-go-0.61.0 branch July 27, 2026 04:57
dadezzz pushed a commit to dadezzz/infra_docker-compose that referenced this pull request Jul 28, 2026
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/0xerr0r/blocky](https://github.com/0xERR0R/blocky) | minor | `v0.33.0` → `v0.34.0` |

---

### Release Notes

<details>
<summary>0xERR0R/blocky (ghcr.io/0xerr0r/blocky)</summary>

### [`v0.34.0`](https://github.com/0xERR0R/blocky/releases/tag/v0.34.0)

[Compare Source](0xERR0R/blocky@v0.33.0...v0.34.0)

#### Changelog

##### Bug fixes

- [`91a8f44`](0xERR0R/blocky@91a8f44): fix(bootstrap): fall back to other resolved addresses when a dial fails ([#&#8203;2190](0xERR0R/blocky#2190)) ([@&#8203;maximilize](https://github.com/maximilize))
- [`0a20671`](0xERR0R/blocky@0a20671): fix(cache): set DO bit on prefetch reloads to keep DNSSEC-signed entry valid ([#&#8203;2158](0xERR0R/blocky#2158)) ([@&#8203;logingood](https://github.com/logingood))
- [`d55cd4f`](0xERR0R/blocky@d55cd4f): fix(docker): pre-create writable /app/cache and /logs owned by UID 100 ([#&#8203;2172](0xERR0R/blocky#2172)) ([@&#8203;0xERR0R](https://github.com/0xERR0R))
- [`dc958ef`](0xERR0R/blocky@dc958ef): fix(lists): skip a lone "/" blocklist line instead of panicking ([#&#8203;2156](0xERR0R/blocky#2156)) ([@&#8203;maximilize](https://github.com/maximilize))
- [`1d450af`](0xERR0R/blocky@1d450af): fix(resolver): match custom DNS PTR queries case insensitively ([#&#8203;2191](0xERR0R/blocky#2191)) ([@&#8203;maximilize](https://github.com/maximilize))
- [`472bac9`](0xERR0R/blocky@472bac9): fix(stats): attribute filtered and non-FQDN queries to the client name ([#&#8203;2167](0xERR0R/blocky#2167)) ([@&#8203;0xERR0R](https://github.com/0xERR0R))
- [`c07bd55`](0xERR0R/blocky@c07bd55): fix(stats): count only true blocks (BLOCKED) as blocked ([#&#8203;2161](0xERR0R/blocky#2161)) ([@&#8203;maximilize](https://github.com/maximilize))
- [`8435342`](0xERR0R/blocky@8435342): fix(stats): give DNS rebinding protection its own REBIND response type ([#&#8203;2166](0xERR0R/blocky#2166)) ([@&#8203;0xERR0R](https://github.com/0xERR0R))

##### Build and dependencies

- [`c163c75`](0xERR0R/blocky@c163c75): build(deps): bump actions/setup-go from 6 to 7 ([#&#8203;2168](0xERR0R/blocky#2168)) ([@&#8203;dependabot](https://github.com/dependabot)\[bot])
- [`958760d`](0xERR0R/blocky@958760d): build(deps): bump github.com/breml/rootcerts from 0.3.6 to 0.3.7 ([#&#8203;2181](0xERR0R/blocky#2181)) ([@&#8203;dependabot](https://github.com/dependabot)\[bot])
- [`d94652f`](0xERR0R/blocky@d94652f): build(deps): bump github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1 ([#&#8203;2157](0xERR0R/blocky#2157)) ([@&#8203;dependabot](https://github.com/dependabot)\[bot])
- [`d784ac5`](0xERR0R/blocky@d784ac5): build(deps): bump github.com/jedib0t/go-pretty/v6 from 6.8.1 to 6.8.2 ([#&#8203;2154](0xERR0R/blocky#2154)) ([@&#8203;dependabot](https://github.com/dependabot)\[bot])
- [`23575a4`](0xERR0R/blocky@23575a4): build(deps): bump github.com/jedib0t/go-pretty/v6 from 6.8.2 to 6.8.3 ([#&#8203;2183](0xERR0R/blocky#2183)) ([@&#8203;dependabot](https://github.com/dependabot)\[bot])
- [`b1f8a72`](0xERR0R/blocky@b1f8a72): build(deps): bump github.com/oapi-codegen/runtime from 1.4.2 to 1.5.0 ([#&#8203;2164](0xERR0R/blocky#2164)) ([@&#8203;dependabot](https://github.com/dependabot)\[bot])
- [`4fda662`](0xERR0R/blocky@4fda662): build(deps): bump github.com/oapi-codegen/runtime from 1.5.0 to 1.6.0 ([#&#8203;2170](0xERR0R/blocky#2170)) ([@&#8203;dependabot](https://github.com/dependabot)\[bot])
- [`7c8aeb4`](0xERR0R/blocky@7c8aeb4): build(deps): bump github.com/pires/go-proxyproto from 0.12.0 to 0.13.0 ([#&#8203;2153](0xERR0R/blocky#2153)) ([@&#8203;dependabot](https://github.com/dependabot)\[bot])
- [`77c115b`](0xERR0R/blocky@77c115b): build(deps): bump github.com/pires/go-proxyproto from 0.13.0 to 0.14.0 ([#&#8203;2155](0xERR0R/blocky#2155)) ([@&#8203;dependabot](https://github.com/dependabot)\[bot])
- [`6154af2`](0xERR0R/blocky@6154af2): build(deps): bump github.com/pires/go-proxyproto from 0.14.0 to 0.15.0 ([#&#8203;2162](0xERR0R/blocky#2162)) ([@&#8203;dependabot](https://github.com/dependabot)\[bot])
- [`bd9e3ae`](0xERR0R/blocky@bd9e3ae): build(deps): bump github.com/prometheus/client\_golang from 1.23.2 to 1.24.0 ([#&#8203;2185](0xERR0R/blocky#2185)) ([@&#8203;dependabot](https://github.com/dependabot)\[bot])
- [`6fd79dd`](0xERR0R/blocky@6fd79dd): build(deps): bump github.com/prometheus/client\_golang from 1.24.0 to 1.24.1 ([#&#8203;2193](0xERR0R/blocky#2193)) ([@&#8203;dependabot](https://github.com/dependabot)\[bot])
- [`82777ca`](0xERR0R/blocky@82777ca): build(deps): bump github.com/quic-go/quic-go from 0.60.0 to 0.61.0 ([#&#8203;2192](0xERR0R/blocky#2192)) ([@&#8203;dependabot](https://github.com/dependabot)\[bot])
- [`59f0b0f`](0xERR0R/blocky@59f0b0f): build(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 ([#&#8203;2159](0xERR0R/blocky#2159)) ([@&#8203;dependabot](https://github.com/dependabot)\[bot])
- [`288ff55`](0xERR0R/blocky@288ff55): build(deps): bump oapi-codegen to 2.7.1 and kin-openapi to 0.144.0 ([#&#8203;2195](0xERR0R/blocky#2195)) ([@&#8203;0xERR0R](https://github.com/0xERR0R))

##### Misc

- [`541860d`](0xERR0R/blocky@541860d): ci: automate sponsor list in README ([#&#8203;2173](0xERR0R/blocky#2173)) ([@&#8203;0xERR0R](https://github.com/0xERR0R))
- [`493142d`](0xERR0R/blocky@493142d): ci: build sponsor avatar URLs from the login to avoid HTML escaping ([#&#8203;2177](0xERR0R/blocky#2177)) ([@&#8203;0xERR0R](https://github.com/0xERR0R))
- [`d9e2827`](0xERR0R/blocky@d9e2827): ci: fail the sponsors job instead of silently wiping the sponsor list ([#&#8203;2175](0xERR0R/blocky#2175)) ([@&#8203;0xERR0R](https://github.com/0xERR0R))

***

#### ❤️ Support Blocky

Blocky is free and open source, developed in my spare time — no telemetry, no ads, no hidden
filtering. If it's useful to you, please consider supporting its continued development:

[GitHub Sponsors](https://github.com/sponsors/0xERR0R) ·
[thanks.dev](https://thanks.dev/u/gh/0xERR0R) ·
[Liberapay](https://liberapay.com/spx01) ·
[Ko-fi](https://ko-fi.com/0xerr0r) ·
[PayPal](https://paypal.me/spx01)

Thank you to everyone supporting Blocky! 🙏

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI4MS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant