fix(deps): update module github.com/quic-go/quic-go to v0.37.4 #206

Merged
sam merged 2 commits from renovate/github.com-quic-go-quic-go-0.x into master 2023-08-10 15:07:32 +00:00
Collaborator

This PR contains the following updates:

Package Type Update Change
github.com/quic-go/quic-go require minor v0.36.2 -> v0.37.4

Release Notes

quic-go/quic-go

v0.37.4

Compare Source

This release contains a fix for a last-minute breaking API change in Go 1.21: https://github.com/quic-go/quic-go/pull/4020

Full Changelog: https://github.com/quic-go/quic-go/compare/v0.37.3...v0.37.4

v0.37.3

Compare Source

This patch release

  • fixes handling of ACK frames serialized after CRYPTO frames: #​4018
  • sets a net.Conn on the tls.ClientHelloInfo used on GetCertificate and GetConfigForClient, for tls.Configs returned (recursively) from GetConfigForClient: https://github.com/quic-go/quic-go/pull/4016

Full Changelog: https://github.com/quic-go/quic-go/compare/v0.37.2...v0.37.3

v0.37.2

Compare Source

This patch release

Note that in order to be protected against the DoS attack making use of large RSA keys, it's necessary to update to this patch release (for Go 1.20). For Go 1.21, please update the Go compiler.

Full Changelog: https://github.com/quic-go/quic-go/compare/v0.37.1...v0.37.2

v0.37.1

Compare Source

This is a patch release fixing two regressions introduced in the v0.37.0 release:

New Contributors

Full Changelog: https://github.com/quic-go/quic-go/compare/v0.37.0...v0.37.1

v0.37.0

Compare Source

crypto/tls changes

With the upcoming Go 1.21 release, we're now able to rely on the Go standard library's TLS implementation's QUIC support.

If you're curious, here are the discussions that happened in the Go project's GitHub:

Special thanks to @​FiloSottile and @​neild for the constructive discussions around the new API, and for making this happen!

Using this new API required major changes to the way quic-go interacts with the TLS stack (#​3860 and #​3939), but ultimately, the new API is a lot cleaner than what we had before.

This means that starting with Go 1.21, we won't have to fork crypto/tls anymore, resolving a longstanding issue (#​2727). This also resolves a major pain point for the community, since quic-go now doesn't have to enforce a specific compiler version any longer.
Note that this release still supports Go 1.20 (in line with our policy to always support the two most recent Go versions), which still uses (a completely rewritten) fork of crypto/tls. We're looking forward to dropping support for Go 1.20 once Go 1.22 is released next year.

Other Notable Changes

  • We dropped support for the QUIC draft-29. This draft version was somewhat widely deployed on the internet before RFC 9000 was finalized, but has been phased out since then. quic-go now supports QUIC version 1 (RFC 9000) and version 2 (RFC 9369).
  • Connection.ReceiveMessage now takes a context.Context, allowing the caller to make the call return, even if no message is received: https://github.com/quic-go/quic-go/pull/3926. Thanks to @​Glonee for the implementation!
  • A long list of added validations (as required by RFC 9114 and RFC 9110) for request and response parsing in the http3 package, mostly around the processing of headers. Thanks to @​Mephue for finding one of the missing checks, and to @​WeidiDeng for finding and fixing multiple of them!
  • quic-go now sets the DF bit on packets sent on macOS (as we've done for a long time on Linux already). This allows us to do DPLPMTUD (Path MTU discovery): https://github.com/quic-go/quic-go/pull/3946. Thanks to @​sukunrt for implementing!
  • The stream and the connection errors are now surfaced via the contexts exposed by Stream.Context and Connection.Context, and can be accessed by calling context.Cause (#​3961 and #​3970). Thanks to @​fholzer for suggesting and implementing this change!
  • OptimizeConn was removed in favor of a new WriteTo method on the Transport, which allows sending of (non-QUIC) packets on the net.PacketConn passed to the Transport (#​3957). Thanks to @​MarcoPolo for helpful feedback on the API!

Changelog

New Contributors

Full Changelog: https://github.com/quic-go/quic-go/compare/v0.36.0...v0.37.0

v0.36.4

Compare Source

v0.36.3

Compare Source

This patch release contains a backport of the fix that triggered the Go 1.20.7 / 1.19.12 patch release (2350afd2e8).

Full Changelog: https://github.com/quic-go/quic-go/compare/v0.36.2...v0.36.3


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) | require | minor | `v0.36.2` -> `v0.37.4` | --- ### Release Notes <details> <summary>quic-go/quic-go</summary> ### [`v0.37.4`](https://github.com/quic-go/quic-go/releases/tag/v0.37.4) [Compare Source](https://github.com/quic-go/quic-go/compare/v0.37.3...v0.37.4) This release contains a fix for a [last-minute breaking API change](https://github.com/golang/go/commit/a915b999c9) in Go 1.21: https://github.com/quic-go/quic-go/pull/4020 **Full Changelog**: https://github.com/quic-go/quic-go/compare/v0.37.3...v0.37.4 ### [`v0.37.3`](https://github.com/quic-go/quic-go/releases/tag/v0.37.3) [Compare Source](https://github.com/quic-go/quic-go/compare/v0.37.2...v0.37.3) This patch release - fixes handling of ACK frames serialized after CRYPTO frames: [#&#8203;4018](https://github.com/quic-go/quic-go/issues/4018) - sets a `net.Conn` on the `tls.ClientHelloInfo` used on `GetCertificate` and `GetConfigForClient`, for `tls.Config`s returned (recursively) from `GetConfigForClient`: https://github.com/quic-go/quic-go/pull/4016 **Full Changelog**: https://github.com/quic-go/quic-go/compare/v0.37.2...v0.37.3 ### [`v0.37.2`](https://github.com/quic-go/quic-go/releases/tag/v0.37.2) [Compare Source](https://github.com/quic-go/quic-go/compare/v0.37.1...v0.37.2) This patch release - contains a backport of the fix that triggered the Go 1.20.7 / 1.19.12 patch release (https://github.com/golang/go/commit/2350afd2e8ab054390e284c95d5b089c142db017): https://github.com/quic-go/quic-go/pull/4012 - sets a `net.Conn` with the correct addresses on the `tls.ClientHelloInfo` used in `tls.Config.GetCertificate`: https://github.com/quic-go/quic-go/pull/4015 Note that in order to be protected against the DoS attack making use of large RSA keys, it's necessary to update to this patch release (for Go 1.20). For Go 1.21, please update the Go compiler. **Full Changelog**: https://github.com/quic-go/quic-go/compare/v0.37.1...v0.37.2 ### [`v0.37.1`](https://github.com/quic-go/quic-go/releases/tag/v0.37.1) [Compare Source](https://github.com/quic-go/quic-go/compare/v0.37.0...v0.37.1) This is a patch release fixing two regressions introduced in the v0.37.0 release: - http3: fix check for content length of the response by [@&#8203;imroc](https://github.com/imroc) in https://github.com/quic-go/quic-go/pull/3998 - set a net.Conn with the correct addresses on the tls.ClientHelloInfo by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/4001 #### New Contributors - [@&#8203;imroc](https://github.com/imroc) made their first contribution in https://github.com/quic-go/quic-go/pull/3998 **Full Changelog**: https://github.com/quic-go/quic-go/compare/v0.37.0...v0.37.1 ### [`v0.37.0`](https://github.com/quic-go/quic-go/releases/tag/v0.37.0) [Compare Source](https://github.com/quic-go/quic-go/compare/v0.36.4...v0.37.0) #### crypto/tls changes With the upcoming Go 1.21 release, we're now able to rely on the Go standard library's TLS implementation's QUIC support. If you're curious, here are the discussions that happened in the Go project's GitHub: - QUIC support for crypto/tls (without 0-RTT): https://github.com/golang/go/issues/44886 - QUIC 0-RTT support for crypto/tls: https://github.com/golang/go/issues/60107 - Advanced session ticket API (needed for 0-RTT): https://github.com/golang/go/issues/60105 Special thanks to [@&#8203;FiloSottile](https://github.com/FiloSottile) and [@&#8203;neild](https://github.com/neild) for the constructive discussions around the new API, and for making this happen! Using this new API required major changes to the way quic-go interacts with the TLS stack ([#&#8203;3860](https://github.com/quic-go/quic-go/issues/3860) and [#&#8203;3939](https://github.com/quic-go/quic-go/issues/3939)), but ultimately, the new API is a lot cleaner than what we had before. This means that starting with Go 1.21, we won't have to fork crypto/tls anymore, resolving a longstanding issue ([#&#8203;2727](https://github.com/quic-go/quic-go/issues/2727)). This also resolves a major pain point for the community, since quic-go now doesn't have to enforce a specific compiler version any longer. Note that this release still supports Go 1.20 (in line with our policy to always support the two most recent Go versions), which still uses (a completely rewritten) [fork of crypto/tls](https://github.com/quic-go/qtls-go1-20). We're looking forward to dropping support for Go 1.20 once Go 1.22 is released next year. #### Other Notable Changes - We dropped support for the [QUIC draft-29](https://datatracker.ietf.org/doc/html/draft-ietf-quic-transport-29). This draft version was somewhat widely deployed on the internet before RFC 9000 was finalized, but has been phased out since then. quic-go now supports QUIC version 1 (RFC 9000) and version 2 (RFC 9369). - `Connection.ReceiveMessage` now takes a `context.Context`, allowing the caller to make the call return, even if no message is received: https://github.com/quic-go/quic-go/pull/3926. Thanks to [@&#8203;Glonee](https://github.com/Glonee) for the implementation! - A long list of added validations (as required by RFC 9114 and RFC 9110) for request and response parsing in the http3 package, mostly around the processing of headers. Thanks to [@&#8203;Mephue](https://github.com/Mephue) for finding one of the missing checks, and to [@&#8203;WeidiDeng](https://github.com/WeidiDeng) for finding and fixing multiple of them! - quic-go now sets the DF bit on packets sent on macOS (as we've done for a long time on Linux already). This allows us to do DPLPMTUD (Path MTU discovery): https://github.com/quic-go/quic-go/pull/3946. Thanks to [@&#8203;sukunrt](https://github.com/sukunrt) for implementing! - The stream and the connection errors are now surfaced via the contexts exposed by `Stream.Context` and `Connection.Context`, and can be accessed by calling `context.Cause` ([#&#8203;3961](https://github.com/quic-go/quic-go/issues/3961) and [#&#8203;3970](https://github.com/quic-go/quic-go/issues/3970)). Thanks to [@&#8203;fholzer](https://github.com/fholzer) for suggesting and implementing this change! - `OptimizeConn` was removed in favor of a new `WriteTo` method on the `Transport`, which allows sending of (non-QUIC) packets on the `net.PacketConn` passed to the `Transport` ([#&#8203;3957](https://github.com/quic-go/quic-go/issues/3957)). Thanks to [@&#8203;MarcoPolo](https://github.com/MarcoPolo) for helpful feedback on the API! #### Changelog - drop support for draft-29 by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3903 - use unix.IPV6\_RECVPKTINFO and unix.IPV6\_PKTINFO on all platforms by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3918 - simplify syscall consts used for requesting / parsing IPv4 packet info by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3919 - use the UDP_SEGMENT constant defined in the unix package (for GSO) by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3917 - Log stream frames in long header packets by [@&#8203;birneee](https://github.com/birneee) in https://github.com/quic-go/quic-go/pull/3922 - add a context to Connection.ReceiveMessage by [@&#8203;Glonee](https://github.com/Glonee) in https://github.com/quic-go/quic-go/pull/3926 - transport: don't add connection to multiplexer if init fails by [@&#8203;kelmenhorst](https://github.com/kelmenhorst) in https://github.com/quic-go/quic-go/pull/3931 - update link to the wiki page about UDP buffer sizes by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3924 - disable GSO unless QUIC_GO_ENABLE_GSO is set by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3934 - use the new crypto/tls QUIC Transport, drop support for Go 1.19 by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3860 - stop using math/rand.Seed and Read in tests, bump go.mod version to 1.20 by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3936 - assert the length of IPv4 packet info control messages, add log message by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3920 - move oss-fuzz build script to this repo by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3940 - oss-fuzz: manually install Go, fix paths by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3941 - http3: validate Host header before sending by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3948 - http3: don't write response headers if the handler panicked by [@&#8203;WeidiDeng](https://github.com/WeidiDeng) in https://github.com/quic-go/quic-go/pull/3950 - http3: add Date response header if not set by [@&#8203;WeidiDeng](https://github.com/WeidiDeng) in https://github.com/quic-go/quic-go/pull/3952 - perform send / receive buffer increases when setting up the connection by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3949 - http3: implement FlushError for the response writer by [@&#8203;WeidiDeng](https://github.com/WeidiDeng) in https://github.com/quic-go/quic-go/pull/3951 - http3: return http.ErrContentLength when writing too large response by [@&#8203;WeidiDeng](https://github.com/WeidiDeng) in https://github.com/quic-go/quic-go/pull/3953 - http3: don't send more than http.Request.ContentLength bytes by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3960 - http3: set the Content-Length header in the http.Request.Header map by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3963 - http3: reject header field that contain non-lowercase characters by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3964 - http3: reject header field names with invalid characters by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3965 - http3: reject header field values with invalid characters by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3967 - http3: reject negative values for the Content-Length header by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3966 - connection: surface connection error as connection context cancellation cause by [@&#8203;fholzer](https://github.com/fholzer) in https://github.com/quic-go/quic-go/pull/3961 - http3: enforce ordering requirement between pseudo and regular headers by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3968 - http3: refactor header field processing into a separate function by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3971 - http3: unify handling of request and response headers by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3969 - http3: deduplicate Content-Length headers by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3972 - http3: reject responses that don't set the :status header by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3975 - http3: reject unknown pseudo headers by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3973 - send stream: surface error as stream context cancellation cause by [@&#8203;fholzer](https://github.com/fholzer) in https://github.com/quic-go/quic-go/pull/3970 - remove OptimizeConn, add a Transport.WriteTo method instead by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3957 - http3: use correct error code when request header parsing fails by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3979 - enable the DF bit on macOS by [@&#8203;sukunrt](https://github.com/sukunrt) in https://github.com/quic-go/quic-go/pull/3946 - http3: enforce that DATA frames don't exceed Content-Length by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3980 - http3: discard negative content-length header when writing response by [@&#8203;WeidiDeng](https://github.com/WeidiDeng) in https://github.com/quic-go/quic-go/pull/3983 - check for WSAEMSGSIZE errors when receiving UDP packets on Windows by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3982 - http3: panic in ResponseWriter.WriteHeader for invalid status codes by [@&#8203;WeidiDeng](https://github.com/WeidiDeng) in https://github.com/quic-go/quic-go/pull/3984 - use a synchronous API for the crypto setup by [@&#8203;marten-seemann](https://github.com/marten-seemann) in https://github.com/quic-go/quic-go/pull/3939 #### New Contributors - [@&#8203;WeidiDeng](https://github.com/WeidiDeng) made their first contribution in https://github.com/quic-go/quic-go/pull/3950 - [@&#8203;fholzer](https://github.com/fholzer) made their first contribution in https://github.com/quic-go/quic-go/pull/3961 **Full Changelog**: https://github.com/quic-go/quic-go/compare/v0.36.0...v0.37.0 ### [`v0.36.4`](https://github.com/quic-go/quic-go/compare/v0.36.3...v0.36.4) [Compare Source](https://github.com/quic-go/quic-go/compare/v0.36.3...v0.36.4) ### [`v0.36.3`](https://github.com/quic-go/quic-go/releases/tag/v0.36.3) [Compare Source](https://github.com/quic-go/quic-go/compare/v0.36.2...v0.36.3) This patch release contains a backport of the fix that triggered the Go 1.20.7 / 1.19.12 patch release (https://github.com/golang/go/commit/2350afd2e8ab054390e284c95d5b089c142db017). **Full Changelog**: https://github.com/quic-go/quic-go/compare/v0.36.2...v0.36.3 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNS43MS4xIiwidXBkYXRlZEluVmVyIjoiMzUuNzEuMSIsInRhcmdldEJyYW5jaCI6Im1hc3RlciJ9-->
renovate-bot force-pushed renovate/github.com-quic-go-quic-go-0.x from 6100a05d29 to dd87aab46d 2023-07-31 22:00:24 +00:00 Compare
renovate-bot changed title from fix(deps): update module github.com/quic-go/quic-go to v0.37.0 to fix(deps): update module github.com/quic-go/quic-go to v0.37.1 2023-07-31 22:00:25 +00:00
renovate-bot force-pushed renovate/github.com-quic-go-quic-go-0.x from dd87aab46d to 484f61122a 2023-08-01 23:00:42 +00:00 Compare
renovate-bot force-pushed renovate/github.com-quic-go-quic-go-0.x from 484f61122a to 572df7b413 2023-08-04 01:00:38 +00:00 Compare
renovate-bot changed title from fix(deps): update module github.com/quic-go/quic-go to v0.37.1 to fix(deps): update module github.com/quic-go/quic-go to v0.37.2 2023-08-04 01:00:39 +00:00
renovate-bot force-pushed renovate/github.com-quic-go-quic-go-0.x from 572df7b413 to fc56e3ebb3 2023-08-04 17:00:39 +00:00 Compare
renovate-bot force-pushed renovate/github.com-quic-go-quic-go-0.x from fc56e3ebb3 to 96d7cc984e 2023-08-05 00:00:38 +00:00 Compare
renovate-bot force-pushed renovate/github.com-quic-go-quic-go-0.x from 96d7cc984e to 2884fb7b4d 2023-08-06 00:00:22 +00:00 Compare
renovate-bot changed title from fix(deps): update module github.com/quic-go/quic-go to v0.37.2 to fix(deps): update module github.com/quic-go/quic-go to v0.37.3 2023-08-06 00:00:23 +00:00
renovate-bot changed title from fix(deps): update module github.com/quic-go/quic-go to v0.37.3 to fix(deps): update module github.com/quic-go/quic-go to v0.37.4 2023-08-09 14:00:26 +00:00
renovate-bot force-pushed renovate/github.com-quic-go-quic-go-0.x from 2884fb7b4d to f5ffd118b1 2023-08-09 14:00:26 +00:00 Compare
sam added 1 commit 2023-08-10 14:02:02 +00:00
BREAKING: Drop Go 1.19
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is passing
1bf1fa892f
Author
Collaborator

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

Warning: custom changes will be lost.

### Edited/Blocked Notification Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. ⚠ **Warning**: custom changes will be lost.
sam merged commit 71477684d9 into master 2023-08-10 15:07:32 +00:00
sam deleted branch renovate/github.com-quic-go-quic-go-0.x 2023-08-10 15:07:32 +00:00
Sign in to join this conversation.
No description provided.