Sourced from github.com/quic-go/quic-go's releases.

v0.37.1

This is a patch release fixing two regressions introduced in the v0.37.0 release:

• http3: fix check for content length of the response by @​imroc in quic-go/quic-go#3998
• set a net.Conn with the correct addresses on the tls.ClientHelloInfo by @​marten-seemann in quic-go/quic-go#4001

New Contributors

• @​imroc made their first contribution in quic-go/quic-go#3998

Full Changelog: quic-go/quic-go@v0.37.0...v0.37.1

v0.37.0

crypto/tls changes

With the upcoming Go 1.21 release, we're now able to rely on the Go standard library's TLS implementation's QUIC support.

If you're curious, here are the discussions that happened in the Go project's GitHub:

• QUIC support for crypto/tls (without 0-RTT): golang/go#44886
• QUIC 0-RTT support for crypto/tls: golang/go#60107
• Advanced session ticket API (needed for 0-RTT): golang/go#60105

Special thanks to @​FiloSottile and @​neild for the constructive discussions around the new API, and for making this happen!

Using this new API required major changes to the way quic-go interacts with the TLS stack (#3860 and #3939), but ultimately, the new API is a lot cleaner than what we had before.

This means that starting with Go 1.21, we won't have to fork crypto/tls anymore, resolving a longstanding issue (#2727). This also resolves a major pain point for the community, since quic-go now doesn't have to enforce a specific compiler version any longer. Note that this release still supports Go 1.20 (in line with our policy to always support the two most recent Go versions), which still uses (a completely rewritten) fork of crypto/tls. We're looking forward to dropping support for Go 1.20 once Go 1.22 is released next year.

Other Notable Changes

• We dropped support for the QUIC draft-29. This draft version was somewhat widely deployed on the internet before RFC 9000 was finalized, but has been phased out since then. quic-go now supports QUIC version 1 (RFC 9000) and version 2 (RFC 9369).
• Connection.ReceiveMessage now takes a context.Context, allowing the caller to make the call return, even if no message is received: quic-go/quic-go#3926. Thanks to @​Glonee for the implementation!
• A long list of added validations (as required by RFC 9114 and RFC 9110) for request and response parsing in the http3 package, mostly around the processing of headers. Thanks to @​Mephue for finding one of the missing checks, and to @​WeidiDeng for finding and fixing multiple of them!
• quic-go now sets the DF bit on packets sent on macOS (as we've done for a long time on Linux already). This allows us to do DPLPMTUD (Path MTU discovery): quic-go/quic-go#3946. Thanks to @​sukunrt for implementing!
• The stream and the connection errors are now surfaced via the contexts exposed by Stream.Context and Connection.Context, and can be accessed by calling context.Cause (#3961 and #3970). Thanks to @​fholzer for suggesting and implementing this change!
• OptimizeConn was removed in favor of a new WriteTo method on the Transport, which allows sending of (non-QUIC) packets on the net.PacketConn passed to the Transport (#3957). Thanks to @​MarcoPolo for helpful feedback on the API!

Changelog

• drop support for draft-29 by @​marten-seemann in quic-go/quic-go#3903
• use unix.IPV6_RECVPKTINFO and unix.IPV6_PKTINFO on all platforms by @​marten-seemann in quic-go/quic-go#3918
• simplify syscall consts used for requesting / parsing IPv4 packet info by @​marten-seemann in quic-go/quic-go#3919
• use the UDP_SEGMENT constant defined in the unix package (for GSO) by @​marten-seemann in quic-go/quic-go#3917
• Log stream frames in long header packets by @​birneee in quic-go/quic-go#3922
• add a context to Connection.ReceiveMessage by @​Glonee in quic-go/quic-go#3926
• transport: don't add connection to multiplexer if init fails by @​kelmenhorst in quic-go/quic-go#3931
• update link to the wiki page about UDP buffer sizes by @​marten-seemann in quic-go/quic-go#3924
• disable GSO unless QUIC_GO_ENABLE_GSO is set by @​marten-seemann in quic-go/quic-go#3934
• use the new crypto/tls QUIC Transport, drop support for Go 1.19 by @​marten-seemann in quic-go/quic-go#3860
• stop using math/rand.Seed and Read in tests, bump go.mod version to 1.20 by @​marten-seemann in quic-go/quic-go#3936

... (truncated)

• f3a0ce1 set a net.Conn with the correct addresses on the tls.ClientHelloInfo (#4001)
• 44a58dc ci: update Go 1.21 to rc3 (#3994)
• 32f8b20 http3: fix check for content length of the response (#3998)
• 469a615 use a synchronous API for the crypto setup (#3939)
• 2c0e7e0 http3: panic in ResponseWriter.WriteHeader for invalid status codes (#3984)
• 2bcfe5b check for WSAEMSGSIZE errors when receiving UDP packets on Windows (#3982)
• 2183283 http3: discard negative content-length header when writing response (#3983)
• 5a22ac8 http3: enforce that DATA frames don't exceed Content-Length (#3980)
• 56cd866 enable the DF bit on macOS (#3946)
• ae8bdd7 http3: use correct error code when request header parsing fails (#3979)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)