Upstream Sync Report 2026-08-19: Go 1.26.6 security fixes and HTTP/2 follow-up

Upstream Sync Report — 2026-08-19

Upstream changes

• Go stdlib net/http: 9689556 (2026-08-17) clears ReadHeaderTimeout after accepting an unencrypted HTTP/2 connection. The change is server-side (server.go and stdlib's internal HTTP/2 server), while req inlines client-side net/http code, so no req port is required.
• golang.org/x/net/http2: f6c404b (2026-08-17) restores documentation for h2c.NewHandler. req does not vendor h2c, so no action is required.
• quic-go: no release or security advisory after v0.61.0.

Security scan

govulncheck ./... with the local Go 1.26.5 toolchain reports five standard-library advisories fixed in Go 1.26.6:

These are toolchain-level vulnerabilities rather than defects introduced by req source. The already required golang.org/x/net version v0.58.0 contains the x/net fix for GO-2026-5026. Users should build req with a patched Go toolchain (1.25.13+ on the 1.25 line or 1.26.6+ on the 1.26 line).

Impact

• No change to req's modified net/http, internal/http2/, or internal/http3/ files is required.
• The upstream baselines have advanced to Go 9689556 and x/net/http2 f6c404b.
• quic-go remains at v0.61.0; the inlined HTTP/3 code still needs a manual sync from v0.60.0 to v0.61.0.

Recommended action

No source change is needed for this report. Consumers should use a patched Go toolchain; maintainers should continue the existing manual HTTP/3 sync tracked in #502.

Start with the upstream sync report and run govulncheck ./... using the local Go toolchain to confirm the listed advisories. The report says no req source change is needed; the remaining HTTP/3 sync is tracked in #502, so completion here is documenting the patched toolchain requirement rather than changing code.