Upstream Sync Report 2026-08-30: net/http trailer strictness and HTTP/3 userinfo rejection

Upstream changes

• golang/go@cff1e3d — net/http: close connection after invalid trailers (including bare LF)

  • seeUpcomingDoubleCRLF now validates that every trailer line is terminated with CRLF and returns an error when a bare LF is used, instead of accepting any buffer ending in \r\n\r\n.
  • The body struct drops the earlyClose field; didEarlyClose is replaced by consumedEntireBody. That part serves server.go, which req does not inline.

• quic-go/quic-go@148fd03 — http3: reject userinfo subcomponent in URIs (unreleased, on master after v0.61.0)

  • RFC 9114 §4.3.1: the authority must not include the deprecated userinfo subcomponent for http/https URIs.

Impact on req

• Root transfer.go still has the old seeUpcomingDoubleCRLF returning bool, so the inlined client accepts trailers terminated with bare LF, unlike current stdlib which rejects them with http: invalid trailer. A non-conforming server can rely on this divergence.
• internal/http3/headers.go (baseline v0.60.0) has no userinfo validation in parseHeaders, so :authority values containing @ are accepted for http/https requests.
• golang/go@da7c67f (net/http: abort in-flight response writes when the connection dies) only touches server.go and tests, which req does not inline — no impact.

Suggested action

• Port the transfer.go part of cff1e3d into root transfer.go, keeping req's dump/decoding customizations.
• Add the userinfo rejection from 148fd03 to internal/http3/headers.go after pseudo-header parsing, for requests with scheme http/https.
• Add regression tests for bare-LF trailers and :authority containing userinfo.

Read root transfer.go alongside golang/go commit cff1e3d, then inspect internal/http3/headers.go and quic-go commit 148fd03. Add regression coverage for bare-LF trailers and HTTP/3 :authority values containing userinfo. Done means the client rejects both invalid forms while preserving req's dump and decoding customizations.