Upstream Sync Report 2026-08-31: quic-go v0.62.0 HTTP/3 compliance changes
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 4.9k
- Forks
- 409
- Avg merge
- 6h 47m
- Merged PRs (30d)
- 7
Description
Summary
quic-go v0.62.0 was released on 2026-08-30. Since our last checked master SHA (148fd03), 7 new http3/ commits landed, all of which affect files inlined in req's internal/http3/ (modified quic-go code, currently based on v0.60.0). These are HTTP/3 protocol-compliance fixes that need to be synced manually.
No new security advisories since the previously confirmed GHSA-vvgj-x9jq-8cj9 (already verified as not affecting req).
Commits needing sync
| Commit | Change | Affected req file |
|---|---|---|
cb8e1ec |
Normalize request schemes to lowercase (RFC 3986 §3.1) | internal/http3/headers.go |
a2aaf58 |
Validate :method is non-empty and syntactically valid |
internal/http3/headers.go |
4aac58a |
Reject regular CONNECT requests containing :scheme |
internal/http3/headers.go |
74b7cb7 |
Use Host as fallback when :authority is omitted; reject :authority/Host mismatch |
internal/http3/headers.go |
1818db9 |
Reject duplicate Host header fields |
internal/http3/headers.go |
1e19960 |
Distinguish empty pseudo-header fields from omitted ones (presence tracked via nil-valued map entries) | internal/http3/headers.go |
eb1fe05 |
Do not gzip-decompress successful CONNECT responses | internal/http3/stream.go |
go.mod dependency upgrade requires a decision
Upgrading the github.com/quic-go/quic-go dependency from v0.61.0 to v0.62.0 forces the module's go directive from 1.25.0 to 1.26.0 (v0.62.0 requires Go 1.26). This would drop Go 1.25 support, which is currently part of the CI matrix (1.25.x, 1.26.x).
Local verification on Go 1.27 with the upgrade applied: go build ./..., go vet ./..., and the full go test ./... all pass. The blocker is purely the support-policy change (dropping Go 1.25), which needs maintainer sign-off.
Action items
- Sync the 7
http3/commits above intointernal/http3/(keeping req customizations) - Decide whether to drop Go 1.25 support and upgrade the go.mod dependency to v0.62.0 (CI matrix would need updating accordingly)
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the seven listed quic-go commits against the customized code in internal/http3/headers.go and internal/http3/stream.go, then inspect go.mod and the CI matrix for the Go version decision. The work is done when the HTTP/3 changes are synced without losing req customizations, tests pass, and maintainers decide whether to drop Go 1.25 and update the dependency.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100