Upstream Sync Report 2026-09-16: RFC 9112 §6.3 Transfer-Encoding / Content-Length framing rewrite

Upstream Changes

Go stdlib net/http rewrote the message-framing (body length determination) logic in src/net/http/transfer.go, restructuring it to follow the numbered algorithm of RFC 9112 §6.3:

• Commit: db450d3 (2026-09-14, CL 818663)
• parseTransferEncoding + fixLength + the HEAD special-case in readTransfer are replaced by a single transferReader.determineBodyLength(isResponse) that walks the RFC items in order
• transferReader gains a RealBodyLength field, separating the actual body length (0 for HEAD/bodyless) from the reported ContentLength
• New sentinel errors: errTooManyTransferEncodings, errUnsupportedTransferEncoding, errTooManyContentLengths
• parseContentLength now returns (string, int64, error) — the trimmed header value alongside the parsed length

Behavior differences vs req's copy

req's inlined transfer.go still carries the pre-rewrite logic (readTransfer → parseTransferEncoding → fixLength), so porting changes behavior in these edge cases:

The HEAD / 1xx / 204 / 304 / chunked / plain-CL / unbounded-response paths keep their net semantics; the rewrite mainly makes the decision table explicit and consistent.

Impact on req

• req inlines transfer.go (root, modified stdlib). Only the read side is affected — readTransfer in req's copy handles *http.Response only (requests go through transferWriter), so the RFC table applies to response framing.
• The 2xx CONNECT change is the one visible to users doing CONNECT tunneling: today a tunnel response carrying Content-Length gets a CL-framed body, which is wrong for a tunnel (the body is the raw tunnel stream until close). Aligning would make tunnel framing correct.
• The HTTP/1.0+TE hardening is a strictness improvement on a request-smuggling-adjacent surface; for a client library it mostly affects responses from non-conforming servers (connection now closed instead of reused).
• No security advisory is attached to this change; it is a correctness/alignment refactor.

Suggested sync

Port db450d3 into transfer.go (merge upstream net/http: <date>(<hash>) style). Port notes:

• req's readTransfer has local deviations to preserve: no maxTrailerHeaders parameter (req's body struct and fixTrailer signature differ), header is http.Header from net/http rather than stdlib's own Header type, and the httplaxContentLength godebug var is locally renamed.
• parseContentLength's new 3-value signature has call sites in readTransfer (HEAD case) that must be adapted.
• The *Request branch of stdlib's determineBodyLength (RFC item 7) is dead code for req since readTransfer only accepts *http.Response; keep the response-side cases.
• No public API change; req's Response.ContentLength / TransferEncoding outputs keep their meaning.

Not security-related, no workaround needed — behavior alignment, low priority.

Start in req's root transfer.go, especially readTransfer, and compare it with upstream commit db450d3. Account for req's local body, trailer, Header, and godebug differences while porting the response-side framing logic. Done means the RFC 9112 response cases and CONNECT behavior are aligned without changing the public response fields.