Upstream Sync Report 2026-08-31: quic-go v0.62.0 HTTP/3 compliance changes

[imroc]

Summary

quic-go v0.62.0 was released on 2026-08-30. Since our last checked master SHA (148fd03), 7 new http3/ commits landed, all of which affect files inlined in req's internal/http3/ (modified quic-go code, currently based on v0.60.0). These are HTTP/3 protocol-compliance fixes that need to be synced manually.

No new security advisories since the previously confirmed GHSA-vvgj-x9jq-8cj9 (already verified as not affecting req).

Commits needing sync

Commit	Change	Affected req file
cb8e1ec	Normalize request schemes to lowercase (RFC 3986 §3.1)	internal/http3/headers.go
a2aaf58	Validate :method is non-empty and syntactically valid	internal/http3/headers.go
4aac58a	Reject regular CONNECT requests containing :scheme	internal/http3/headers.go
74b7cb7	Use Host as fallback when :authority is omitted; reject :authority/Host mismatch	internal/http3/headers.go
1818db9	Reject duplicate Host header fields	internal/http3/headers.go
1e19960	Distinguish empty pseudo-header fields from omitted ones (presence tracked via nil-valued map entries)	internal/http3/headers.go
eb1fe05	Do not gzip-decompress successful CONNECT responses	internal/http3/stream.go

go.mod dependency upgrade requires a decision

Upgrading the github.com/quic-go/quic-go dependency from v0.61.0 to v0.62.0 forces the module's go directive from 1.25.0 to 1.26.0 (v0.62.0 requires Go 1.26). This would drop Go 1.25 support, which is currently part of the CI matrix (1.25.x, 1.26.x).

Local verification on Go 1.27 with the upgrade applied: go build ./..., go vet ./..., and the full go test ./... all pass. The blocker is purely the support-policy change (dropping Go 1.25), which needs maintainer sign-off.

Action items

• Sync the 7 http3/ commits above into internal/http3/ (keeping req customizations)
• Decide whether to drop Go 1.25 support and upgrade the go.mod dependency to v0.62.0 (CI matrix would need updating accordingly)

[imroc]

Update (2026-09-03): golang.org/x/crypto v0.56.0 is now available and raises the same Go 1.25 support question as the quic-go upgrade above.

• Upgrading x/crypto v0.55.0 → v0.56.0 bumps the module's go directive from 1.25.0 to 1.26.0 (v0.56.0 requires Go 1.26) — identical policy blocker as quic-go v0.62.0.
• v0.56.0 ships security fixes GO-2026-6354 and GO-2026-6355 (DoS in x/crypto/ssh). req does not call the ssh package (govulncheck reports 0 call-chain vulnerabilities), so there is no runtime impact either way; upgrading would only clear the module-level advisories.
• Local verification on Go 1.27 with x/crypto v0.56.0 applied: go build ./..., go vet ./..., full go test ./... all pass. Rolled back locally; no PR created.

The two upgrades are now tied to a single decision:

• Drop Go 1.25 support → upgrade quic-go v0.62.0 and x/crypto v0.56.0 together in one PR (CI matrix update needed).
• Keep Go 1.25 support → both stay at their current versions for now.