[dependabot]

Bumps the go-deps group with 2 updates in the / directory: github.com/quic-go/quic-go and golang.org/x/crypto.

Updates github.com/quic-go/quic-go from 0.64.1 to 0.65.0

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.65.0

This release updates qlog to the latest IETF drafts, adds explicit stream credit release, and fixes a number of HTTP/3 and connection migration bugs.

• With Config.RequireStreamCreditRelease, completed streams count towards the incoming stream limit until the application calls ReleaseStreamCredit: #5981, #5982
• qlog: events now follow draft-ietf-quic-qlog-quic-events-14 and draft-ietf-quic-qlog-h3-events-14: #6120

Breaking Changes

• http3: HTTPStreamer.HTTPStream now returns (*Stream, error), and no longer sends an implicit 200 response: #5988, #5994

Notable Fixes

• QUIC v2 key updates now use the correct quicv2 ku label: #5973
• Connections using zero-length connection IDs no longer stop receiving packets after version negotiation: #6129
• Switching paths now uses a new connection ID, fixing servers that kept sending to the old address after repeated NAT rebindings: #6015
• Clients now send PATH_RESPONSE on the path the PATH_CHALLENGE was received on: #5980
• Path.Probe now succeeds on an already validated path: #6019
• Reordered and retransmitted NEW_CONNECTION_ID frames are now handled correctly: #6009, #6007
• DATAGRAM frames no longer starve ACKs, control frames and retransmissions: #5970
• CancelRead now unblocks Read and Peek after receiving RESET_STREAM_AT: #6022
• TryWriteAll no longer copies queued data quadratically: #6042, #6043
• http3: canceling the first request to a host no longer cancels the shared dial: #6132
• http3: bodies shorter than the announced Content-Length now fail with io.ErrUnexpectedEOF: #5913
• http3: Content-Length is no longer added to 204 and 304 responses, and is now sent for requests with http.NoBody: #6032, #6029
• http3: response writes that fail partway (e.g. on a write deadline) no longer corrupt the stream: #5993, #6002, #6001, #6003
• http3: canceling an Extended CONNECT request now interrupts waiting for SETTINGS: #6020
• qlog fixes:
  • incorrect or missing values for transport parameters, packet numbers, congestion metrics, timers, connection IDs and lengths: #6050, #6054, #6059, #6060, #6074, #6077, #6091, #6023, #5969
  • stateless resets are logged as remote closures: #6063
  • concurrently recorded events are written in order: #5956
  • traces of connections abandoned after version negotiation are closed: #6130
  • http3: traces no longer close before all events are recorded: #6090, #6083, #6041

Notable Changes

• Multiple DATAGRAM frames are now packed into a single packet: #5961, #5960
• qlog: new connection_state_updated and HTTP/3 stream_type_set events, and tuples for path probing and migration: #6111, #6113, #5977, #5979
• qlog: qlog.RedactIPs redacts IP addresses and ports: #5943
• qlog: HTTP/3 connections now use qlog.DefaultConnectionTracer; http3/qlog.DefaultConnectionTracer is removed: #5966
• Reduced allocations during the handshake: #6096, #6093, #6098, #6097, #6095

Changelog

• ci: bump CodSpeedHQ/action from 5.4.0 to 5.5.0 by @​dependabot[bot] in quic-go/quic-go#5945
• qlogwriter: fix ordering of concurrently recorded events by @​marten-seemann in quic-go/quic-go#5956
• omit the length field of the last DATAGRAM frame in a packet by @​marten-seemann in quic-go/quic-go#5960
• remove obsolete curve ID helpers from handshake tests by @​marten-seemann in quic-go/quic-go#5968
• handshake: remove obsolete session ticket error workaround by @​marten-seemann in quic-go/quic-go#5967
• pack multiple DATAGRAM frames into a packet by @​marten-seemann in quic-go/quic-go#5961
• qlog: register event schemas on init, remove Trace.SupportsSchemas by @​marten-seemann in quic-go/quic-go#5966

... (truncated)

Commits

• aa265c3 http3: don't cancel a shared dial when the first request is canceled (#6132)
• 7c2906f qlog: close the trace of a connection abandoned after version negotiation (#6...
• faa3b83 remove the old connection immediately after version negotiation (#6129)
• 946bda4 ci: use a daily Go build cache for unit and integration tests (#6124)
• 99d6d1e qlog: map packet drop reasons to packet_dropped triggers (#6055)
• 91d541c ci: delete outdated cross-compilation build caches (#6122)
• 3ee97eb README: list tools supporting quic-go (#6123)
• 3316624 ci: run benchmarks for a fixed number of iterations (#6121)
• 220eda8 ci: cancel outdated PR runs (#6118)
• 0bf3ea5 qlog: update event schema URIs to quic-events-14 and h3-events-14 (#6120)
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.58.0 to 0.59.0

Commits

• 6c966a7 ssh: quote remaining peer-controlled strings in error messages
• bc46121 ssh: fail OpenChannel when the connection is lost
• 7e0915c ssh/test: connect to sshd over a loopback TCP connection
• bfa619e ssh/agent: use a short socket path for ssh-agent in tests
• 4e10f38 go.mod: update golang.org/x dependencies
• a1058eb ssh: remove DSA support
• d580ab7 ssh: report algorithms of the last completed key exchange
• d1f31f6 ssh/knownhosts: skip lines that cannot be parsed
• 04c6b4f ssh: return rest from ParseKnownHosts on parse errors
• 3d426ad ssh: separately count rejected public key queries towards MaxAuthTries
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.