This release adds new stream APIs intended for application protocols that perform their own flow-control accounting, such as WebTransport:

• SendStream and Stream now expose TryWriteAll, which queues an entire buffer without blocking or returns ErrWouldBlock without queueing anything: #5704
• SendStream and Stream now expose WriteWithLimit, allowing higher-level protocols to apply an additional send limit while data is packetized: #5753
• ReceiveStream and Stream now expose SetReceiveFinalSizeCallback, which reports the final receive-side stream size once it is learned from a FIN or RESET_STREAM frame: #5752

Support for the RESET_STREAM_AT extension was updated to draft-09, while retaining support for the draft-07 codepoint for backwards compatibility: #5724

Breaking Changes

• http3: ParseCapsule was replaced by the stateful CapsuleParser and CapsuleReader APIs. Each capsule payload must now be consumed or discarded before advancing to the next capsule: #5729
• The StreamID.Type and StreamID.InitiatedBy methods were removed because they exposed internal types: #5744
• qlog: datagram IDs were replaced by CRC32c payload checksums. The JSON field is now datagram_payload_checksum instead of datagram_id, and the corresponding exported qlog types were renamed: #5758

Notable Fixes

• Transport parameter parsing is around 27% faster and now reliably rejects duplicate transport parameters: #5712
• Session tickets containing unknown transport parameters are now rejected during restoration, preventing 0-RTT resumption when an endpoint no longer understands an extension recorded in the ticket: #5714
• RESET_STREAM_AT negotiation is now applied correctly to streams opened before transport parameters are received during 0-RTT: #5715
• RESET_STREAM_AT support is now cleared after 0-RTT rejection, preventing new streams from inheriting the rejected connection's setting: #5716
• Pending stream control frames from a rejected 0-RTT attempt are now discarded instead of being sent after rejection: #5717
• Remembered RESET_STREAM_AT support is now validated across 0-RTT resumption: #5722
• http3: receiving a GOAWAY now unblocks pending OpenStreamSync calls and prevents new request streams from being opened: #5730
• http3: invalid header values are no longer included in validation errors, avoiding accidental exposure of sensitive values when errors are logged: #5742

Changelog

• ci: bump codecov/codecov-action from 6.0.1 to 7.0.0 by @dependabot[bot] in #5677
• ci: add Go 1.27rc1 to tested Go versions by @marten-seemann in #5682
• handshake: use new tls.QUICConfig.ClientHelloInfoConn API, avoid cloning tls.Config by @marten-seemann in #5571
• ci: bump actions/checkout from 6 to 7 by @dependabot[bot] in #5684
• move FIPS integration tests to a separate Go module by @marten-seemann in #5691
• ci: bump actions/cache from 5 to 6 by @dependabot[bot] in #5694
• ci: bump CodSpeedHQ/action from 4.15.1 to 4.18.1 by @dependabot[bot] in #5695
• ci: only run Codspeed benchmarks for the integration tests by @marten-seemann in #5701
• dissolve the flowcontrol package into the quic package by @marten-seemann in #5702
• protocol: remove unused AtomicByteCount type by @marten-seemann in #5703
• implement a method on the SendStream to send data immediately by @marten-seemann in #5704
• add a method to query for the final size of a receive stream by @marten-seemann in #5693
• ci: bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #5706
• ci: bump docker/login-action from 4.2.0 to 4.4.0 by @dependabot[bot] in #5708
• ci: bump docker/build-push-action from 7.2.0 to 7.3.0 by @dependabot[bot] in #5707
• ci: bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #5710
• ci: bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by @dependabot[bot] in #5709
• wire: speed up transport parameter parsing by using slices.Sort by @marten-seemann in #5712
• wire: reject unknown transport params on session ticket restore by @marten-seemann in #5714
• fix RESET_STREAM_AT negotiation after 0-RTT for existing streams by @marten-seemann in #5715
• clear stream control frames on 0-RTT rejection by @marten-seemann in #5717
• simnet: fix flaky TestMTUEnforcement by @marten-seemann in #5719
• validate RESET_STREAM_AT across 0-RTT resumption by @marten-seemann in #5722
• http3: avoid race initializing server idle timer by @marten-seemann in #5725
• reset RESET_STREAM_AT support after 0-RTT rejection by @marten-seemann in #5716
• fix flaky TestHTTPServerIdleTimeout by @marten-seemann in #5726
• fix flaky TestHTTPSettings by @marten-seemann in #5727
• add support for RESET_STREAM_AT draft-09 by @marten-seemann in #5724
• http3: implement a stricter API for capsule parsing by @marten-seemann in #5729
• http3: unblock pending calls to OpenStreamSync on GOAWAY by @marten-seemann in #5730
• handshake: simplify code by using bytes.CutPrefix by @marten-seemann in #5732
• ci: bump CodSpeedHQ/action from 4.18.1 to 4.18.5 by @dependabot[bot] in #5733
• remove unneeded underflow checks in the flow controller by @marten-seemann in #5738
• protocol: avoid exposing methods on the StreamID by @marten-seemann in #5744
• http3: avoid logging of invalid header values by @marten-seemann in #5742
• ci: don’t cancel interop Docker image builds on master by @marten-seemann in #5746
• use the StreamID alias on Stream.StreamID and ReceiveStream.StreamID by @marten-seemann in #5745
• rename SendStream.WriteImmediately to TryWriteAll by @marten-seemann in #5747
• ci: run Codspeed on pull requests and on master by @marten-seemann in #5748
• update golang.org/x/crypto to v0.54.0 by @marten-seemann in #5749
• rename ReceiveStream.WaitForFinalSize to WaitForReceiveFinalSize by @marten-seemann in #5750
• fix flaky TestDatagramSizeLimitWithMTUDiscovery by @marten-seemann in #5751
• ci: bump actions/setup-go from 6 to 7 by @dependabot[bot] in #5756
• replace receive stream final size wait with callback by @marten-seemann in #5752
• qlog: replace datagram IDs with CRC32c payload checksums by @marten-seemann in #5758
• guard qlogger when dropping malformed short-header packets by @marten-seemann in #5759
• add SendStream.WriteWithLimit for higher-level flow control by @marten-seemann in #5753

Full Changelog: v0.60.0...v0.61.0

Starting with v0.60.0, quic-go is ready for use in FIPS 140-3 environments when built with Go 1.26 or newer and used with the Go Cryptographic Module. See FIPS140.md for details.

This required a number of changes:

• switch QUIC HKDF usage to the standard library crypto/hkdf: #5461
• use the Go standard library's TLS 1.3 AES-GCM implementation for QUIC packet protection AEADs: #5624
• use cipher.NewGCMWithRandomNonce for address validation token encryption: #5625
• disable FIPS 140-3 enforcement for the Retry packet integrity tag, which is outside the FIPS 140-3 scope: #5630
• disable FIPS 140-3 enforcement for Initial packet protection, whose secrets are derived from public RFC constants: #5640
• guard the internal ChaCha20-Poly1305 code path so it is not used in FIPS 140-3 mode: #5633
• add FIPS / non-FIPS data transfer integration tests, including Retry and key updates: #5646

Breaking Changes

• quic-go now requires Go 1.25 or newer: #5561

Notable Fixes

• path probe packets now correctly pass the OOB data (needed to select the correct network interface in some system configurations): #5544, thanks to @on-keyday
• cancel the Stream and SendStream context when the connection is closed: #5556, thanks to @zvdy
• http3: validate Extended CONNECT ``:protocol` pseudo-header values according to HTTP token syntax: #5639
• http3: always set http.Request.Scheme and http.Request.Host: #5554, thanks to @qiulaidongfeng
• http3: fixed a nil pointer dereference when Server.Logger is unset: #5671
• fix maximum datagram size estimation after MTU discovery: #5650, thanks to @jinq0123
• OpenStreamSync now reliably returns the context error when the context is cancelled: #5660

Behind the scenes

In the last couple of months, we have reworked our fuzz setup and the integration into OSS-Fuzz: First of all, all fuzzers were rewritten to Go native fuzzing (#5592, #5599, #5600, #5603, #5613). We also added new fuzzers for the HTTP/3 frame parser (#5595), HTTP/3 request, response and trailer decoding (#5602) and the STREAM / CRYPTO frame sorter (#5620).

Since native Go fuzzing uses a different seed corpus format, we now use the newly implemented go-ossfuzz-seeds library to generate OSS-Fuzz compatible seed corpus files from f.Add calls.

We also enable ClusterFuzzLite batch fuzzing (#5605), including. a seed corpus (#5607). Fuzz coverage for both ClusterFuzzLite batch fuzzing (#5641) and for OSS-Fuzz fuzzing (#5655) is now submitted to Codecov.

Changelog

• README: update nodepass link and description in #5545
• ci: always use the latest Go patch release by @marten-seemann in #5560
• ci: update golangci-lint to v2.9.0 by @marten-seemann in #5559
• update to Go 1.26, drop Go 1.24 by @marten-seemann in #5561
• remove synctest wrapper needed for Go 1.24 by @marten-seemann in #5563
• ci: remove stray golangci-lint rule for ConnectionTracing(ID|Key) by @marten-seemann in #5565
• handshake: use the tls.QUICErrorEvent added in Go 1.26 by @marten-seemann in #5564
• pass OOB data to select network interface when sending path probes by @on-keyday in #5544
• remove special treatment for Go 1.24 in tests by @marten-seemann in #5568
• remove unneeded version switches for ECH ClientHello fragmentation test by @marten-seemann in #5567
• use sync.WaitGroup.Go added in Go 1.25 by @marten-seemann in #5566
• README: Fix NodePass GitHub stars badge link in #5570
• cancel stream context when the connection is closed by @zvdy in #5556
• http3: always set Scheme and Host of Request.URL field by @qiulaidongfeng in #5554
• build(deps): bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in #5576
• http3: fix misleading error when parsing the :path header fails by @Copilot in #5579
• build(deps): bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #5581
• build(deps): bump docker/login-action from 3 to 4 by @dependabot[bot] in #5584
• build(deps): bump docker/setup-qemu-action from 3 to 4 by @dependabot[bot] in #5583
• build(deps): bump docker/build-push-action from 6 to 7 by @dependabot[bot] in #5582
• build(deps): bump codecov/codecov-action from 5 to 6 by @dependabot[bot] in #5588
• ci: run govulncheck by @marten-seemann in #5586
• http3: fix typo in qlog quarter_stream_id by @marten-seemann in #5590
• ci: update golangci-lint to v2.11.4 by @marten-seemann in #5591
• ci: use the Go version provided in the OSS-Fuzz Go image by @marten-seemann in #5593
• ci: remove obsolete -lresolv workaround for OSS-Fuzz by @marten-seemann in #5594
• wire: use Go’s native fuzzing for the frame parser by @marten-seemann in #5592
• ci: fix oss-fuzz build of native Go fuzzer by @marten-seemann in #5598
• wire: use Go native fuzzing for the transport parameter parser by @marten-seemann in #5599
• http3: add a fuzzer for frame parsing by @marten-seemann in #5595
• wire: use Go native fuzzing for the header parser by @marten-seemann in #5600
• http3: add a fuzzer for request, response and trailer decoding by @marten-seemann in #5602
• ci: switch to native Go fuzzing for QPACK by @marten-seemann in #5603
• remove the fuzzer for resumption and retry tokens by @marten-seemann in #5606
• ci: enable ClusterFuzzLite batch fuzzing by @marten-seemann in #5605
• ci: use seed corpus for ClusterFuzzLite PR fuzzing by @marten-seemann in #5607
• Remove unnecessary apt-get dependencies from ClusterFuzzLite Dockerfile by @Copilot in #5609
• ci: fix path to QPACK fuzzer for OSS-Fuzz by @marten-seemann in #5612
• handshake: use Go native fuzzing for the handshake fuzzer by @marten-seemann in #5613
• wire: fuzz splitting of CRYPTO and DATAGRAM, truncation of ACK frames by @marten-seemann in #5615
• wire: improve fuzz coverage of the header fuzzer by @marten-seemann in #5616
• ci: set permissions on all CI workflows by @marten-seemann in #5617
• remove unused fuzzing helper functions by @marten-seemann in #5618
• wire: increase fuzz coverage of transport parameter fuzzer by @marten-seemann in #5619
• handshake: switch to crypto/hkdf instead of golang.org/x/crypto/hkdf by @marten-seemann in #5461
• handshake: use cipher.NewGCMWithRandomNonce for token protector AEAD by @marten-seemann in #5625
• fix .gitignore entry for fuzzing testdata by @marten-seemann in #5627
• generate an OSS-Fuzz compatible seed corpus from f.Add calls by @marten-seemann in #5626
• wire: limit size of frames to split off in the frame fuzzer by @marten-seemann in #5628
• wire: use a valid size parameter for the frame fuzzer corpus by @marten-seemann in #5629
• handshake: disable FIPS 140 enforcement for the Retry AEAD by @marten-seemann in #5630
• ci: run Codspeed once per day by @marten-seemann in #5636
• ci: pin non-GitHub-owned GitHub Actions by @marten-seemann in #5637
• add detailed instructions how to interact with OSS-Fuzz fuzzers by @marten-seemann in #5638
• http3: add validation logic for the :protocol pseudo-header field by @marten-seemann in #5639
• handshake: disable FIPS 140 enforcement for Initial AEAD by @marten-seemann in #5640
• ci: obtain coverage for ClusterFuzzLite Batch fuzzing by @marten-seemann in #5641
• http3: implement trailer validation logic by @marten-seemann in #5642
• handshake: use crypto/tls.aeadAESGCMTLS13 to construct FIPS 140 AEAD by @marten-seemann in #5624
• handshake: disable ChaCha20 code path in FIPS 140 mode by @marten-seemann in #5633
• r...

This patch release backports #5642, which adds validation for HTTP/3 trailers.

This release adds a couple of new features:

• Adds an API to peek stream data on ReceiveStream and Stream: #5501
• Adds an API to peek the next varint on a stream: #5502
• Reworks the API exposed by the HTTP/3 package for WebTransport: #5509, #5512. Regular HTTP/3 use cases should not be affected by these changes.
• Adds support for HTTP request trailers (trailers sent by the client): #5507

Breaking Changes

• Removes the deprecated ClientHelloInfo: #5497
• Removes the deprecated ConnectionTracingID and ConnectionTracingKey: #5521
• http3: the qlogger is now closed after all streams have been handled: #5524
• The ConnectionState now reports both the local and the remote status of the QUIC Datagram and Reliable Stream Reset extensions: #5533

Other Notable Fixes

• Fixes an infinite loop of PING-only packets caused by a bug in the PTO queueing logic: #5538 and #5539
• http3: Fixes a race condition between new request streams and GOAWAY: #5522
• qlog: Fixes a race condition between RecordEvent and Close: #5523

Changelog

• remove deprecated ClientHelloInfo by @marten-seemann in #5497
• expose SetReliableBoundary method on the Stream by @marten-seemann in #5498
• simplify ReceiveStream.Read implementation by @marten-seemann in #5500
• ci: use codecov-action instead of codecov/test-results-action by @Copilot in #5504
• http3: add support for request trailers by @marten-seemann in #5507
• http3: remove stream hijacking API by @marten-seemann in #5508
• http3: remove Hijacker, add Settingser interface by @marten-seemann in #5509
• implement a stream peeking API by @marten-seemann in #5501
• ci: fix Codecov upload by untracking integrationtests before removal by @marten-seemann in #5511
• quicvarint: implement function to peek the next varint by @marten-seemann in #5502
• http3: implement new API to allow fine-grained control of connections by @marten-seemann in #5512
• remove deprecated ConnectionTracingID and ConnectionTracingKey by @marten-seemann in #5521
• http3: fix race between new streams and GOAWAY by @marten-seemann in #5522
• qlogwriter: fix race between RecordEvent and Close by @marten-seemann in #5523
• polish the security policy by @marten-seemann in #5526
• http3: close qlogger after all streams have been handled by @marten-seemann in #5524
• fix flaky TestHTTP3Qlog by @marten-seemann in #5532
• expose local and remote settings in ConnectionState by @marten-seemann in #5533
• ackhandler: fix qlogging of outstanding packet count by @marten-seemann in #5538
• ackhandler: fix counting of packets queued for PTO probing by @marten-seemann in #5539

Full Changelog: v0.58.0...v0.59.0

This patch release backports fixes for a bug in the PTO queueing logic that could lead to an infinite loop of PING packets.

Bug Fixes

• ackhandler: fix qlogging of outstanding packet count (#5538)
• ackhandler: fix counting of packets queued for PTO probing (#5539)

This release optimizes the QUIC handshake:

• Multiple incoming packets are now processed before sending an acknowledgment, reducing the total number of packets sent: #5451
• ACK frames are now packed into coalesced packets, reducing the need to send a separate packet just for the ACK in many cases: #5477
• When packets are buffered during the handshake, this now doesn't lead to inflated RTT measurements anymore: #5493, #5494

Other notable changes

• quic-go now has a new logo: #5484
• ACK frames can now be encoded with up to 64 ranges (previously: 32): #5476
• Serializing ACK frames is now significantly faster: #5476
• Improved batch packet processing logic: #5478
• qlog: added support for the datagram_id on packet_sent, packet_received and packet_buffered events, using the CRC32 of the packet: #5455

Changelog

• qlog: add a DebugEvent by @marten-seemann in #5456
• qlog the datagram_id for long header and coalesced packets by @marten-seemann in #5455
• build(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in #5458
• handshake: pass cipherSuite by value instead of pointer by @marten-seemann in #5459
• handshake: add a benchmark for token decoding by @marten-seemann in #5460
• use synctest in the session resumption test by @marten-seemann in #5424
• handshake: fix QUIC events with session tickets disabled on Go 1.26 by @marten-seemann in #5462
• fix flaky TestConnectionCongestionControl by @Copilot in #5467
• simnet: move latency configuration to Router, simplify queueing logic by @marten-seemann in #5463
• use synctest for the RTT and reordering tests by @marten-seemann in #5464
• use synctest for 0-RTT integration tests by @marten-seemann in #5465
• allow processing of multiple packets before handshake completion by @marten-seemann in #5451
• ackhandler: disentangle ReceivedPacketHandler and SentPacketHandler by @marten-seemann in #5469
• refactor connection tests to remove ReceivedPacketHandler mock by @marten-seemann in #5468
• ackhandler: remove ReceivedPacketHandler interface, use struct directly by @marten-seemann in #5472
• wire: add a function to trunctate an ACK frame by @marten-seemann in #5476
• allow packing of ACKs in coalesced packets by @marten-seemann in #5477
• improve batch packet processing logic by @marten-seemann in #5478
• build(deps): bump actions/cache from 4 to 5 by @dependabot[bot] in #5482
• build(deps): bump actions/upload-artifact from 5 to 6 by @dependabot[bot] in #5483
• update the logo by @marten-seemann in #5484
• ci: add Go 1.26rc1 to tested Go versions by @marten-seemann in #5486
• utils: make TestAddTimestamp work in all time zones by @marten-seemann in #5492
• ackhandler: record RTT measurements for non-ack-eliciting packets by @marten-seemann in #5494
• ackhandler: only generate RTT sample for the last ack-eliciting packet by @marten-seemann in #5493

Full Changelog: v0.57.0...v0.58.0

This release resolves a panic during the server handshake when using the upcoming Go 1.26 toolchain, specifically occurring with TLS session tickets disabled (#5462). This issue does not impact builds on Go 1.25 or earlier versions.

This release contains a fix for CVE-2025-64702 by reworking the HTTP/3 header processing logic:

• Both client and server now send their respective header size constraints using the SETTINGS_MAX_FIELD_SECTION_SIZE setting: #5431
• For any QPACK-related errors, the correct error code (QPACK_DECOMPRESSION_FAILED) is now used: #5439
• QPACK header parsing is now incremental (instead of parsing all headers at once), which is ~5-10% faster and reduces allocations: #5435 (and quic-go/qpack#67)
• The server now sends a 431 status code (Request Header Fields Too Large) when encountering HTTP header fields exceeding the size constraint: #5452

Breaking Changes

• http3: Transport.MaxResponseBytes is now an int (before: int64): #5433
   

Notable Fixes

• qlogwriter: fix storing of event schemas (this prevented qlog event logging from working for HTTP/3): #5430
• http3: errors sending the request are now ignored, instead, the response from the server is read (thereby allowing the client to read the status code, for example): #5432

What's Changed

• build(deps): bump golangci/golangci-lint-action from 8 to 9 by @dependabot[bot] in #5426
• qlogwriter: fix storing of event schemas by @marten-seemann in #5430
• http3: send SETTINGS_MAX_FIELD_SECTION_SIZE in the SETTINGS frame by @marten-seemann in #5431
• http3: read response after encountering error sending the request by @marten-seemann in #5432
• http3: make Transport.MaxResponseBytes an int by @marten-seemann in #5433
• http3: add a benchmark for header parsing by @marten-seemann in #5435
• update qpack to v0.6.0 by @marten-seemann in #5434
• http3: use QPACK_DECOMPRESSION_FAILED for QPACK errors by @marten-seemann in #5439
• add documentation for Conn.NextConnection by @marten-seemann in #5442
• ackhandler: don’t generate an immediate ACK for the first packet by @marten-seemann in #5447
• don’t arm connection timer for connection ID retirement by @marten-seemann in #5449
• README: add nodepass to list of projects by @yosebyte in #5448
• qlogwriter: use synctest to make tests deterministic by @marten-seemann in #5454
• http3: limit size of decompressed headers by @marten-seemann in #5452

New Contributors

• @yosebyte made their first contribution in #5448

Full Changelog: v0.56.0...v0.57.0

This release introduces qlog support for HTTP/3 (#5367, #5372, #5374, #5375, #5376, #5381, #5383).

For this, we completely changed how connection tracing works. Instead of a general-purpose logging.ConnectionTracer (which we removed entirely), we now have a qlog-specific tracer (#5356, #5417). quic-go users can now implement their own qlog events.

It also removes the Prometheus-based metrics collection. Please comment on the tracking issue (#5294) if you rely on metrics and are interested in seeing metrics brought back in a future release.

Notable Changes

• replaced the unmaintained gojay with a custom, performance-optimized JSON encoder (#5353, #5371)
• quicvarint: improved panic message for numbers larger than 2^62 (#5410)

Behind the Scenes

Go 1.25 introduced support for testing concurrent code using testing/synctest. We've been working on transitioning tests to use synctest (#5357, #5391, #5393, #5397, #5398, #5403, #5414, #5415), using @MarcoPolo's simnet package to simulate a network in memory.

Using synctest makes test execution more reliable (reducing flakiness). The use of a synthetic clock leads to a massive speedup; the execution time of some integration tests was reduced from 20s to less than 1ms. The work will continue for the next release (see tracking issue: #5386).

Changelog

• qlog: implement a minimal jsontext-like JSON encoder by @marten-seemann in #5353
• ci: remove 386 (32 bit x86) by @MarcoPolo in #5352
• use synctest in more connection tests by @marten-seemann in #5357
• qlog: split serializiation and event definitions, remove logging abstraction by @marten-seemann in #5356
• qlogwriter: implement the draft-12 trace header by @marten-seemann in #5360
• qlogwriter: add support for event_schemas in the trace header by @marten-seemann in #5361
• qlogwriter: pass the event time to Event.Encode by @marten-seemann in #5362
• ackhandler: fix qlogging of alarm timer expiration time by @marten-seemann in #5363
• qlog: privatize Encode functions of non-Event structs by @marten-seemann in #5364
• fix qlogging of the short header payload length by @marten-seemann in #5365
• ci: include OS and Go version in Codecov test report upload by @marten-seemann in #5370
• http3: add basic server-side qlog support by @marten-seemann in #5367
• jsontext: add support for encoding null by @marten-seemann in #5371
• qlog: use PathEndpointInfo in connection_started by @marten-seemann in #5368
• http3: fix qlog encoding of frame_parsed and frame_created events by @marten-seemann in #5372
• http3: add basic client-side qlog support by @marten-seemann in #5374
• readme: update oss-fuzz link by @kriztalz in #5377
• http3: qlog sent and received GOAWAY frames by @marten-seemann in #5376
• http3: qlog sent and received DATAGRAMs by @marten-seemann in #5375
• http3: move qlogging of frames into the frame parser by @marten-seemann in #5378
• http3: qlog sent and received SETTINGS frames by @marten-seemann in #5379
• http3: qlog the frame length and payload length of parsed frames by @marten-seemann in #5380
• http3: qlog reserved, unsupported and unknown frames by @marten-seemann in #5381
• http3: add the qlog event schema to trace header by @marten-seemann in #5383
• use default RTT (100ms) for 0-RTT if no prior estimate by @marten-seemann in #5388
• congestion: avoid overflows when calculating pacer budget by @marten-seemann in #5390
• add simnet package to simulate a net.PacketConn in memory by @marten-seemann in #5385
• use synctest for transport tests by @marten-seemann in #5391
• use simnet in CONNECTION_CLOSE retransmission test by @marten-seemann in #5395
• use synctest for the packet drop test by @marten-seemann in #5393
• use synctest for the handshake drop test by @marten-seemann in #5397
• use synctest for the datagram test by @marten-seemann in #5398
• use synctest for the timeout tests by @marten-seemann in #5403
• fix flaky TestConnectionUnpackFailureDropped by @Copilot in #5382
• fix flaky TestServerTransportClose by @Copilot in #5407
• ci: use gcassert to check that quicvarint.Len is inlined by @marten-seemann in #5409
• quicvarint: improve panic message for numbers larger 2^62 by @marten-seemann in #5410
• ci: bump actions/upload-artifact from 4 to 5 by @dependabot[bot] in #5411
• ci: update golangci-lint to v2.6.0 by @marten-seemann in #5412
• qlog: rename owner to initiator by @marten-seemann in #5416
• use synctest for the stateless reset tests by @marten-seemann in #5415
• ackhandler: fix qlogging of RTT values by @marten-seemann in #5418
• qlog: rework the ConnectionClosed event by @marten-seemann in #5417
• qlog: split the PTO count updates ouf of the MetricsUpdated event by @marten-seemann in #5421

New Contributors

• @kriztalz made their first contribution in #5377
• @Copilot made their first contribution in #5382

Full Changelog: v0.55.0...v0.56.0

This release contains a number of improvements and fixes, and it updates the supported Go versions to 1.24 and 1.25.

Optimizations

When sending packets on a QUIC connection, RFC 9002 requires us to save the timestamp for every packet sent. In #5344, we implemented a memory-optimized drop-in replacement for time.Time, which reduces the memory required from 24 to 8 bytes, and vastly speeds up timer calculations (which happen very frequently).

New Features

• Basic connection statistics are now exposed via Conn.ConnectionStats, thanks to @MarcoPolo
• On some links, packet reordering can lead to spurious detections of packet loss when using the loss detection logic specified in RFC 9002. #5355 adds logic detect when packet loss is detected spuriously.

Notable Fixes

• http3: don't allow usage of closed Transport: #5324, thanks to @Glonee
• http3: fix race in concurrent Transport.Roundtrip calls: #5323, thanks to @Glonee
• improve and fix connection timer logic: #5339, thanks to @sukunrt for a very comprehensive code review

Behind the Scenes

We have started transitioning tests to make use of the new synctest package that was added in Go 1.25 (and was available as a GOEXPERIMENT in Go 1.24): #5291, #5296, #5298, #5299, #5302, #5304, #5305, #5306, #5317. This is a lot of work, but it makes the test execution both faster and more reliable.

Changelog

• wire: implement parsing and writing of the ACK_FREQUENCY frame by @marten-seemann in #5264
• wire: implement parsing and writing of the IMMEDIATE_ACK frame by @marten-seemann in #5265
• fuzzing: fix timeout in frame parser by @jannis-seemann in #5268
• wire: add support for the min_ack_delay transport parameter by @marten-seemann in #5266
• fix missing log statement for STREAM, DATAGRAM and ACK by @jannis-seemann in #5273
• qlog: add support for ACK_FREQUENCY and IMMEDIATE_ACK frames by @marten-seemann in #5276
• ackhandler: remove unused time from receivedPacketHandler.ReceivedPacket by @marten-seemann in #5277
• quicvarint: extend benchmark to use quicvarint.Reader by @marten-seemann in #5278
• quicvarint: tolerate empty reads of the underlying io.Reader by @bemasc in #5275
• http3: fix documentation for Server.ServeListener by @WeidiDeng in #5282
• expose connection stats via Conn.ConnectionStats by @marten-seemann in #5281
• ackhandler: generalize check for missing packets below threshold by @marten-seemann in #5260
• update to Go 1.25, drop Go 1.23, use go tool for gomock by @marten-seemann in #5283
• replace interface{} with any by @marten-seemann in #5290
• use testing.B.Loop in all benchmark tests by @marten-seemann in #5285
• build(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in #5293
• use synctest to make receive stream tests fully deterministc by @marten-seemann in #5291
• use synctest to make streams map tests fully deterministic by @marten-seemann in #5296
• ci: cache the Go build cache for cross-compilation workflow by @marten-seemann in #5297
• ci: fix cache save and restore logic for cross compile workflow by @marten-seemann in #5300
• restore previously deleted TestStreamsMapConcurrent test by @marten-seemann in #5301
• use synctest to make the send queue tests fully deterministic by @marten-seemann in #5302
• use synctest to make the send stream tests fully deterministic by @marten-seemann in #5298
• ci: use go mod tidy -diff to check for tidied go.mod by @marten-seemann in #5303
• use synctest to make the datagram queue tests fully deterministic by @marten-seemann in #5305
• utils: use synctest to make the timer tests fully deterministic by @marten-seemann in #5306
• ackhandler: fix resetting of packet.isPathProbePacket by @marten-seemann in #5310
• ackhandler: use an iterator to process received packet ranges by @marten-seemann in #5309
• ackhandler: use a typed mock for the ECNHandler by @marten-seemann in #5311
• ackhandler: immediately clear ackedPacket slice after processing ACK by @marten-seemann in #5313
• ci: improve cache key generation for the cross compilation job by @marten-seemann in #5315
• ci: fix cache paths in cross compile workflow by @marten-seemann in #5318
• ackhandler: avoid storing packet number in packet struct by @marten-seemann in #5312
• ackhandler: store skipped packet numbers separately by @marten-seemann in #5314
• ackhandler: account for skipped packets in packet threshold calculation by @marten-seemann in #5316
• ackhandler: store the last four skipped packets by @marten-seemann in #5322
• http3: fix data race in Transport by @Glonee in #5323
• qlog: add a benchmark for the ConnectionTracer by @marten-seemann in #5328
• qlog: merge event category and name by @marten-seemann in #5329
• http3: don't allow usage of closed Transport by @Glonee in #5324
• build(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in #5330
• fix: return stream frames to pool on error paths by @lidel in #5327
• ackhandler: add a benchmark for sending and acknowledging packets by @marten-seemann in #5333
• implement a memory-optimized time.Time replacement by @marten-seemann in #5334
• add a benchmark test for data transfers by @marten-seemann in #5335
• improve connection timer logic by @marten-seemann in #5339
• use synctest to make the connection tests fully deterministic by @marten-seemann in #5317
• drop initial packets when the handshake is confirmed by @marten-seemann in #5354
• protocol: optimize ConnectionID.String by @marten-seemann in #5351
• fix missing tracing of restored transport parameters by @marten-seemann in #5349
• ackhandler: track lost packets and detect spurious losses by @marten-seemann in #5355

New Contributors

• @bemasc made their first contribution in #5275
• @lidel made their first contribution in #5327

Full Changelog: v0.54.0...v0.55.0