chore: upgrade dependencies (2026-07-14)#506
Merged
Merged
Conversation
Upgrade non-sensitive and sensitive dependencies to latest: Direct: - golang.org/x/net v0.56.0 -> v0.57.0 - golang.org/x/text v0.38.0 -> v0.40.0 Indirect / transitive: - golang.org/x/crypto v0.53.0 -> v0.54.0 - golang.org/x/sys v0.46.0 -> v0.47.0 - github.com/yuin/goldmark v1.4.13 -> v1.8.4 - github.com/rogpeppe/go-internal v1.10.0 -> v1.15.0 - github.com/xyproto/randomstring v1.0.5 -> v1.2.0 - github.com/jordanlewis/gcassert -> v0.0.0-20260313214104-ad3fae17affe - golang.org/x/mod v0.36.0 -> v0.38.0 - golang.org/x/sync v0.21.0 -> v0.22.0 - golang.org/x/term v0.44.0 -> v0.45.0 - golang.org/x/tools v0.45.0 -> v0.48.0 - gotest.tools/v3 v3.5.1 -> v3.5.2 Unchanged (already latest): utls v1.8.2, quic-go v0.60.0. All tests pass (go build ./..., go vet ./..., go test ./...), including the modified internal/http2 and internal/http3 code.
imroc
commented
Jul 13, 2026
imroc
left a comment
imroc
left a comment
Owner
Author
There was a problem hiding this comment.
Reviewed. Pure dependency bump (go.mod / go.sum only) — cannot self-approve as the PR author. quic-go v0.60.0 and utls v1.8.2 are unchanged, and no modified upstream code (internal/http3/, internal/http2/, or the vendored stdlib files) is touched. CI is green on both Go 1.25.x and 1.26.x.
Non-blocking note (already captured in the PR description): bumping golang.org/x/net shifts the baseline for the next vendored http2 upstream-sync pass — keep it in mind during that sync.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
摘要
升级 req 的非敏感与敏感依赖至最新版本。
go build ./...、go vet ./...、go test ./...全部通过（含魔改的internal/http2、internal/http3代码）。升级清单
直接依赖
golang.org/x/netv0.56.0 → v0.57.0golang.org/x/textv0.38.0 → v0.40.0间接 / 传递依赖
golang.org/x/cryptov0.53.0 → v0.54.0golang.org/x/sysv0.46.0 → v0.47.0github.com/yuin/goldmarkv1.4.13 → v1.8.4github.com/rogpeppe/go-internalv1.10.0 → v1.15.0github.com/xyproto/randomstringv1.0.5 → v1.2.0github.com/jordanlewis/gcassert→ v0.0.0-20260313214104-ad3fae17affegolang.org/x/modv0.36.0 → v0.38.0golang.org/x/syncv0.21.0 → v0.22.0golang.org/x/termv0.44.0 → v0.45.0golang.org/x/toolsv0.45.0 → v0.48.0gotest.tools/v3v3.5.1 → v3.5.2保持不变（已是最新）
github.com/refraction-networking/utlsv1.8.2github.com/quic-go/quic-gov0.60.0验证
go mod tidy无残留go build ./...通过go vet ./...通过go test ./...通过（16 个包全部 ok）说明
x/net、x/crypto、x/text）随go get传递升级，已通过完整测试套件统一验证。internal/http3/或internal/http2/中的任何文件。x/net升级可能影响未来 vendored http2 的同步基线，同步上游时需留意。