v0.2.11

New Features

Nothing to report this release.

Changed or Fixed Behavior

• Fixes a set of reachable HTTP/2 and TLS security bugs inherited from the Go 1.27.2 toolchain upgrade. Verified via govulncheck (run against an actual Go 1.27.1 toolchain on the pre-release code) that all nine fixed standard-library vulnerabilities are genuinely reachable from websyncd's own code paths — both the webhook/heartbeat HTTP server in internal/app/app_servers.go and the sync HTTP(S)/HTTP-3 client in internal/httpclient and internal/syncer. These are real behavior fixes, not theoretical: an HTTP/2 HPACK-encoder race that could crash the heartbeat/webhook server (GO-2026-6617), an HTTP/2 double flow-control refund and a repeated-SETTINGS CPU-exhaustion issue affecting both server and client (GO-2026-6612, GO-2026-6611), an HTTP/2 Trailer-header memory-exhaustion issue on the server (GO-2026-6603), malformed HTTP/2 framing headers previously accepted by the transport (GO-2026-6610), an HTTP/1 request-smuggling/desync risk after a 2xx CONNECT response on the server side (GO-2026-6613) and after a rejected CONNECT on the client side (GO-2026-6605), a MIME-header memory-limit bypass in net/textproto/mime/multipart (GO-2026-6608), and a malformed-ECH-extension handling gap in crypto/tls (GO-2026-6607). No configuration changes are required — simply running the updated binary closes these.
• Inherited from the golang.org/x/net transitive upgrade (pulled in alongside the quic-go bump): the same HTTP/2 Trailer-header, flow-control, framing, and HPACK-race issues listed above are also fixed at the module level (golang.org/x/net v0.59.0 → v0.61.0, fix landed in v0.60.0).
• Inherited from the quic-go upgrade (v0.62.0 → v0.64.0): HTTP/3 response header/trailer buffers now grow as data arrives instead of being pre-sized from the peer-advertised HEADERS length, removing a memory-amplification vector a malicious or misbehaving server could trigger against websyncd's HTTP/3 client. Path MTU discovery now restarts correctly after connection migration/NAT rebinding, and unanswered PATH_CHALLENGEs are retried with exponential backoff — both improve sync resilience on changing networks. Writes to an already-closed stream now correctly return quic.ErrStreamClosed instead of a less specific error.

Architectural Changes

Nothing to report this release.

Dependency Updates

• Go toolchain: 1.27.1 → 1.27.2 (security + bug-fix point release).
• github.com/quic-go/quic-go (core dependency): v0.62.0 → v0.64.0 (via intermediate v0.63.0). See quic-go's GitHub Releases for v0.63.0 and v0.64.0 for the congestion-control, http3 buffer-sizing, and PATH_CHALLENGE/PMTU fixes summarized above. v0.63.0 also contains server-side http3 breaking changes (URL.Scheme/URL.Host handling, stricter :path validation) that do not affect websyncd, which only uses quic-go's http3.Transport as a client.
• golang.org/x/crypto v0.57.0 → v0.58.0, golang.org/x/net v0.59.0 → v0.61.0, golang.org/x/sys v0.48.0 → v0.49.0, golang.org/x/text v0.42.0 → v0.43.0 (all transitive, via quic-go/Go toolchain).

CVEs fixed by this update batch (mechanically diffed via grype worktree comparison of v0.2.10 vs. HEAD, plus govulncheck run against an actual Go 1.27.1 toolchain to confirm reachability — all nine are confirmed reachable from websyncd's own code, not just present in the dependency tree):

• GO-2026-6603 — HTTP/2 server memory exhaustion via Trailer headers (net/http, golang.org/x/net)
• GO-2026-6605 — HTTP/1 client connection desync after CONNECT rejection (net/http)
• GO-2026-6607 — malformed ECH outer-extension handling (crypto/tls)
• GO-2026-6608 — MIME-header memory-limit bypass (net/textproto, mime/multipart)
• GO-2026-6610 — HTTP/2 transport accepts malformed framing headers (net/http, golang.org/x/net)
• GO-2026-6611 — excessive CPU use from repeated HTTP/2 window-size changes (net/http, golang.org/x/net)
• GO-2026-6612 — HTTP/2 double flow-control refund (net/http, golang.org/x/net)
• GO-2026-6613 — HTTP/1 server connection desync after 2xx CONNECT response (net/http)
• GO-2026-6617 — HTTP/2 HPACK-encoder race causing server crash (net/http, golang.org/x/net)

No new vulnerabilities were introduced by this update batch (HEAD's dependency tree has zero IDs that weren't already present at v0.2.10, aside from the one documented exception below).

Advisories Flagged but Not Applicable:

• GO-2026-5932 — golang.org/x/crypto/openpgp flagged as unmaintained/unsafe-by-design. websyncd never imports or calls openpgp; it is pulled in only transitively via quic-go's TLS internals. Re-confirmed unreachable via govulncheck at HEAD. (Already documented in .claude/release-notes.yml; no change needed.)

CI Updates

Nothing to report this release.

Full Changelog: v0.2.10...v0.2.11