Skip to content

v0.2.9

Choose a tag to compare

View all tags
@TomTonic TomTonic released this 07 Sep 21:42
· 3 commits to main since this release
v0.2.9
9fe4d98

New Features

Nothing to report this release. (Inherited from the quic-go v0.62.0 upgrade: RFC 9218 stream-priority support and an HTTP/3 TryWriteAll API were added, but websyncd's client only issues single HEAD/GET requests per origin and doesn't expose or rely on stream prioritization, so this brings no observable change for websyncd users.)

Changed or Fixed Behavior

  • Bumped the quic-go/http3 client library from v0.61.0 to v0.62.0. Inherited from this upgrade: fixes to HTTP/3 request validation (userinfo-in-authority, duplicate Host headers, scheme normalization, CONNECT handling), 0-RTT rejection when server settings changed, and a race in connection-ID retirement/path closure — all of which make websyncd's automatic HTTP/3 upgrade path (ENABLE_HTTP3) more robust against non-conformant or flaky servers. (quic-go v0.62.0 release notes)
  • Note: quic-go v0.62.0 now requires Go 1.26+; this is already satisfied since websyncd's toolchain was bumped to Go 1.27.1 in the same batch (see Dependency Updates), so no action is needed.

Architectural Changes

  • The repo's release-notes procedure was replaced with a pointer to a shared release-notes Claude Code agent (sourced from github.com/TomTonic/go-project-defaults), with project-specific parameters now living in .claude/release-notes.yml. This only affects contributors/maintainers preparing releases, not the shipped binary.

Dependency Updates

  • Go toolchain: 1.27.0 → 1.27.1.
  • github.com/quic-go/quic-go (direct): v0.61.0 → v0.62.0.
  • golang.org/x/crypto (indirect, pulled in via quic-go): v0.55.0 → v0.56.0.
  • github.com/stretchr/testify (indirect, test-only): v1.11.1 → v1.12.1; its own gopkg.in/yaml.v3 dependency was replaced by go.yaml.in/yaml/v3 v3.0.5.

CVEs fixed by this update batch:

  • GO-2026-6354 — DoS via deadlock on an undecided SSH channel in golang.org/x/crypto/ssh, fixed by the x/crypto v0.56.0 bump.
  • GO-2026-6355 — DoS via deadlock on an established SSH channel in golang.org/x/crypto/ssh, fixed by the same bump.
    (Confirmed via grype diff between the v0.2.8 and HEAD checkouts, and independently by govulncheck. Both are in the SSH package, which websyncd's own code never calls — govulncheck reports them as unreachable both before and after the fix — but they're listed here since a dependency-tree scan flags them regardless of reachability.)
  • No other CVEs were found fixed in quic-go itself between v0.61.0 and v0.62.0 (a worktree-diff scan of the quic-go repo at both tags produced identical vulnerability ID sets).

Advisories Flagged but Not Applicable:

  • GO-2026-5932 — "golang.org/x/crypto/openpgp is unmaintained, unsafe by design" — present in x/crypto both before and after this release's bump (not newly introduced, not fixed). govulncheck ./... confirms websyncd's code never reaches the flagged openpgp symbols (x/crypto is only pulled in transitively for QUIC/TLS internals via quic-go).

CI Updates

Nothing to report this release.

Full Changelog: v0.2.8...v0.2.9

Assets 2
Loading