QPack breaking change

[softexpert]

Hello,

Recently released v0.6.0 of github.com/quic-go/qpack changed the signature for qpack.NewDecoder function, which now expects no parameters.

As such, there are now errors like this when building :

../../../../pkg/mod/cache/github.com/imroc/req/v3@v3.56.0/internal/http3/client.go:105:31: too many arguments in call to qpack.NewDecoder
	have (func(hf qpack.HeaderField))
	want ()

[softexpert]

I went ahead and applied the modifications on a local copy (I also updated all dependencies to the latest versions).
All the tests are passing, but I cannot guarantee that there are no side effects - I'm not very familiar with the inner logic.

diff --git a/go.mod b/go.mod
index ae176c1..966c7ee 100644
--- a/go.mod
+++ b/go.mod
@@ -7,8 +7,8 @@ require (
 	github.com/google/go-querystring v1.1.0
 	github.com/icholy/digest v1.1.0
 	github.com/klauspost/compress v1.18.1
-	github.com/quic-go/qpack v0.5.1
-	github.com/quic-go/quic-go v0.56.0
+	github.com/quic-go/qpack v0.6.0
+	github.com/quic-go/quic-go v0.57.0
 	github.com/refraction-networking/utls v1.8.1
 	golang.org/x/net v0.47.0
 	golang.org/x/text v0.31.0
@@ -17,6 +17,6 @@ require (
 require (
 	github.com/google/go-cmp v0.7.0 // indirect
 	go.uber.org/mock v0.6.0 // indirect
-	golang.org/x/crypto v0.44.0 // indirect
+	golang.org/x/crypto v0.45.0 // indirect
 	golang.org/x/sys v0.38.0 // indirect
 )
diff --git a/go.sum b/go.sum
index 7e13fa7..c9e1d6e 100644
--- a/go.sum
+++ b/go.sum
@@ -13,20 +13,20 @@ github.com/klauspost/compress v1.18.1 h1:bcSGx7UbpBqMChDtsF28Lw6v/G94LPrrbMbdC3J
 github.com/klauspost/compress v1.18.1/go.mod h1:ZQFFVG+MdnR0P+l6wpXgIL4NTtwiKIdBnrBd8Nrxr+0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/quic-go/qpack v0.5.1 h1:giqksBPnT/HDtZ6VhtFKgoLOWmlyo9Ei6u9PqzIMbhI=
-github.com/quic-go/qpack v0.5.1/go.mod h1:+PC4XFrEskIVkcLzpEkbLqq1uCoxPhQuvK5rH1ZgaEg=
-github.com/quic-go/quic-go v0.56.0 h1:q/TW+OLismmXAehgFLczhCDTYB3bFmua4D9lsNBWxvY=
-github.com/quic-go/quic-go v0.56.0/go.mod h1:9gx5KsFQtw2oZ6GZTyh+7YEvOxWCL9WZAepnHxgAo6c=
+github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
+github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
+github.com/quic-go/quic-go v0.57.0 h1:AsSSrrMs4qI/hLrKlTH/TGQeTMY0ib1pAOX7vA3AdqE=
+github.com/quic-go/quic-go v0.57.0/go.mod h1:ly4QBAjHA2VhdnxhojRsCUOeJwKYg+taDlos92xb1+s=
 github.com/refraction-networking/utls v1.8.1 h1:yNY1kapmQU8JeM1sSw2H2asfTIwWxIkrMJI0pRUOCAo=
 github.com/refraction-networking/utls v1.8.1/go.mod h1:jkSOEkLqn+S/jtpEHPOsVv/4V4EVnelwbMQl4vCWXAM=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
 github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
 go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
 go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
-golang.org/x/crypto v0.44.0 h1:A97SsFvM3AIwEEmTBiaxPPTYpDC47w720rdiiUvgoAU=
-golang.org/x/crypto v0.44.0/go.mod h1:013i+Nw79BMiQiMsOPcVCB5ZIJbYkerPrGnOa00tvmc=
+golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
+golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
 golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
 golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
 golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
diff --git a/internal/http3/client.go b/internal/http3/client.go
index 4e5d307..1ce8e22 100644
--- a/internal/http3/client.go
+++ b/internal/http3/client.go
@@ -102,7 +102,7 @@ func newClientConn(
 	} else {
 		c.maxResponseHeaderBytes = uint64(maxResponseHeaderBytes)
 	}
-	c.decoder = qpack.NewDecoder(func(hf qpack.HeaderField) {})
+	c.decoder = qpack.NewDecoder()
 	c.requestWriter = newRequestWriter()
 	c.conn = newConnection(
 		conn.Context(),
diff --git a/internal/http3/conn.go b/internal/http3/conn.go
index 90d76de..e82779e 100644
--- a/internal/http3/conn.go
+++ b/internal/http3/conn.go
@@ -80,7 +80,7 @@ func newConnection(
 		logger:           logger,
 		idleTimeout:      idleTimeout,
 		enableDatagrams:  enableDatagrams,
-		decoder:          qpack.NewDecoder(func(hf qpack.HeaderField) {}),
+		decoder:          qpack.NewDecoder(),
 		receivedSettings: make(chan struct{}),
 		streams:          make(map[quic.StreamID]*stateTrackingStream),
 		maxStreamID:      InvalidStreamID,
@@ -209,10 +209,19 @@ func (c *Conn) decodeTrailers(r io.Reader, streamID quic.StreamID, hf *headersFr
 	if _, err := io.ReadFull(r, b); err != nil {
 		return nil, err
 	}
-	fields, err := c.decoder.DecodeFull(b)
-	if err != nil {
-		maybeQlogInvalidHeadersFrame(c.qlogger, streamID, hf.Length)
-		return nil, err
+
+	df := c.decoder.Decode(b)
+	fields := []qpack.HeaderField{}
+	for {
+		dhf, er := df()
+		if er == io.EOF {
+			break
+		}
+		if er != nil {
+			maybeQlogInvalidHeadersFrame(c.qlogger, streamID, hf.Length)
+			return nil, er
+		}
+		fields = append(fields, dhf)
 	}
 	if c.qlogger != nil {
 		qlogParsedHeadersFrame(c.qlogger, streamID, hf, fields)
diff --git a/internal/http3/stream.go b/internal/http3/stream.go
index e4dc308..1d13e27 100644
--- a/internal/http3/stream.go
+++ b/internal/http3/stream.go
@@ -355,12 +355,20 @@ func (s *RequestStream) ReadResponse() (*http.Response, error) {
 		s.str.CancelWrite(quic.StreamErrorCode(ErrCodeRequestIncomplete))
 		return nil, fmt.Errorf("http3: failed to read response headers: %w", err)
 	}
-	hfs, err := s.decoder.DecodeFull(headerBlock)
-	if err != nil {
-		maybeQlogInvalidHeadersFrame(s.str.qlogger, s.str.StreamID(), hf.Length)
-		// TODO: use the right error code
-		s.str.conn.CloseWithError(quic.ApplicationErrorCode(ErrCodeGeneralProtocolError), "")
-		return nil, fmt.Errorf("http3: failed to decode response headers: %w", err)
+	df := s.decoder.Decode(headerBlock)
+	hfs := []qpack.HeaderField{}
+	for {
+		dhf, er := df()
+		if er == io.EOF {
+			break
+		}
+		if er != nil {
+			maybeQlogInvalidHeadersFrame(s.str.qlogger, s.str.StreamID(), hf.Length)
+			// TODO: use the right error code
+			err = errors.Join(err, s.str.conn.CloseWithError(quic.ApplicationErrorCode(ErrCodeGeneralProtocolError), ""))
+			return nil, fmt.Errorf("http3: failed to decode response headers: %w", err)
+		}
+		hfs = append(hfs, dhf)
 	}
 	if s.str.qlogger != nil {
 		qlogParsedHeadersFrame(s.str.qlogger, s.str.StreamID(), hf, hfs)

[nomad-software]

I'm affected by this too. I'm hoping for an official fix? 🙏🙏🙏

[softexpert]

For now I'm redirecting the package reference in the go.mod file of my projects with an instruction like this:

replace github.com/imroc/req/v3 => ../path/to/local/and/patched/req

[ghstahl]

this is my replace until this is addressed.

replace github.com/imroc/req/v3 => github.com/fluffy-bunny/req/v3 v3.0.0-20251213162032-0048121fe388

and my pull request

[BrianLeishman]

+1

(sorry for the +1 but we really don't want this update to get lost)

[imroc]

Sorry for the wait, everyone. I've been quite busy lately. This issue has been resolved in the latest version; you can upgrade req to v3.57.0.