Skip to content

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Dec 11, 2025

Bumps github.com/quic-go/quic-go from 0.46.0 to 0.57.0.

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.57.0

This release contains a fix for CVE-2025-64702 by reworking the HTTP/3 header processing logic:

  • Both client and server now send their respective header size constraints using the SETTINGS_MAX_FIELD_SECTION_SIZE setting: #5431
  • For any QPACK-related errors, the correct error code (QPACK_DECOMPRESSION_FAILED) is now used: #5439
  • QPACK header parsing is now incremental (instead of parsing all headers at once), which is ~5-10% faster and reduces allocations: #5435 (and quic-go/qpack#67)
  • The server now sends a 431 status code (Request Header Fields Too Large) when encountering HTTP header fields exceeding the size constraint: #5452

 

Breaking Changes

  • http3: Transport.MaxResponseBytes is now an int (before: int64): #5433  

Notable Fixes

  • qlogwriter: fix storing of event schemas (this prevented qlog event logging from working for HTTP/3): #5430
  • http3: errors sending the request are now ignored, instead, the response from the server is read (thereby allowing the client to read the status code, for example): #5432

What's Changed

New Contributors

Full Changelog: quic-go/quic-go@v0.56.0...v0.57.0

v0.56.0

This release introduces qlog support for HTTP/3 (#5367, #5372, #5374, #5375, #5376, #5381, #5383).

For this, we completely changed how connection tracing works. Instead of a general-purpose logging.ConnectionTracer (which we removed entirely), we now have a qlog-specific tracer (#5356, #5417). quic-go users can now implement their own qlog events.

It also removes the Prometheus-based metrics collection. Please comment on the tracking issue (#5294) if you rely on metrics and are interested in seeing metrics brought back in a future release.

Notable Changes

  • replaced the unmaintained gojay with a custom, performance-optimized JSON encoder (#5353, #5371)

... (truncated)

Commits
  • 5b2d212 http3: limit size of decompressed headers (#5452)
  • e80b378 qlogwriter: use synctest to make tests deterministic (#5454)
  • d43c589 README: add nodepass to list of projects (#5448)
  • ca2835d don’t arm connection timer for connection ID retirement (#5449)
  • e84ebae ackhandler: don’t generate an immediate ACK for the first packet (#5447)
  • d4d168f add documentation for Conn.NextConnection (#5442)
  • 4cdebbe http3: use QPACK_DECOMPRESSION_FAILED for QPACK errors (#5439)
  • b7886d5 update qpack to v0.6.0 (#5434)
  • 2fc9705 http3: add a benchmark for header parsing (#5435)
  • dafdd6f http3: make Transport.MaxResponseBytes an int (#5433)
  • Additional commits viewable in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

…optimism#405)

* github: Detect OP_GETH_BASE_BRANCH in update-geth workflow

Minor additional changes:
* use a more informative job id than "job_id"
* add quotes to silence shellcheck warnings

Closes celo-org/celo-blockchain-planning#933

* github: Fix ambiguous ls-remote match

The previous command yielded multiple results:
```
> git ls-remote https://github.com/celo-org/op-geth/ "celo-rebase-14"
18fdf55a858a46e5838c72f0e1eddcae00ced616	refs/heads/Kourin1996/celo-rebase-14
df2ea968968d4910ce21b44280a0077a54f73d3f	refs/heads/celo-rebase-14
```

That led to a malformed GITHUB_OUTPUT and caused job errors like
```
Error: Unable to process file command 'output' successfully.
Error: Invalid format 'df2ea968968d4910ce21b44280a0077a54f73d3f'
```
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Dec 11, 2025
QuentinI and others added 25 commits January 15, 2026 15:58
Initial implementation of Espresso integration by using Espresso
as an AltDA layer.
Implement getting AWS Nitro attestations and commitmen signing in the batcher
In order to be able to verify that a transaction coming from Espresso's finalized
transaction list was originally sourced from the op-batcher, we need a way to
verify that the transaction did actually come from the op-batcher.  To facilitate
this we want the transaction submitted to espresso to be signed by the op-batcher
itself.

The majority of this change is a result of attempting to forward the signing
functions to the place where we need them, while also maintaining no ability to
have direct memory access to any potentially stored private key.

This change signs the payload with the desired private key before it is submitted
to Espresso.

Update comments on `clientSigner` and `privateKeySigner`

The comment on `privateKeySigner` is for different code altogether.  It should
be replaced with a comment that applies to `privateKeySigner` itself.  Additionally
the comments could use some more explicit purpose.

This change updates the comments on `privateKeySigner` and `clientSigner` that
help to      explain what they are intended for.

Fix ChainSigner not being set for Config and DriverSetup

The ChainSigner is created, but it's never assigned to Config and for DriverSetup.
This leads to null pointer calls when trying to sign the payload for the chain.

Clean up comment that had an extra "creates a"
The rebase from celo-tip made the celo-integration branch
go back a version on`github.com/minio/minio-go/v7` from
`v7.0.85` to `v7.0.84`.  Additionally, the devnet configuration
files ended up dropping the `participants` configurations.

This commit updates the version to what it was, and re-adds
the participants configurations in the devnet files.
Pre-download rust dependency of Espresso Go SDK in CI builds
Removes reliance on AltDA for Espresso integration
* Allows for simultaneous usage of Espresso and an AltDA provider
* Allows for immediate posting of blocks to Espresso instead of waiting
  for new frames on a channel
* When not using an alternative DA layer, L1 now receives full batch
  data instead of just the commitments
* Same logic for the Espresso Streamer used in the batcher and derivation pipeline
* Separate the interaction between Espresso nodes and the handling of batches
* Several TODOs / improvements will be addressed in another PR.
Reduces code duplication and move more code to a separate package
by making Batch a type parameter of the streamer
philippecamacho and others added 28 commits January 15, 2026 15:58
* Document how to make changes to the kona repository and propagate them.
* Reference new docker images for the op-succinct proposer and challenger.
* Remove the superfluous check about the batcher address as now the Batch Inbox contract verifies the sender is legitimate.
* Add support for ZK attestation service

* check attestation service url is not nil

* upgrade espresso tee verifier contracts

* fix contracts

* fix merge

* fix tests

* bring back deploy aws nitro

* add support for mock contract

* add support for attestation verifier service

* fix tee tests

* use higher version of github runner

* fix tee args

* fix tee args

* add healthcheck to attestation verifier zk

* increase timeout

* Invalid attestation test passing

* small fixes

* fix TestE2eDevnetWithUnattestedBatcherKey

* fix health check

* fix devnet test

* use 127.0.0.1

* fix regex

* debug

* fix proof generation

* debug

* fix url

* fix url

* remove debug logs

* resolve based on comments

* address comments

* update github runner enclave

* fix based on suggestions

* cleanup logs
* Integrate EigenDA via Docker proxy for AltDA Espresso E2E tests

* Scope EigenDA lifecycle to the test and ensure clean startup/teardown

* Extract EigenDA Docker port and image into constants
* Make attestation service url optional

* fix dasel

* fix dasel

* update dockerfiles

* make attestation service required again
* Withdraw test passing again on devnet.

* Faster CI

* Deposit into L1 before requesting the withdrawal on L2.
---------

Co-authored-by: Philippe Camacho <[email protected]>
* update logging for the batch

* clean up
* Add code sync procedure

* Update links

* Fix format

* Rename files
* update batchAuthenticator according to audit report

* gen bindings and fix fast-tests
* Simplify the test as we cannot in practice reduce the window size.

---------

Co-authored-by: Philippe Camacho <[email protected]>
* remove warning on every failed tx

* reorder the checks
* Fallback mechanism test

* Update op-e2e/system/e2esys/setup.go

Co-authored-by: Phil <[email protected]>

---------

Co-authored-by: Philippe Camacho <[email protected]>
* Address flakiness.

* Simplify the code

* Fix CI

---------

Co-authored-by: Keyao Shen <[email protected]>
* update single run-enclave.sh

* remove BATCHER_PRIVATE_KEY

* update run-enclave.sh
* Fallback recovery

* Add caff node

* Suggestions
* Make Attestation Verifier Service optional

When the Attestation Verifier Service was added to the integration it
fundamentally modified the testing experience, requiring external
environment variables to be populated in order to run the tests.
Additionally, these environment variable requirements were not
documented in the README_ESPRESSO.md file for reference.

This change modifies the Attestation Verifier Service setup for the
E2E testing environment to make it opt-in instead of being forced
to be enabled.  Additionally, the Verifier URL is no longer required
to run the Batcher.  This is a double-edged sword, however, as it
means that we could potentially deploy the service without the
configuration, and we would potentially be lacking the registered
attestation.

This may be resolvable with a slight modification to the service
configuration, that we would ultimately disable for the E2E
testing environment.

* Fix misspelling

Fix linting error that has caught a misspelling of the work 'Network'.

* Modify configuration address to be required from CLI

With the change of making the Espresso Attestation Service optional
we removed the CLI configuration check that occurs on launch, so
that the E2E tests can still be run.

This has an unfortunate side-effect of allowing the Batcher to be
launched in a state where it is unable to operate as intended due
to user error.  The only indication being a `WARN` log entry to
inform him/her of his/her mistake.

This sort of approach is generally discouraged, yet we still need
to be able to bypass this check for testing purposes.  As a result
the `EspressoAttestationService` value has been modified from being
a simple `string` to being an interface whose value is inspectable
and not allowed to be empty by default.  This allows for the
test configurations to overwrite this behavior, and allow an
optional value in the cases where it is needed.

This should preserve the prior behavior of erroring on launch when
the parameter is not configured or specified, and should also
preserve the new behavior where it is explicitly disabled in
tests.

* Fix some nil references

The EspressoAttestationService configuration value being
an interface makes it a `nil`lable value by default. Care
needs to be taken when accessing this value an referencing
it.

This change adds some additional care in referencing the
value stored within.

* Fix nil access error

The `l1Client` being created assumes that the `sys` returned from the
call is non-nil before checking the error.  This is not guaranteed, and
is most likley not ever the case.  As a result there is a potential for
an error do to attempting an access on a `nil` value.  By moving the
`l1Client` declaration after the error check, we avoid the potential for
this issue.

* Apply linting and formatting changes

* Fix e2e tests - populate default EspressoAttestationService

With the modification of the EspressoAttestationService to an interface
instead of an individual value, we need to ensure that the default
way of launching the Espresso E2E DevNet results in the value being
populated with an empty allowed value.

This still allows for extension and override, without requiring the
value to be specified, which is our intention.  This was missed when
adding the capability originally.

* Cleanup code practices

We have duplicated code that makes the maintenance burden more difficult
than it needs to be.  In many of these scenarios the code that is
duplicated differs by only a single line.  Instead of making the system
more flexible, we ended up duplicating code paths.

This increases the maintenance burden by needing to ensure that these
code paths match in every case where they do not differ, yet they are
independent of each other.  This is not a great approach.

Additionally, we end up with multiple starting points for something that
should not need them.  We also end up storing a configuration that is
unnecessary to store.  This incurs conditional checks where some are not
needed, and ends up making the approach be more confusing than it needs
to be.

This change aims to replace these approaches with one that adheres to
the functional option approach and preserves the existing behavior.

* Revert EspressoAttestionService to a `string`

As it so happens we rely on the `CLIConfig` for `Espresso`, and the
`Batcher` to be serializable.  By utilizing an `interface`, we run into
trouble doing this.  Due this constraint, the `interface` constraint is
not feasible.

This change reverts the value back to a `string`, which should result in
a smaller overall change.  It also opts for a private configuration
value that is inspectable by the `Verify` check, but not directly
configurable.  We expose a method to allow for it to be configured, so
it can only occur within code within the code base itself.  We should
only invoke this via Testing where we need the value to be optional.

This achieves the same result but in a different way.

| NOTE: There may be a better approach to this as well, isntead of
having this be a separate field, we could do something akin to
sql.NullString, where we encode this value as a Marshable `struct`.  The
acess pattern becomes different, but we could directly encode the empty
allowance into the struct itself.

* Add Espresso Attestation Verifier Service to Enclave Test

The Enclave tests are currently failing in CI.  It is dying due to an
error stemming from the lack of the EspressoAttestationService being
configured.  It is likely that this is required for the Enclave tests
specifically.  As a result, we need to add and enable it for the enclave
tests.

* Modify LaunchBatcherInEnclave option

The LaunchBatcherInEnclave essentially launches the batcher externally
within an enclave.  This option actually relies on the Espresso
Attestation Verifier Service to be running.  This is due to the Espresso
Attestation Service only being optional inside of a test environment.
When launched externally, the Batcher is no longer considered to be in a
"test environment", or configurable for testing.  As a result, its
configuration **MUST** be something that can actually be resolvable from
a CLI launch.

Since the Espresso Attestation Verifier Service check is only disabled
within the testing environment, this means it **MUST** be enabled in the
enclave.

For convenience, this option has been added automatically as a part of
the LaunchBatcherInEnclave option, since it depends on it.  This will
minimize accidentl misconfigurations.
* add eigenda_proxy_url to op-batcher-tee

* fix the url to post to eigenDA

* not hardcoding EIGENDA_PROXY_PORT

* fix the block height config
* Add test to check end of channel fallback

Asana task: https://app.asana.com/1/1208976916964769/project/1209976130071762/task/1211892212379885?focus=true

We need a test to check the fallback Batcher behavior in the event
that the Espresso Batcher is able to submit a partial Channel that is
im progress.

The specific scenario we want to test for is one concerning a
multi-frame channel that has had at least part of the full channel
submitted to the L1 by the Espresso Batcher, then no more.  After
which we swap to the Fallback Batcher, and we should be able to pick
up the missed / incomplete channel, and complete the transactions.

* Rename helper function to match naming pattern

* Fix lint issue with not checking error result of wait.For

* Commit work in progress multi frame channel efforts

* Adjust settings to successfully trigger multi-frame channels

After a mob programming session @quentinl was able to help identify a
a specific combiniation of parameters to successfully and consistently
trigger multi-frames within the Batcher.  This condition is a necessary
precusor to the test being attempted.

This commit updates the test with the information necessary to trigger
this condition and sets the necessary test criteria that we are aiming
to achieve.

* Perform some code cleanup

This change does a few things:

- Address linting issue causing CI failure
- Adjusts some golang forloop usage to be more modern
- Adjust function call signatures to remove unused variables

* Fix bug tracking unsuccessful frames in test

In the `TxManagerIntercept` there is a bug that appends the successful
frames to the unsuccessful ones.  While this bug isn't great in the
information that it taints, it doesn't actually have the large of an
impact on the test as a whole, as the resulting failure condition
would be triggered regardless.

This bug does affect the accurate tracking of failed frames which
could be valuable information for inspection.

* Update espresso/environment/e2e_helpers.go

Co-authored-by: Phil <[email protected]>

* Replace Disable Batcher setting references

There are a number of places in our testing setup where we are
explicitly preventing the Batcher from starting on launch.  Instead of
rewriting this same option every time we want to use it, we should
reference a built in option that we can reference continually.  This
allows for non-repeated code and improved documentation as to the point
and purpose of this option.

* Refactor custom wait in test

There's a condition being waited on in the switch to fallback batcher
test.  This wait is useful, and can be reused between tests.  But the
wait itself is somewhat hiding it's intention by being inline defined
within the test itself.  We should pull this wait out so it can be
easily used, and its intention / purpose can be more easily documented.

* Cleanup code reuse in frame decoding

When decoding frame information for one of the Batcher fallback tests,
there are similar code paths taken that result in most of the code being
reused.  We should clean up this code reuse so that we don't repeat
ourselves in order to avoid diverging logic.  Additionally, it allows us
to reduce the amount of code needing to be maintained, and more clearly
document the intention of the code, and the consistency with how we
perform this frame decoding process.

* Relocate deferred stop calls

The Stop calls should occur as close to the launch of the environment as
possible.  As a result, any deferred calls to Stop for the system or the
Espresso Dev Node should occur as close to their occurence as possible.

* Modify Initial L2Verif wait to be longer

With the specific Frame and Channel settings being specified in the
`TestFallbackMechanismIntegrationTestChannelNotClosed` test, the initial
startup check for the L2 Verifier is failing.  This is due to our
settings requiring the Verifier process to take a bit longer than
normal.  In general, we want to give it more time, but the time frame
for the failure is hard-coded in the `wait` function being utilized.
While we **could** add a simple `time.Sleep`, and this would work, this
is generally a bad appraoch as it just adds an unchecked delay.
Instead, we opt to utilize a simple `retry` for up to `n` times.  In
this case, we only need to wait up to `3x` the normal time, so ensure
that we perform at least `3` times.

* Fix failure in Batcher Fallback test

The TestFallbackMechanismIntegrationTestChannelNotClosed test fails
locally without stopping, in spite of the overall time limit being
specified on the test.  After some troubleshooting and debugging, We
were able to chase down the cause to be due to the
`RunSimpleMultiTransactions`.  It's unclear as to why this was causing
the process to hang for as long as it was.  It seemed to not be handling
timeout errors well for some reason.

Either way, we fority this helper by setting an explicit time limit on
it, and referncing the context whenever we're performing channel
operations.  This should allow the channel operations themselves not to
block and hang the test.

After this modification we were able to determine that this process was
failing due to insufficient gas being provided.  For some reason when
running the transactions through this mechanism, we require even more
gas than we're normally need.  This seems a bit odd, perhaps it has to
do with the differences in the transaction construction.  In any case,
we up the gas being provided so that this becomes a non-issue.

* Fix linting issues

* Update espresso/environment/tx_helpers.go

Co-authored-by: Phil <[email protected]>

* Correct failure vs success in Send

The triggered conditions for failures and successes are backwards in the
`Send` method of `TxMangerIntercept`.  Their specific frame markers
should be switched.

* Update espresso/environment/14_batcher_fallback_test.go

Co-authored-by: Phil <[email protected]>

---------

Co-authored-by: Phil <[email protected]>
* Check if the batcher is active before publishing to L1/DA

* fix readme lint

* more lint fixes

* check batcher contract

* Fix endless warning

* add batch authenticator address to rollup config

* handle contract undeployed error

* attempt test in CI

* add test to CI

* Revert "add test to CI"

This reverts commit 2a9678a.

* add test to CI

* remove jg/ from branches

* attempt to clean up and make the test more reliable

* fix ci error WaitUntilSafe undefined

* revert 07a82bf

* Fix `anvil_setBalance` not found error

* Simplify isActive check

* add batcher-active-publish-only to devnet tests justfile

* - simplify test, one less batcher switch
- increase timeouts for devnet test

* Cleaned up the code, raise tx waiting time to 60s

* Brought back original timeouts

* started fallback batcher up + lint fix docker compose file

* Ensure that in Espresso mode the batch authenticator address is set.

* Removing all changes to driver.go and the tests are still passing.

---------

Co-authored-by: Philippe Camacho <[email protected]>
* Remove pre authenticated batcher

* fix test
Bumps [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) from 0.46.0 to 0.57.0.
- [Release notes](https://github.com/quic-go/quic-go/releases)
- [Commits](quic-go/quic-go@v0.46.0...v0.57.0)

---
updated-dependencies:
- dependency-name: github.com/quic-go/quic-go
  dependency-version: 0.57.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot changed the base branch from celo-integration-rebase-14.1 to celo-integration-rebase-14.2 January 16, 2026 01:54
@dependabot dependabot bot force-pushed the dependabot/go_modules/github.com/quic-go/quic-go-0.57.0 branch from c55817b to 3e58a02 Compare January 16, 2026 01:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.