Skip to content

build(deps): bump github.com/imroc/req/v3 from 3.59.0 to 3.60.0 in /contrib/req_log - #202

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/contrib/req_log/github.com/imroc/req/v3-3.60.0
Open

build(deps): bump github.com/imroc/req/v3 from 3.59.0 to 3.60.0 in /contrib/req_log#202
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/contrib/req_log/github.com/imroc/req/v3-3.60.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown

Bumps github.com/imroc/req/v3 from 3.59.0 to 3.60.0.

Release notes

Sourced from github.com/imroc/req/v3's releases.

v3.60.0 Release

Breaking Changes

  • SetTLSFingerprintSpec API change — The signature changed from SetTLSFingerprintSpec(spec *utls.ClientHelloSpec) to SetTLSFingerprintSpec(fn func() utls.ClientHelloSpec). This fixes a bug where reusing the same spec across multiple TLS handshakes caused the second handshake to fail (#504). The factory function ensures a fresh spec is generated per connection. PR #507 by @​1992w.

New Features

  • SetMaxResponseSize — Limit response body size at the client or request level. When Content-Length is known and exceeds the limit, the body is closed without reading. For chunked responses, a streaming limit reader stops at the configured size and returns ErrResponseBodyTooLarge. Closes #406. PR #512 by @​ManuelReschke.

  • SOCKS4 and SOCKS4a proxy supportsocks4:// and socks4a:// proxy URLs are now supported. SOCKS4 resolves domain names locally to IPv4; SOCKS4a sends the domain name to the proxy for remote resolution. Closes #473. PR #510 by @​ManuelReschke.

  • HTTP QUERY method — Added Request.Query(url) and Request.MustQuery(url) for the HTTP QUERY method defined in RFC 10008 (Proposed Standard, June 2026). PR #508 by @​thatwasyahya.

  • Retry on before-request errors — Retry logic now covers errors from before-request middleware, not just transport errors. PR #499 by @​bao-io.

Bug Fixes

  • Stream multipart uploads without buffering files — Multipart uploads now stream directly to the HTTP transport via io.Pipe instead of building the complete body in a bytes.Buffer. Memory usage is bounded for large file uploads. Fixes #433. PR #505 by @​ManuelReschke.

Dependencies

  • quic-go v0.60.0 → v0.61.0
  • klauspost/compress v1.18.2 → v1.19.1
  • icholy/digest v1.1.0 → v1.2.0
  • google/go-querystring v1.1.0 → v1.2.0
  • andybalholm/brotli v1.2.0 → v1.2.2
  • golang.org/x/net v0.55.0 → v0.57.0
  • golang.org/x/text v0.37.0 → v0.40.0
  • golang.org/x/crypto v0.51.0 → v0.54.0 (indirect)
  • golang.org/x/sys v0.45.0 → v0.47.0 (indirect)
Commits
  • 789eeac Revert "chore: gitignore AGENTS.md for local AI agent config"
  • 9cec738 chore: gitignore AGENTS.md for local AI agent config
  • dfcc12c feat: Add SetMaxResponseSize to limit response body size (#406) (#512)
  • a43b760 feat: add SOCKS4 and SOCKS4a proxy support (#473) (#510)
  • 0e377e6 fix: SetTLSFingerprintSpec fails on consecutive handshakes to different domai...
  • 53d43b5 feat: add Query and MustQuery for the HTTP QUERY method (RFC 10008) (#508)
  • 319d3a7 chore: upgrade dependencies (quic-go v0.61.0, compress v1.19.1, digest v1.2.0...
  • d34ebe5 Merge pull request #505 from ManuelReschke/master
  • 7c8f5bf Merge pull request #506 from imroc/chore/upgrade-deps-20260714
  • 621ab69 chore: upgrade dependencies
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/imroc/req/v3](https://github.com/imroc/req) from 3.59.0 to 3.60.0.
- [Release notes](https://github.com/imroc/req/releases)
- [Commits](imroc/req@v3.59.0...v3.60.0)

---
updated-dependencies:
- dependency-name: github.com/imroc/req/v3
  dependency-version: 3.60.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 3, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: go, req_log. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants