v3.59.0 Release

Breaking Changes

• Go 1.25+ required — quic-go v0.60.0 drops Go 1.24 support. The go directive in go.mod is now 1.25.0, and CI tests against Go 1.25.x and 1.26.x. Users on Go 1.24 should stay on v3.58.0.

Dependencies

• Port quic-go v0.60.0 — full sync of all http3 changes from quic-go v0.59.0 → v0.60.0 into req's vendored internal/http3/:
  • Fix QuaterStreamID → QuarterStreamID field rename in qlog DatagramCreated / DatagramParsed (compile error with quic-go v0.60.0). Fixes #500.
  • Extract validateHeaderFieldNameAndValue, validateRegularHeaderField, validateTrailerHeaderField helper functions in headers.go
  • parseTrailers: add sizeLimit parameter with per-field size accounting and errHeaderTooLarge check
  • Add validExtendedConnectProtocol function (RFC 9220) and validate extended CONNECT :protocol in request_writer.go
  • Use strings.SplitSeq in extractAnnouncedTrailers

v3.58.0 Release

New Features

• Add SetTLSFingerprintSpec for custom ClientHelloSpec support — accepts a *utls.ClientHelloSpec for fine-grained TLS fingerprint customization (JA3/JA4). Closes #477, #478.
• Add SensitiveHeadersRedirectPolicy — strips custom auth headers (e.g. X-API-Key, X-Auth-Token) on cross-domain redirects to prevent credential leakage (CWE-200). Fixes #489.
• Port quic-go v0.59.0 — aligns with quic-go v0.59.0 breaking changes: removes deprecated ConnectionTracingID/ConnectionTracingKey, removes stream hijacking API, replaces handleUnidirectionalStreams with per-stream callback, adds RawClientConn for fine-grained stream control, adds HandleBidirectionalStream (closes conn per RFC 9114), fixes SupportsDatagrams → SupportsDatagrams.Remote. Fixes #482.

Bug Fixes

• Unmarshal returns error on error status codes — now checks IsErrorState() before deserializing, preventing 4xx/5xx response bodies from being deserialized into target structs. Closes #465.
• Retry on GOAWAY errors with cached HTTP/2 connections — RoundTripOnlyCachedConn now falls through to create a new connection instead of returning errClientConnGotGoAway directly. Closes #491.
• SetCookieJarFactory returns http.CookieJar interface — changes return type from *cookiejar.Jar to http.CookieJar, allowing custom cookie jar implementations. Closes #415.
• Add application/json to Chrome impersonate accept header — matches Chrome's actual accept header for API requests expecting JSON. Closes #471.

Dependencies

• Upgrade utls to v1.8.2 — security update from v1.8.1. Addresses #459.

Tests

• Add comprehensive unit tests for HTTP/3 frames, headers, transport, and dump.
• Add automated test gate infrastructure.

v3.57.0 Release

• Update go modules.
• Port quic-go v0.57.1 (fix #474)

v3.56.0 Release

• Update go modules
• Port quic-go v0.56.0

v3.55.0 Release

• Fix ResultState()documentation to clarify ResultState logic (#463)
• feat: add SetQueryParamsFromValues and SetQueryParamsFromStruct methods (#462)

v3.54.2 Release

• Replace go-multierror with errors.Join (#458)

v3.54.1 Release

• Fix data race condition in the Alt-Svc cache(#456)

v3.54.0 Release

• support quic-go 0.53.0

v3.53.0 Release

• Upgrade all dependencies to the latest stable version.
• Port quic-go's latest stable version's logic.
• Now it requires go1.24+.

• README: Add Go Version Compatibility Matrix

v3.52.2 Release

add Do func for client (compatible with http.Client.Do)