chore: upgrade dependencies (quic-go v0.61.0, compress v1.19.1, digest v1.2.0)

[imroc]

Dependency Upgrades

Upgraded 3 direct dependencies:

Dependency	From	To	Type
github.com/quic-go/quic-go	v0.60.0	v0.61.0	minor (sensitive)
github.com/klauspost/compress	v1.19.0	v1.19.1	patch
github.com/icholy/digest	v1.1.0	v1.2.0	minor

Sensitive dependency verification

quic-go v0.60.0 → v0.61.0 (minor) — upgraded and verified separately before batching other upgrades. This is sensitive because req vendors a modified copy of quic-go in internal/http3/. After upgrade:

• go build ./... passes
• go vet ./... passes
• go test ./internal/http3/... ./internal/http2/... passes
• Full test suite go test ./... passes (22 packages ok, including internal/http3 and internal/http2)

quic-go v0.61.0 is compatible with the vendored modified code in internal/http3/.

Dependencies already at latest (no change)

• github.com/refraction-networking/utls v1.8.2
• golang.org/x/net v0.57.0
• golang.org/x/crypto v0.54.0
• golang.org/x/text v0.40.0
• golang.org/x/sys v0.47.0
• github.com/andybalholm/brotli v1.2.2

Verification checklist

• go build ./... succeeds
• go vet ./... passes
• go test ./... -coverprofile=coverage.txt all packages pass
• go mod tidy leaves no residual changes

Notes

• Only go.mod and go.sum modified — no source code changes
• No files in internal/http3/ or internal/http2/ were touched
• Supersedes PR chore: upgrade dependencies #511 and PR chore: upgrade dependencies (quic-go v0.61.0, compress v1.19.1, digest v1.2.0) #513 (same upgrades, both still open)

Reminder

The vendored modified copies of Go stdlib net/http, golang.org/x/net/http2, and quic-go (in internal/http3/) are not upgraded by this PR — their upstream sync is a separate manual process requiring per-file diff comparison.

[imroc]

Review: Dependency Upgrade — Looks Good ✅

Reviewed this PR as part of the automated PR review loop.

Changes

• go.mod / go.sum only — no source code modifications
• 3 direct dependency upgrades:
  • quic-go v0.60.0 → v0.61.0 (minor, sensitive)
  • klauspost/compress v1.19.0 → v1.19.1 (patch)
  • icholy/digest v1.1.0 → v1.2.0 (minor)

Verification

• CI: Both Go 1.25.x and 1.26.x jobs pass ✅
• Sensitive dependency (quic-go v0.61.0): Verified compatible with the vendored modified code in internal/http3/ — go build ./..., go vet ./..., and full test suite (go test ./..., 22 packages including internal/http3 and internal/http2) all pass.
• No files in internal/http3/ or internal/http2/ were touched — the vendored modified copies remain at their current upstream sync baseline.
• go mod tidy leaves no residual changes.

Notes

• Supersedes PR #511 and #513 (both now closed) — same upgrades, consolidated into this PR.
• The vendored modified copies of Go stdlib net/http, golang.org/x/net/http2, and quic-go (in internal/http3/) are not upgraded by this PR. Their upstream sync remains a separate manual process.
• As a reminder for future upstream sync: when internal/http3/ is next synced to quic-go v0.61.0, ensure all req-specific customizations (dump, middleware, protocol sniffing) are preserved.

No blockers. Since this is the maintainer's own PR, leaving a review comment rather than approving.