quic-go

This release adds a couple of new features:

• Adds an API to peek stream data on ReceiveStream and Stream: #5501
• Adds an API to peek the next varint on a stream: #5502
• Reworks the API exposed by the HTTP/3 package for WebTransport: #5509, #5512. Regular HTTP/3 use cases should not be affected by these changes.
• Adds support for HTTP request trailers (trailers sent by the client): #5...

This patch release backports fixes for a bug in the PTO queueing logic that could lead to an infinite loop of PING packets.

Bug Fixes

• ackhandler: fix qlogging of outstanding packet count (#5538)
• ackhandler: fix counting of packets queued for PTO probing (#5539)

This release optimizes the QUIC handshake:

• Multiple incoming packets are now processed before sending an acknowledgment, reducing the total number of packets sent: #5451
• ACK frames are now packed into coalesced packets, reducing the need to send a separate packet just for the ACK in many cases: #5477
• When packets are buffered during the handshake, this now doesn't lead to inflated RTT m...

This release resolves a panic during the server handshake when using the upcoming Go 1.26 toolchain, specifically occurring with TLS session tickets disabled (#5462). This issue does not impact builds on Go 1.25 or earlier versions.

This release contains a fix for CVE-2025-64702 by reworking the HTTP/3 header processing logic:

• Both client and server now send their respective header size constraints using the SETTINGS_MAX_FIELD_SECTION_SIZE setting: #5431
• For any QPACK-related errors, the correct error code (QPACK_DECOMPRESSION_FAILED) is now used: #5439
• QPACK header parsing is now incremental (instead of parsing al...