fix(deps): update module github.com/imroc/req/v3 to v3.61.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/imroc/req/v3	v3.57.0 → v3.61.0

---

Release Notes

imroc/req (github.com/imroc/req/v3)

v3.61.0: Release

Compare Source

New Features

• Add Client.SetResolver and Client.SetHosts for custom DNS on HTTP/1 and HTTP/2 — custom net.Resolver or static hosts-file-style hostname→IP mapping, with fail-closed behavior for unknown hosts. Closes #​169. PR #​516 by @​ManuelReschke.
• Expose RetryOption for middleware read access — adds Request.GetRetryOption() so middleware can read the live retry config (MaxRetries, interval, conditions, hooks). Closes #​475. PR #​515 by @​ManuelReschke.

Dependencies

• github.com/klauspost/compress v1.19.1 → v1.19.2
• golang.org/x/text v0.40.0 → v0.41.0
• golang.org/x/crypto v0.54.0 → v0.55.0

v3.60.0: Release

Compare Source

Breaking Changes

• SetTLSFingerprintSpec API change — The signature changed from SetTLSFingerprintSpec(spec *utls.ClientHelloSpec) to SetTLSFingerprintSpec(fn func() utls.ClientHelloSpec). This fixes a bug where reusing the same spec across multiple TLS handshakes caused the second handshake to fail (#​504). The factory function ensures a fresh spec is generated per connection. PR #​507 by @​1992w.

New Features

• SetMaxResponseSize — Limit response body size at the client or request level. When Content-Length is known and exceeds the limit, the body is closed without reading. For chunked responses, a streaming limit reader stops at the configured size and returns ErrResponseBodyTooLarge. Closes #​406. PR #​512 by @​ManuelReschke.

• SOCKS4 and SOCKS4a proxy support — socks4:// and socks4a:// proxy URLs are now supported. SOCKS4 resolves domain names locally to IPv4; SOCKS4a sends the domain name to the proxy for remote resolution. Closes #​473. PR #​510 by @​ManuelReschke.

• HTTP QUERY method — Added Request.Query(url) and Request.MustQuery(url) for the HTTP QUERY method defined in RFC 10008 (Proposed Standard, June 2026). PR #​508 by @​thatwasyahya.

• Retry on before-request errors — Retry logic now covers errors from before-request middleware, not just transport errors. PR #​499 by @​bao-io.

Bug Fixes

• Stream multipart uploads without buffering files — Multipart uploads now stream directly to the HTTP transport via io.Pipe instead of building the complete body in a bytes.Buffer. Memory usage is bounded for large file uploads. Fixes #​433. PR #​505 by @​ManuelReschke.

Dependencies

• quic-go v0.60.0 → v0.61.0
• klauspost/compress v1.18.2 → v1.19.1
• icholy/digest v1.1.0 → v1.2.0
• google/go-querystring v1.1.0 → v1.2.0
• andybalholm/brotli v1.2.0 → v1.2.2
• golang.org/x/net v0.55.0 → v0.57.0
• golang.org/x/text v0.37.0 → v0.40.0
• golang.org/x/crypto v0.51.0 → v0.54.0 (indirect)
• golang.org/x/sys v0.45.0 → v0.47.0 (indirect)

v3.59.0: Release

Compare Source

Breaking Changes

• Go 1.25+ required — quic-go v0.60.0 drops Go 1.24 support. The go directive in go.mod is now 1.25.0, and CI tests against Go 1.25.x and 1.26.x. Users on Go 1.24 should stay on v3.58.0.

Dependencies

• Port quic-go v0.60.0 — full sync of all http3 changes from quic-go v0.59.0 → v0.60.0 into req's vendored internal/http3/:
  • Fix QuaterStreamID → QuarterStreamID field rename in qlog DatagramCreated / DatagramParsed (compile error with quic-go v0.60.0). Fixes #​500.
  • Extract validateHeaderFieldNameAndValue, validateRegularHeaderField, validateTrailerHeaderField helper functions in headers.go
  • parseTrailers: add sizeLimit parameter with per-field size accounting and errHeaderTooLarge check
  • Add validExtendedConnectProtocol function (RFC 9220) and validate extended CONNECT :protocol in request_writer.go
  • Use strings.SplitSeq in extractAnnouncedTrailers

v3.58.0: Release

Compare Source

New Features

• Add SetTLSFingerprintSpec for custom ClientHelloSpec support — accepts a *utls.ClientHelloSpec for fine-grained TLS fingerprint customization (JA3/JA4). Closes #​477, #​478.
• Add SensitiveHeadersRedirectPolicy — strips custom auth headers (e.g. X-API-Key, X-Auth-Token) on cross-domain redirects to prevent credential leakage (CWE-200). Fixes #​489.
• Port quic-go v0.59.0 — aligns with quic-go v0.59.0 breaking changes: removes deprecated ConnectionTracingID/ConnectionTracingKey, removes stream hijacking API, replaces handleUnidirectionalStreams with per-stream callback, adds RawClientConn for fine-grained stream control, adds HandleBidirectionalStream (closes conn per RFC 9114), fixes SupportsDatagrams → SupportsDatagrams.Remote. Fixes #​482.

Bug Fixes

• Unmarshal returns error on error status codes — now checks IsErrorState() before deserializing, preventing 4xx/5xx response bodies from being deserialized into target structs. Closes #​465.
• Retry on GOAWAY errors with cached HTTP/2 connections — RoundTripOnlyCachedConn now falls through to create a new connection instead of returning errClientConnGotGoAway directly. Closes #​491.
• SetCookieJarFactory returns http.CookieJar interface — changes return type from *cookiejar.Jar to http.CookieJar, allowing custom cookie jar implementations. Closes #​415.
• Add application/json to Chrome impersonate accept header — matches Chrome's actual accept header for API requests expecting JSON. Closes #​471.

Dependencies

• Upgrade utls to v1.8.2 — security update from v1.8.1. Addresses #​459.

Tests

• Add comprehensive unit tests for HTTP/3 frames, headers, transport, and dump.
• Add automated test gate infrastructure.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: ci-github-notifier/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 13 additional dependencies were updated

Details:

Package	Change
github.com/andybalholm/brotli	v1.2.0 -> v1.2.2
github.com/google/go-querystring	v1.1.0 -> v1.2.0
github.com/icholy/digest	v1.1.0 -> v1.2.0
github.com/klauspost/compress	v1.18.2 -> v1.19.2
github.com/quic-go/quic-go	v0.57.1 -> v0.61.0
github.com/refraction-networking/utls	v1.8.1 -> v1.8.2
golang.org/x/crypto	v0.46.0 -> v0.55.0
golang.org/x/mod	v0.30.0 -> v0.38.0
golang.org/x/net	v0.48.0 -> v0.57.0
golang.org/x/sync	v0.19.0 -> v0.22.0
golang.org/x/sys	v0.39.0 -> v0.47.0
golang.org/x/text	v0.32.0 -> v0.41.0
golang.org/x/tools	v0.39.0 -> v0.48.0