Breaking Changes

• SetTLSFingerprintSpec API change — The signature changed from SetTLSFingerprintSpec(spec *utls.ClientHelloSpec) to SetTLSFingerprintSpec(fn func() utls.ClientHelloSpec). This fixes a bug where reusing the same spec across multiple TLS handshakes caused the second handshake to fail (#504). The factory function ensures a fresh spec is generated per connection. PR #507 by @1992w.

New Features

• SetMaxResponseSize — Limit response body size at the client or request level. When Content-Length is known and exceeds the limit, the body is closed without reading. For chunked responses, a streaming limit reader stops at the configured size and returns ErrResponseBodyTooLarge. Closes #406. PR #512 by @ManuelReschke.

• SOCKS4 and SOCKS4a proxy support — socks4:// and socks4a:// proxy URLs are now supported. SOCKS4 resolves domain names locally to IPv4; SOCKS4a sends the domain name to the proxy for remote resolution. Closes #473. PR #510 by @ManuelReschke.

• HTTP QUERY method — Added Request.Query(url) and Request.MustQuery(url) for the HTTP QUERY method defined in RFC 10008 (Proposed Standard, June 2026). PR #508 by @thatwasyahya.

• Retry on before-request errors — Retry logic now covers errors from before-request middleware, not just transport errors. PR #499 by @bao-io.

Bug Fixes

• Stream multipart uploads without buffering files — Multipart uploads now stream directly to the HTTP transport via io.Pipe instead of building the complete body in a bytes.Buffer. Memory usage is bounded for large file uploads. Fixes #433. PR #505 by @ManuelReschke.

Dependencies

• quic-go v0.60.0 → v0.61.0
• klauspost/compress v1.18.2 → v1.19.1
• icholy/digest v1.1.0 → v1.2.0
• google/go-querystring v1.1.0 → v1.2.0
• andybalholm/brotli v1.2.0 → v1.2.2
• golang.org/x/net v0.55.0 → v0.57.0
• golang.org/x/text v0.37.0 → v0.40.0
• golang.org/x/crypto v0.51.0 → v0.54.0 (indirect)
• golang.org/x/sys v0.45.0 → v0.47.0 (indirect)

Breaking Changes

• Go 1.25+ required — quic-go v0.60.0 drops Go 1.24 support. The go directive in go.mod is now 1.25.0, and CI tests against Go 1.25.x and 1.26.x. Users on Go 1.24 should stay on v3.58.0.

Dependencies

• Port quic-go v0.60.0 — full sync of all http3 changes from quic-go v0.59.0 → v0.60.0 into req's vendored internal/http3/:
  • Fix QuaterStreamID → QuarterStreamID field rename in qlog DatagramCreated / DatagramParsed (compile error with quic-go v0.60.0). Fixes #500.
  • Extract validateHeaderFieldNameAndValue, validateRegularHeaderField, validateTrailerHeaderField helper functions in headers.go
  • parseTrailers: add sizeLimit parameter with per-field size accounting and errHeaderTooLarge check
  • Add validExtendedConnectProtocol function (RFC 9220) and validate extended CONNECT :protocol in request_writer.go
  • Use strings.SplitSeq in extractAnnouncedTrailers

New Features

• Add SetTLSFingerprintSpec for custom ClientHelloSpec support — accepts a *utls.ClientHelloSpec for fine-grained TLS fingerprint customization (JA3/JA4). Closes #477, #478.
• Add SensitiveHeadersRedirectPolicy — strips custom auth headers (e.g. X-API-Key, X-Auth-Token) on cross-domain redirects to prevent credential leakage (CWE-200). Fixes #489.
• Port quic-go v0.59.0 — aligns with quic-go v0.59.0 breaking changes: removes deprecated ConnectionTracingID/ConnectionTracingKey, removes stream hijacking API, replaces handleUnidirectionalStreams with per-stream callback, adds RawClientConn for fine-grained stream control, adds HandleBidirectionalStream (closes conn per RFC 9114), fixes SupportsDatagrams → SupportsDatagrams.Remote. Fixes #482.

Bug Fixes

• Unmarshal returns error on error status codes — now checks IsErrorState() before deserializing, preventing 4xx/5xx response bodies from being deserialized into target structs. Closes #465.
• Retry on GOAWAY errors with cached HTTP/2 connections — RoundTripOnlyCachedConn now falls through to create a new connection instead of returning errClientConnGotGoAway directly. Closes #491.
• SetCookieJarFactory returns http.CookieJar interface — changes return type from *cookiejar.Jar to http.CookieJar, allowing custom cookie jar implementations. Closes #415.
• Add application/json to Chrome impersonate accept header — matches Chrome's actual accept header for API requests expecting JSON. Closes #471.

Dependencies

• Upgrade utls to v1.8.2 — security update from v1.8.1. Addresses #459.

Tests

• Add comprehensive unit tests for HTTP/3 frames, headers, transport, and dump.
• Add automated test gate infrastructure.

• Update go modules.
• Port quic-go v0.57.1 (fix #474)

• Update go modules
• Port quic-go v0.56.0

• Fix ResultState()documentation to clarify ResultState logic (#463)
• feat: add SetQueryParamsFromValues and SetQueryParamsFromStruct methods (#462)

• Replace go-multierror with errors.Join (#458)

• Fix data race condition in the Alt-Svc cache(#456)

• support quic-go 0.53.0