[dependabot]

Bumps the go-modules group with 2 updates in the / directory: github.com/Eyevinn/mp4ff and github.com/quic-go/quic-go.

Updates github.com/Eyevinn/mp4ff from 0.59.0 to 0.60.0

Release notes

Sourced from github.com/Eyevinn/mp4ff's releases.

v0.60.0

mp4ff v0.60.0 can read sample data from the external files that a track's dref names, and can write AAC sample entries for 5.1, 7.1 and other fixed channel layouts. Go 1.24 is now the minimum version, and the tools take their version from Go's build information.

Added

• File.ReadSampleData reads a progressive track's samples, through a DataResolver such as LocalFileResolver also from the files that its dref names, as in Unified Streaming dref MP4s; the segmenter example uses it
• avc.ParseSliceHeaderInto parses a slice header into a caller's SliceHeader without allocating
• TrakBox.SetAACDescriptorWithChannelConfig sets an AAC sample entry with any fixed channel configuration, such as 5.1 or 7.1, and aac.NrChannels gives the number of channels of a configuration

Changed

• Go 1.24 is the minimum Go version
• The tools' -version reports the version that Go embeds from git, which names the commit between releases. Builds from a source archive set it with -ldflags "-X github.com/Eyevinn/mp4ff/internal.commitVersion=vX.Y.Z"

Fixed

• StscBox.GetSampleDescriptionID returns the ID of the entry that the chunk belongs to, and mp4ff-crop keeps the right sample description ID in a cropped stsc with several of them
• The segmenter example includes the last sample of each track in its last segment
• avc.ParseSliceHeader and avc.ParseSliceHeaderInto set SliceHeader.SeqParamID to the ID of the SPS that the slice's PPS refers to
• aac.DecodeADTSHeader returns an error for a frame_length shorter than the header, instead of a wrapped PayloadLength close to 65535
• HdlrBox keeps its reserved words in Reserved, so a QuickTime or iTunes mdir handler with the "appl" manufacturer, as ffmpeg writes, encodes as it was decoded

Changelog

Sourced from github.com/Eyevinn/mp4ff's changelog.

[0.60.0] - 2026-10-13

Added

• File.ReadSampleData reads a progressive track's samples, through a DataResolver such as LocalFileResolver also from the files that its dref names, as in Unified Streaming dref MP4s; the segmenter example uses it
• avc.ParseSliceHeaderInto parses a slice header into a caller's SliceHeader without allocating
• TrakBox.SetAACDescriptorWithChannelConfig sets an AAC sample entry with any fixed channel configuration, such as 5.1 or 7.1, and aac.NrChannels gives the number of channels of a configuration

Changed

• Go 1.24 is the minimum Go version
• The tools' -version reports the version that Go embeds from git, which names the commit between releases. Builds from a source archive set it with -ldflags "-X github.com/Eyevinn/mp4ff/internal.commitVersion=vX.Y.Z"

Fixed

• StscBox.GetSampleDescriptionID returns the ID of the entry that the chunk belongs to, and mp4ff-crop keeps the right sample description ID in a cropped stsc with several of them
• The segmenter example includes the last sample of each track in its last segment
• avc.ParseSliceHeader and avc.ParseSliceHeaderInto set SliceHeader.SeqParamID to the ID of the SPS that the slice's PPS refers to
• aac.DecodeADTSHeader returns an error for a frame_length shorter than the header, instead of a wrapped PayloadLength close to 65535
• HdlrBox keeps its reserved words in Reserved, so a QuickTime or iTunes mdir handler with the "appl" manufacturer, as ffmpeg writes, encodes as it was decoded

Commits

• dab0d5d chore: prepare v0.60.0 release
• 0b7c9d7 fix(mp4): keep the reserved words of hdlr when encoding
• 696692d fix(aac): reject an ADTS frame_length shorter than the header
• 2e7f9b2 feat(mp4): set AAC sample entries with other channel configurations than stereo
• f4e3775 fix(avc): set SliceHeader.SeqParamID from the slice's PPS
• 2e5119c feat(avc): ParseSliceHeaderInto parses into a caller's SliceHeader
• 118a2bf docs: put the Unreleased CHANGELOG sections in order
• 3abc620 fix(examples): include the last sample in the segmenter's last segment
• ebb7dff feat(mp4): open LocalFileResolver files through os.Root
• b9ed3b6 feat(mp4): read sample data from the files that a track's dref names
• Additional commits viewable in compare view

Updates github.com/quic-go/quic-go from 0.63.0 to 0.64.0

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.64.0

This release improves congestion control and performance, especially on paths with packet reordering:

• Slow-start pacing now uses twice the estimated bandwidth, allowing the sending rate to double each RTT: #5882
• Application-data loss detection now disables packet-threshold detection after a spurious loss, avoiding repeated unnecessary retransmissions caused by packet reordering: #5905
• Application-data loss detection now uses an adaptive time threshold that increases after spurious losses, allowing more time for reordered packets to arrive: #5925
• The congestion controller now restores its congestion window and recovery state after a reduction caused entirely by spurious packet loss: #5923

Notable Fixes

• Congestion recovery now respects send order across Initial, Handshake and application-data packets, fixing incorrect recovery decisions caused by comparing packet numbers from different spaces: #5920
• Connections now fall back to 1200-byte Initial packets on EMSGSIZE when Config.InitialPacketSize is unset, allowing handshakes over paths with smaller MTUs: #5911
• Oversized packets are now rejected before serialization, including Initial packets with excessively large address-validation tokens: #5937
• Path MTU discovery now restarts correctly after connection migration and NAT rebinding: #5887
• Servers now retry unanswered PATH_CHALLENGEs with exponential backoff as more packets arrive on the candidate path, preventing path validation from stalling when a challenge is acknowledged but no PATH_RESPONSE arrives: #5930
• Servers now continue responding to PATH_CHALLENGEs on existing candidate paths when the candidate path limit is reached: #5929
• Writes after closing a SendStream or Stream now return quic.ErrStreamClosed, which is also used as the stream context's cancellation cause: #5885
• Conn.SendDatagram now returns the connection's close error after shutdown, instead of accepting datagrams that will be silently dropped: #5880
• http3: SendDatagram now immediately returns an error after the stream's send side closes, including after STOP_SENDING or connection shutdown: #5884
• http3: request header, response header and trailer buffers now grow as data arrives, avoiding large allocations based solely on a peer's advertised HEADERS frame length: #5886
• Spurious losses are now detected when an ACK only acknowledges packets previously declared lost: #5895
• Spurious losses are now detected when ACKs arrive out of order: #5900
• Path migration now clears the old path's loss history, preventing stale spurious-loss reports and recovery adjustments: #5903
• MTU and path probes no longer trigger spurious-loss reports or adaptive loss-recovery changes: #5906

Notable Changes

• ConnectionStats now exposes CongestionWindow, reporting the local sender's congestion window on the active network path in bytes: #5901
• http3.Stream and http3.RequestStream now expose QlogTrace, allowing applications to add events to the underlying connection's qlog trace: #5935
• http3/qlog.RedactHeaders allows applications to redact HTTP/3 header and trailer values, including pseudo-headers, before they are written to qlog: #5932
• qlog: locally dropped QUIC datagrams are now recorded with quic:datagram_dropped, including drops caused by a full receive buffer or an oversized outgoing datagram: #5907
• qlog: quic:recovery_parameters_set now records initial recovery parameters and changes to loss-detection thresholds, including resets after path migration: #5926

Changelog

• return an error from Conn.SendDatagram when the connection is closed by @​marten-seemann in quic-go/quic-go#5880
• http3: fail SendDatagram as soon as the send side is closed by @​marten-seemann in quic-go/quic-go#5884
• use ErrStreamClosed instead of context.Canceled for closed streams by @​marten-seemann in quic-go/quic-go#5885
• congestion: pass the pacing rate explicitly to the pacer by @​marten-seemann in quic-go/quic-go#5881
• congestion: increase slow start pacing factor to 2 by @​marten-seemann in quic-go/quic-go#5882
• http3: grow header block buffers as data arrives by @​marten-seemann in quic-go/quic-go#5886
• ackhandler: use a fixed cap for tracked lost packets by @​marten-seemann in quic-go/quic-go#5888
• ackhandler: detect spurious loss when only lost packets are ACKed by @​marten-seemann in quic-go/quic-go#5895
• ackhandler: avoid floating point math for time threshold calculations by @​marten-seemann in quic-go/quic-go#5896
• ackhandler: move MaxAckDelay constant from the protocol package by @​marten-seemann in quic-go/quic-go#5892
• ackhandler: don’t store MaxAckDelay on the appDataReceivedPacketTracker by @​marten-seemann in quic-go/quic-go#5893
• congestion: move MinPacingDelay constant from the protocol package by @​marten-seemann in quic-go/quic-go#5889
• handshake: move the KeyUpdateInterval from the protocol package by @​marten-seemann in quic-go/quic-go#5891
• ackhandler: detect spurious losses in reordered ACKs by @​marten-seemann in quic-go/quic-go#5900
• move 0-RTT queue constants from the protocol package by @​marten-seemann in quic-go/quic-go#5890

... (truncated)

Commits

• 9abbbad retry server path challenges with exponential backoff (#5930)
• 15baf53 only enforce the candidate path limit for new paths (#5929)
• 8754e95 reject oversized packets before serialization (#5937)
• 54cf12e http3: expose the connection's qlog trace on streams (#5935)
• 4b404ee http3/qlog: implement redacting of header fields (#5932)
• 432b156 README: link OSS-Fuzz badge to the introspector (#5928)
• d4981bc qlog initial recovery parameters and loss threshold updates (#5926)
• 99c7436 fall back to 1200 bytes initial packet size on EMSGSIZE (#5911)
• 53a52d5 ackhandler: increase the time threshold after spurious losses (#5925)
• 6b98bc9 restore congestion control state after spurious packet loss (#5923)
• Additional commits viewable in compare view

[floatdrop]

@dependabot rebase