cppla · Oct 8, 2026 · Oct 5, 2026 · Oct 8, 2026 · Oct 8, 2026 · Oct 8, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        go: ['1.25.13', '1.27.x']
+        go: ['1.26.8', '1.27.x']
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -60,26 +60,26 @@ jobs:
           if-no-files-found: error
 
   macos-test:
-    name: macOS test (Go 1.25.13)
+    name: macOS test (Go 1.26.8)
     runs-on: macos-14
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.25.13
+          go-version: 1.26.8
           cache: true
       - name: Test
         run: go test -shuffle=on -count=1 ./...
 
   windows-udp-test:
-    name: Windows UDP continuity (Go 1.25.13)
+    name: Windows UDP continuity (Go 1.26.8)
     runs-on: windows-2022
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.25.13
+          go-version: 1.26.8
           cache: true
       - name: Exercise native UDP continuity and platform bind errors
         shell: pwsh
@@ -134,7 +134,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.25.13
+          go-version: 1.26.8
           cache: true
       - name: Run govulncheck
         run: ./scripts/govulncheck.sh

diff --git a/README.md b/README.md
@@ -85,7 +85,7 @@ Web cover 的目标是正常网站兼容、减少主动探测暴露并在 UDP
 
 ## 快速开始
 
-客户端和服务端分别在各自机器上构建，需要 Go 1.25.13 或更高版本：
+客户端和服务端分别在各自机器上构建，需要 Go 1.26.8 或更高版本：
 
 ```bash
 git clone https://github.com/cppla/autocar.git

diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
@@ -393,7 +393,7 @@ The above copyright notice and this permission notice shall be included in all c
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ```
 
-## `github.com/quic-go/quic-go` `v0.61.0`
+## `github.com/quic-go/quic-go` `v0.63.0`
 
 ### `LICENSE`
 
@@ -459,7 +459,7 @@ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 ```
 
-## `golang.org/x/crypto` `v0.55.0`
+## `golang.org/x/crypto` `v0.57.0`
 
 ### `LICENSE`
 
@@ -523,7 +523,7 @@ rights granted to you under this License for this implementation of Go
 shall terminate as of the date such litigation is filed.
 ```
 
-## `golang.org/x/net` `v0.58.0`
+## `golang.org/x/net` `v0.59.0`
 
 ### `LICENSE`
 
@@ -587,7 +587,7 @@ rights granted to you under this License for this implementation of Go
 shall terminate as of the date such litigation is filed.
 ```
 
-## `golang.org/x/sys` `v0.47.0`
+## `golang.org/x/sys` `v0.48.0`
 
 ### `LICENSE`
 
@@ -651,7 +651,7 @@ rights granted to you under this License for this implementation of Go
 shall terminate as of the date such litigation is filed.
 ```
 
-## `golang.org/x/text` `v0.41.0`
+## `golang.org/x/text` `v0.42.0`
 
 ### `LICENSE`
 

diff --git a/docs/ACCELERATION.md b/docs/ACCELERATION.md
@@ -153,7 +153,7 @@ delay test matters at least as much as bulk throughput.
 ## `reno`
 
 `reno` bypasses AutoCAR's application-layer admission. It does not implement
-Reno itself; the native pinned upstream quic-go v0.61.0 transport selects Reno
+Reno itself; the native pinned upstream quic-go v0.63.0 transport selects Reno
 for its default sender. This mode therefore measures that actual upstream
 baseline and is useful
 for A/B tests or for operators who do not want an additional application pacing

diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
@@ -35,7 +35,7 @@ flowchart LR
 | `internal/security` | TLS policy, secrets, remote resolution and SSRF/port/CIDR enforcement |
 | `internal/transport` | Small TCP and packet interfaces shared by frontends |
 
-The native transport uses upstream `github.com/quic-go/quic-go` v0.61.0. Web H3
+The native transport uses upstream `github.com/quic-go/quic-go` v0.63.0. Web H3
 uses the `github.com/apernet/quic-go` fork, pinned exactly to
 `v0.61.1-0.20260806010916-184d081eef3e`, because its client-only ChromeParrot
 profile controls the TLS ClientHello, QUIC transport parameters, connection IDs

diff --git a/docs/STEALTH-PILOT.md b/docs/STEALTH-PILOT.md
@@ -7,7 +7,7 @@ collection before paying the cost of the preregistered corpus.
 
 The result is always **calibration / `insufficient_evidence`**. Two captures per
 product and cell cannot establish that AutoCAR is less distinguishable than
-the baseline. The control uses upstream quic-go v0.61.0 and is deliberately
+the baseline. The control uses upstream quic-go v0.63.0 and is deliberately
 recorded as **not a real browser**. A later claim-bearing campaign still needs
 the preregistered browser diversity, sample count, held-out evaluation, and
 statistical gates in `docs/STEALTH-BENCHMARK.md`.

diff --git a/go.mod b/go.mod
@@ -1,20 +1,19 @@
 module github.com/cppla/autocar
 
-go 1.25.13
+go 1.26.8
 
 require (
 	github.com/apernet/quic-go v0.61.1-0.20260806010916-184d081eef3e
-	github.com/quic-go/quic-go v0.61.0
+	github.com/quic-go/quic-go v0.63.0
 	github.com/refraction-networking/utls v1.8.2
-	golang.org/x/net v0.58.0
+	golang.org/x/net v0.59.0
 )
 
 require (
 	github.com/andybalholm/brotli v1.0.6 // indirect
 	github.com/klauspost/compress v1.17.4 // indirect
 	github.com/quic-go/qpack v0.6.0 // indirect
-	github.com/stretchr/testify v1.12.1 // indirect
-	golang.org/x/crypto v0.55.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/crypto v0.57.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
 )
diff --git a/go.sum b/go.sum
@@ -8,8 +8,8 @@ github.com/quic-go/go-ossfuzz-seeds v0.1.0 h1:APacT+iIaNF6fd8AGEiN3bT/Jtkd2jz4v4
 github.com/quic-go/go-ossfuzz-seeds v0.1.0/go.mod h1:3IOHRbJIc+L6YKMwfDtJAM9Vj9k0YY4muhuyUYk5tbk=
 github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
 github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
-github.com/quic-go/quic-go v0.61.0 h1:ui88A53s8MSVYLC56en0KQ17HARk+9986Dn0SBfKNvA=
-github.com/quic-go/quic-go v0.61.0/go.mod h1:9So2anK4Tp22URSQq00k+Vo2PNkle96ycDPDHL4s9vs=
+github.com/quic-go/quic-go v0.63.0 h1:LIFGHI4PFUhhw2dDD1ARHdCff143ffMHwZtbnbuJ78A=
+github.com/quic-go/quic-go v0.63.0/go.mod h1:RAro2j2yN9a9EiPACLHT9IB2NXCvGQmmo/alT0yYI0w=
 github.com/refraction-networking/utls v1.8.2 h1:j4Q1gJj0xngdeH+Ox/qND11aEfhpgoEvV+S9iJ2IdQo=
 github.com/refraction-networking/utls v1.8.2/go.mod h1:jkSOEkLqn+S/jtpEHPOsVv/4V4EVnelwbMQl4vCWXAM=
 github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
@@ -18,11 +18,11 @@ go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
 go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
-golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
+golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
diff --git a/internal/cover/request_trailer_test.go b/internal/cover/request_trailer_test.go
@@ -512,12 +512,31 @@ func requestTrailerHTTPSExchange(t *testing.T, constructor string, protocol int)
 	}
 	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
 	defer cancel()
+	outboundClosed := make(chan struct{})
+	var outboundCloseOnce sync.Once
+	var outboundCloses atomic.Int64
+	observedTransport := roundTripFunc(func(request *http.Request) (*http.Response, error) {
+		// Observe the body handed to the real transport. A shallow copy keeps
+		// the trailer bridge's destination map; Request.Clone would detach it.
+		out := *request
+		body := out.Body
+		out.Body = &requestTrailerUnitBody{
+			read: body.Read,
+			close: func() error {
+				err := body.Close()
+				outboundCloses.Add(1)
+				outboundCloseOnce.Do(func() { close(outboundClosed) })
+				return err
+			},
+		}
+		return transport.RoundTrip(&out)
+	})
 	var handler http.Handler
 	if constructor == "public_origin" {
 		public, _ := url.Parse("https://public.example")
-		handler, err = NewReverseProxyHandlerWithPublicOrigin(origin, public, transport)
+		handler, err = NewReverseProxyHandlerWithPublicOrigin(origin, public, observedTransport)
 	} else {
-		handler, err = NewReverseProxyHandler(origin, transport)
+		handler, err = NewReverseProxyHandler(origin, observedTransport)
 	}
 	if err != nil {
 		t.Fatal(err)
@@ -539,7 +558,7 @@ func requestTrailerHTTPSExchange(t *testing.T, constructor string, protocol int)
 	reader := strings.NewReader(payload)
 	sourceEOF := make(chan struct{})
 	var eofOnce sync.Once
-	var bodyCloses atomic.Int64
+	var inboundCloses atomic.Int64
 	request.Body = &requestTrailerUnitBody{
 		read: func(p []byte) (int, error) {
 			n, err := reader.Read(p)
@@ -556,10 +575,26 @@ func requestTrailerHTTPSExchange(t *testing.T, constructor string, protocol int)
 			}
 			return n, err
 		},
-		close: func() error { bodyCloses.Add(1); return nil },
+		close: func() error { inboundCloses.Add(1); return nil },
 	}
+	// This direct ServeHTTP fixture owns inbound cleanup, as an HTTP server
+	// would. ReverseProxy may shield that body from outbound Close calls.
+	var inboundCloseOnce sync.Once
+	closeInbound := func() {
+		inboundCloseOnce.Do(func() {
+			if err := request.Body.Close(); err != nil {
+				t.Errorf("owned inbound body close: %v", err)
+			}
+		})
+	}
+	t.Cleanup(closeInbound)
 	recorder := httptest.NewRecorder()
 	handler.ServeHTTP(recorder, request)
+	// RoundTrip may close its request body asynchronously after returning.
+	if !requestTrailerWait(t, outboundClosed, "owned outbound transport body close") {
+		return
+	}
+	closeInbound()
 	var got observation
 	select {
 	case got = <-observed:
@@ -592,8 +627,8 @@ func requestTrailerHTTPSExchange(t *testing.T, constructor string, protocol int)
 	} else if got.trailer.Get("Forwarded") != "host=fictional.example" {
 		t.Error("the opt-in trailer forwarding policy affected the default constructor")
 	}
-	if requests.Load() != 1 || unexpected.Load() != 0 || verified.Load() != 1 || badDials.Load() != 0 || bodyCloses.Load() == 0 {
-		t.Errorf("owned lifecycle controls: requests=%d unexpected=%d verified=%d badDials=%d bodyCloses=%d", requests.Load(), unexpected.Load(), verified.Load(), badDials.Load(), bodyCloses.Load())
+	if requests.Load() != 1 || unexpected.Load() != 0 || verified.Load() != 1 || badDials.Load() != 0 || outboundCloses.Load() == 0 || inboundCloses.Load() == 0 {
+		t.Errorf("owned lifecycle controls: requests=%d unexpected=%d verified=%d badDials=%d outboundCloses=%d inboundCloses=%d", requests.Load(), unexpected.Load(), verified.Load(), badDials.Load(), outboundCloses.Load(), inboundCloses.Load())
 	}
 	if !reflect.DeepEqual(request.Header, beforeHeader) || !reflect.DeepEqual(initial, beforeInitial) ||
 		request.ContentLength != int64(len(payload)) || request.Trailer.Get("Authorization") != "fictional-trailer" || request.Trailer.Get("X-Hop") != "fictional-hop" {

diff --git a/scripts/stealth-pilot-config.py b/scripts/stealth-pilot-config.py
@@ -172,9 +172,9 @@ def prepare(args: argparse.Namespace) -> None:
         "products": {
             "cover": {"variants": [{
                 "name": "quic-go-standard-h3-control",
-                "client_implementation": "quic-go v0.61.0 standard H3 control (not a browser)",
-                "server_implementation": "quic-go v0.61.0 HTTP/3 fixture",
-                "implementation_version": "v0.61.0-calibration-control",
+                "client_implementation": "quic-go v0.63.0 standard H3 control (not a browser)",
+                "server_implementation": "quic-go v0.63.0 HTTP/3 fixture",
+                "implementation_version": "v0.63.0-calibration-control",
                 "real_browser": False,
                 "runner_image": args.runner_image,
                 "server_container": args.control_container,