[dependabot]

Bumps the go-modules group with 2 updates in the / directory: github.com/Eyevinn/mp4ff and github.com/quic-go/quic-go.

Updates github.com/Eyevinn/mp4ff from 0.60.0 to 0.61.0

Release notes

Sourced from github.com/Eyevinn/mp4ff's releases.

v0.61.0

mp4ff v0.61.0 decodes Apple Lossless (ALAC) sample entries with their magic cookie, encrypts VP9 with cenc, and round-trips QuickTime .mov files much better: video sample entry fields, movie and track header fields, the mvhd matrix, udta terminators and the SliceWriter path for QuickTime metadata and mfra. Many decoding and encoding paths now return errors instead of panicking on files that lack boxes, and 32-bit architectures are supported and tested.

Breaking change: DataBox now keeps its type and locale, so a DataBox built for text must set DataType: mp4.DataTypeUTF8; without it, it is written with type 0.

Added

• alac (Apple Lossless) sample entries decode as AudioSampleEntryBox and StsdBox.Alac, with the magic cookie as AlacBox in AudioSampleEntryBox.Alac, or in WaveBox.Alac for QuickTime files
• InitProtect and ExtractInitProtectData support VP9 (vp09) with scheme cenc, and GetVP9ProtectRanges gives the subsample protection ranges of a VP9 sample

Changed

• DecModeLazyMdat also skips the payload of free and skip boxes; FreeBox.Payload is then nil and FreeBox.Encode writes zeros of the original payload size
• DataBox keeps its type and locale in the new DataType, Country and Language fields instead of always writing type 1 (UTF-8) and locale 0, so a DataBox with text needs DataType: DataTypeUTF8

Fixed

• ExtractInitProtectData accepts avc3 and hev1 sample entries, as InitProtect already does
• DecodeFile with DecModeLazyMdat returns an error for an mdat size above math.MaxInt64 instead of looping
• SgpdBox decodes entries with descriptionLength 0, such as tsas, and checks that every entry is exactly descriptionLength bytes
• On 32-bit architectures, hevc.ParseSPSNALUnit and hevc.ParseVPSNALUnit read the 48-bit constraint flags of the profile, tier and level, and the bits readers and writers handle up to 32 bits at any bit position
• On 32-bit architectures, File.CopySampleData copies chunks of 2 GiB or more, and sizes beyond the int range in mdat, stsc, BoxSeekReader.Seek, ivf.Reader.ReadFrame and the IAMF parser give errors instead of wrong data
• bits.EBSPWriter.WriteExpGolomb and bits.FixedSliceWriter.WriteExpGolomb write values up to 2^32-1 at any bit position
• bits.FixedSliceReader.SkipBytes and bits.EBSPReader.ReadBytes set an error for a negative or too large length instead of moving backwards or panicking
• hevc.DecodeHEVCDecConfRec, hevc.DecodeLHEVCDecConfRec and vvc.DecodeVVCDecConfRec stop at the end of the record, instead of adding or allocating an empty NAL unit for each one that the record announces but does not hold
• Decoding a traf without tfhd, with DecodeBox, DecodeBoxSR, DecodeFile or FragmentDecoder, returns an error instead of a TrafBox with a nil Tfhd
• MoovBox.IsEncrypted, MoovBox.GetSinf, DecodeFile, DecodeFileSR, FragmentDecoder and InitDecodeStream no longer panic on a track without the boxes down to its sample entry or stts, or on an empty saio or seig sgpd
• TrakBox.GetNrSamples, GetSampleData, GetRangesForSampleInterval and File.CopySampleData return 0 or an error instead of panicking or using chunk offset 0 when the track lacks a box of its sample table
• MoofBox.Encode, File.UpdateSidx, MediaSegment.Fragmentify, InitSegment.GetMediaType and the Fragment methods Encode, GetSampleInterval, GetSampleNrFromTime and AddSampleInterval handle missing boxes instead of panicking
• InitProtect, ExtractInitProtectData, DecryptInit, DecryptSegment, DecryptFragment and RemoveEncryption return an error instead of panicking when a box they need is missing, or ExtractInitProtectData gets a clear init
• mp4ff-crop, mp4ff-decrypt, mp4ff-mvhevc, mp4ff-nallister, mp4ff-pslister and mp4ff-subslister give an error, or skip the track, instead of panicking on a file without a box they need
• The segmenter example segments a video track without stss, in which every sample is a sync sample, and gives an error instead of panicking on a file without video track or without a box it needs
• hevc.ParseSPSNALUnit refuses a coding tree block outside 16x16..64x64 or a picture size that is not a multiple of

... (truncated)

Changelog

Sourced from github.com/Eyevinn/mp4ff's changelog.

[0.61.0] - 2026-10-27

Added

• alac (Apple Lossless) sample entries decode as AudioSampleEntryBox and StsdBox.Alac, with the magic cookie as AlacBox in AudioSampleEntryBox.Alac, or in WaveBox.Alac for QuickTime files
• InitProtect and ExtractInitProtectData support VP9 (vp09) with scheme cenc, and GetVP9ProtectRanges gives the subsample protection ranges of a VP9 sample

Changed

• DecModeLazyMdat also skips the payload of free and skip boxes; FreeBox.Payload is then nil and FreeBox.Encode writes zeros of the original payload size
• DataBox keeps its type and locale in the new DataType, Country and Language fields instead of always writing type 1 (UTF-8) and locale 0, so a DataBox with text needs DataType: DataTypeUTF8

Fixed

• ExtractInitProtectData accepts avc3 and hev1 sample entries, as InitProtect already does
• DecodeFile with DecModeLazyMdat returns an error for an mdat size above math.MaxInt64 instead of looping
• SgpdBox decodes entries with descriptionLength 0, such as tsas, and checks that every entry is exactly descriptionLength bytes
• On 32-bit architectures, hevc.ParseSPSNALUnit and hevc.ParseVPSNALUnit read the 48-bit constraint flags of the profile, tier and level, and the bits readers and writers handle up to 32 bits at any bit position
• On 32-bit architectures, File.CopySampleData copies chunks of 2 GiB or more, and sizes beyond the int range in mdat, stsc, BoxSeekReader.Seek, ivf.Reader.ReadFrame and the IAMF parser give errors instead of wrong data
• bits.EBSPWriter.WriteExpGolomb and bits.FixedSliceWriter.WriteExpGolomb write values up to 2^32-1 at any bit position
• bits.FixedSliceReader.SkipBytes and bits.EBSPReader.ReadBytes set an error for a negative or too large length instead of moving backwards or panicking
• hevc.DecodeHEVCDecConfRec, hevc.DecodeLHEVCDecConfRec and vvc.DecodeVVCDecConfRec stop at the end of the record, instead of adding or allocating an empty NAL unit for each one that the record announces but does not hold
• Decoding a traf without tfhd, with DecodeBox, DecodeBoxSR, DecodeFile or FragmentDecoder, returns an error instead of a TrafBox with a nil Tfhd
• MoovBox.IsEncrypted, MoovBox.GetSinf, DecodeFile, DecodeFileSR, FragmentDecoder and InitDecodeStream no longer panic on a track without the boxes down to its sample entry or stts, or on an empty saio or seig sgpd
• TrakBox.GetNrSamples, GetSampleData, GetRangesForSampleInterval and File.CopySampleData return 0 or an error instead of panicking or using chunk offset 0 when the track lacks a box of its sample table
• MoofBox.Encode, File.UpdateSidx, MediaSegment.Fragmentify, InitSegment.GetMediaType and the Fragment methods Encode, GetSampleInterval, GetSampleNrFromTime and AddSampleInterval handle missing boxes instead of panicking
• InitProtect, ExtractInitProtectData, DecryptInit, DecryptSegment, DecryptFragment and RemoveEncryption return an error instead of panicking when a box they need is missing, or ExtractInitProtectData gets a clear init
• mp4ff-crop, mp4ff-decrypt, mp4ff-mvhevc, mp4ff-nallister, mp4ff-pslister and mp4ff-subslister give an error, or skip the track, instead of panicking on a file without a box they need
• The segmenter example segments a video track without stss, in which every sample is a sync sample, and gives an error instead of panicking on a file without video track or without a box it needs
• hevc.ParseSPSNALUnit refuses a coding tree block outside 16x16..64x64 or a picture size that is not a multiple of the minimum coding block, and hevc.ParseSliceHeader gives an error instead of dividing by zero on such an SPS
• cbcs encryption of AVC and HEVC in GetAVCProtectRanges, GetHEVCProtectRanges and FragmentEncryptor parses slice headers with the SPS and PPS that the samples carry, not only with those of the decoder configuration record

... (truncated)

Commits

• 411fcab chore: prepare v0.61.0 release
• 643457d fix(mp4): keep the mvhd matrix and QuickTime values of mvhd, mdhd and tkhd
• be31d23 fix(mp4): decode udta boxes that end with the QuickTime user data terminator
• 39407f0 fix(mp4): write the mfra box of fragmented files in File.EncodeSW
• 829c36e fix(mp4): keep the QuickTime fields, depth and color table ID of visual sampl...
• 3adc32f fix(mp4): encode a QuickTime meta box without version and flags in EncodeSW
• 06e6d8f fix(mp4)!: keep the type and locale of data boxes
• 359c1dc refactor(mp4): move DataBox to data.go
• 28c8981 docs(mp4ff-encrypt): list AV1 and VP9 in doc.go
• f9d4606 docs(mp4ff-encrypt): list VP9 in usage text
• Additional commits viewable in compare view

Updates github.com/quic-go/quic-go from 0.64.0 to 0.64.1

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.64.1

This patch release fixes datagram receive cancellation and stream reset handling.

Notable Fixes

• Conn.ReceiveDatagram now fails immediately if the context is already canceled: #5947
• http3: Stream.ReceiveDatagram and RequestStream.ReceiveDatagram now fail immediately if the context is already canceled: #5948
• Stream reset handling now ignores reliable boundary updates after cancellation: #5950

Changelog

• ignore reliable boundary updates after stream cancellation by @​marten-seemann in quic-go/quic-go#5950
• fail Conn.ReceiveDatagram if the context is already canceled by @​marten-seemann in quic-go/quic-go#5947
• http3: fail Stream.ReceiveDatagram if the context is already canceled by @​marten-seemann in quic-go/quic-go#5948

Full Changelog: quic-go/quic-go@v0.64.0...v0.64.1

Commits

• ed90516 http3: fail Stream.ReceiveDatagram if the context is already canceled (#5948)
• 1170056 fail Conn.ReceiveDatagram if the context is already canceled (#5947)
• 5a5e6b7 ignore reliable boundary updates after stream cancellation (#5950)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions