[dependabot]

Bumps the go-modules group with 4 updates: github.com/Eyevinn/mp4ff, github.com/quic-go/quic-go, golang.org/x/sync and golang.org/x/sys.

Updates github.com/Eyevinn/mp4ff from 0.61.0 to 0.62.0

Release notes

Sourced from github.com/Eyevinn/mp4ff's releases.

v0.62.0

Highlights

• QuickTime: timecode tracks, chapter and text tracks, ProRes, PCM and other sound sample entries, audio channel layouts, metadata keys and freeform items decode.
• Box trees: the new boxtree package, and mp4ff-info -tree and -json, show the box tree with positions and keep going after errors.
• AAC: AAC Main, program config elements, SBR and PS sync extensions, and USAC (xHE-AAC) configs.
• Hostile files: decoders return errors instead of hanging, panicking or allocating memory for sizes the data doesn't hold. Boxes nested more than 64 levels deep give mp4.ErrBoxTooDeep.
• Faster decoding: DecodeFile and the other io.Reader decoders take about half the time and memory on the test files.
• Annex B: start codes and zero bytes at the end of NAL units are no longer included in them.

Breaking changes

• avc.SPS.OffsetForNonRefPic, OffsetForTopToBottomField and RefFramesInPicOrderCntCycle are signed (int).
• aac.ADTSHeader.Frequency returns int instead of uint16.

Added

• UserDataTextBox: QuickTime user data text atoms, whose types start with ©, such as ©nam and ©swr in udta, decode with their texts and language codes
• QuickTime wide atoms decode as a FreeBox, and NewWideBox makes one
• The QuickTime sound sample entries in24, in32, fl32, fl64, ulaw, alaw, ima4, MAC3, MAC6, QDM2, QDMC and agsm decode as AudioSampleEntryBox, with the PCM ones in StsdBox.QtPcm
• ChanBox for the QuickTime audio channel layout atom chan, also in the new AudioSampleEntryBox.Chan
• KeysBox for the QuickTime metadata keys atom keys, also in the new MetaBox.Keys, with KeyOfItem to find the key of an item in ilst
• TrackApertureDimensionsBox for the QuickTime track aperture atoms clef, prof and enof, in a tapt atom that decodes as a GenericContainerBox
• GminBox, TcmiBox and TimecodeSampleEntryBox for the QuickTime atoms gmin, tcmi and tmcd of timecode tracks, with the timecode sample entry also in the new StsdBox.Tmcd; gmhd decodes as a GenericContainerBox
• AlisBox for the QuickTime alias data reference alis in dref
• The Apple ProRes sample entries apch, apcn, apcs, apco, ap4h and ap4x decode as VisualSampleEntryBox, also in the new StsdBox.ProRes
• MeanBox and NameBox for the mean and name atoms of freeform items ---- in ilst, such as iTunSMPB; a QuickTime name atom in udta decodes as a NameBox, and one in a timecode sample entry as a UserDataTextBox
• TextSampleEntryBox with FtabBox for 3GPP timed text tx3g and the chapter tracks that use it, and QuickTimeTextSampleEntryBox for QuickTime text, in the new StsdBox.Tx3g and StsdBox.QtText
• ChplBox for the Nero chapter list chpl in udta, which Nero, ffmpeg and GPAC write
• DataBox.Meaning tells what a metadata value means, such as track 2 of 21 for trkn, an integer, or the gapless playback information of iTunSMPB
• boxtree package that decodes the box tree of a file with box positions, and keeps going after errors, reporting them for the smallest box that fails
• mp4ff-info -tree and -json print the box tree with box positions and errors, as text or JSON, and files that cannot be decoded completely get that tree instead of a partial box list
• StsdBox, DrefBox, VisualSampleEntryBox, AudioSampleEntryBox, StppBox, WvttBox, TrepBox and EvteBox implement ContainerBox
• StblBox.GetContainingChunks returns the chunks of a sample interval, checked against the chunk offsets
• avc.SPS.PicWidthInMbsMinus1 and PicHeightInMapUnitsMinus1 hold the picture size in macroblocks and map units
• aac.AudioSpecificConfig decodes and encodes AAC Main, 960-sample frames, core coder delays, program config elements (aac.ProgramConfigElement) and SBR and PS sync extensions; TrakBox.SetAACDescriptorFromConfig uses one
• aac.DecodeAudioSpecificConfig and AudioSpecificConfig.Encode support USAC (xHE-AAC), object type aac.USAC,

... (truncated)

Changelog

Sourced from github.com/Eyevinn/mp4ff's changelog.

[0.62.0] - 2026-11-04

Added

• UserDataTextBox: QuickTime user data text atoms, whose types start with ©, such as ©nam and ©swr in udta, decode with their texts and language codes
• QuickTime wide atoms decode as a FreeBox, and NewWideBox makes one
• The QuickTime sound sample entries in24, in32, fl32, fl64, ulaw, alaw, ima4, MAC3, MAC6, QDM2, QDMC and agsm decode as AudioSampleEntryBox, with the PCM ones in StsdBox.QtPcm
• ChanBox for the QuickTime audio channel layout atom chan, also in the new AudioSampleEntryBox.Chan
• KeysBox for the QuickTime metadata keys atom keys, also in the new MetaBox.Keys, with KeyOfItem to find the key of an item in ilst
• TrackApertureDimensionsBox for the QuickTime track aperture atoms clef, prof and enof, in a tapt atom that decodes as a GenericContainerBox
• GminBox, TcmiBox and TimecodeSampleEntryBox for the QuickTime atoms gmin, tcmi and tmcd of timecode tracks, with the timecode sample entry also in the new StsdBox.Tmcd; gmhd decodes as a GenericContainerBox
• AlisBox for the QuickTime alias data reference alis in dref
• The Apple ProRes sample entries apch, apcn, apcs, apco, ap4h and ap4x decode as VisualSampleEntryBox, also in the new StsdBox.ProRes
• MeanBox and NameBox for the mean and name atoms of freeform items ---- in ilst, such as iTunSMPB; a QuickTime name atom in udta decodes as a NameBox, and one in a timecode sample entry as a UserDataTextBox
• TextSampleEntryBox with FtabBox for 3GPP timed text tx3g and the chapter tracks that use it, and QuickTimeTextSampleEntryBox for QuickTime text, in the new StsdBox.Tx3g and StsdBox.QtText
• ChplBox for the Nero chapter list chpl in udta, which Nero, ffmpeg and GPAC write
• DataBox.Meaning tells what a metadata value means, such as track 2 of 21 for trkn, an integer, or the gapless playback information of iTunSMPB
• boxtree package that decodes the box tree of a file with box positions, and keeps going after errors, reporting them for the smallest box that fails
• mp4ff-info -tree and -json print the box tree with box positions and errors, as text or JSON, and files that cannot be decoded completely get that tree instead of a partial box list
• StsdBox, DrefBox, VisualSampleEntryBox, AudioSampleEntryBox, StppBox, WvttBox, TrepBox and EvteBox implement ContainerBox
• StblBox.GetContainingChunks returns the chunks of a sample interval, checked against the chunk offsets
• avc.SPS.PicWidthInMbsMinus1 and PicHeightInMapUnitsMinus1 hold the picture size in macroblocks and map units
• aac.AudioSpecificConfig decodes and encodes AAC Main, 960-sample frames, core coder delays, program config elements (aac.ProgramConfigElement) and SBR and PS sync extensions; TrakBox.SetAACDescriptorFromConfig uses one
• aac.DecodeAudioSpecificConfig and AudioSpecificConfig.Encode support USAC (xHE-AAC), object type aac.USAC, with the UsacConfig kept unchanged in aac.USACConfig and its sampling frequency, frame lengths and channels decoded
• bits.FixedSliceReader.Depth and SetDepth, which hold the box nesting depth that mp4 counts while decoding

Changed

• DataBox.Info adds what the value means, using the item type and freeform name that IlstBox gives its data boxes, and writes images as their kind and size, with their bytes in hex at info level 1
• VisualSampleEntryBox.Info and AudioSampleEntryBox.Info print the QuickTime vendor as its four characters, such as appl (0x6170706c), and VisualSampleEntryBox.Info names the quality levels, such as 0x200 (normal)
• TrefBox decodes every child as a TrefTypeBox, including reference types that mp4ff does not register, such as the QuickTime tmcd and chap
• IlstBox decodes items whose type mp4ff does not know, such as trkn, covr and the key indices of QuickTime metadata, as GenericContainerBox with their data boxes, instead of as UnknownBox

... (truncated)

Commits

• 19c75f0 chore: prepare v0.62.0 release
• 0558cfb fix(avc): drop the zero bytes after NAL units in ConvertByteStreamToNaluSample
• 56f8b92 fix(avc,hevc): leave a start code that ends a byte stream out of the last NAL...
• 6d5f796 fix(aac)!: return the ADTS sampling frequency as int
• 2608b20 perf(mp4): read box payloads of up to 1 MiB into one buffer of their size
• ac2d403 fix(mp4): limit box nesting to 64 levels
• 6f2cdd6 fix(mp4): decode nested QuickTime atoms and audio sample entries once
• 4131c60 docs: an SVG logo with the Go gopher, and a social preview image
• 6d9e196 fix(mp4ff-mvhevc): print the usage for -h and add a package doc comment
• 87fe568 fix(cmd): name the unsupported codec in mp4ff-pslister and mp4ff-nallister er...
• Additional commits viewable in compare view

Updates github.com/quic-go/quic-go from 0.64.1 to 0.65.0

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.65.0

This release updates qlog to the latest IETF drafts, adds explicit stream credit release, and fixes a number of HTTP/3 and connection migration bugs.

• With Config.RequireStreamCreditRelease, completed streams count towards the incoming stream limit until the application calls ReleaseStreamCredit: #5981, #5982
• qlog: events now follow draft-ietf-quic-qlog-quic-events-14 and draft-ietf-quic-qlog-h3-events-14: #6120

Breaking Changes

• http3: HTTPStreamer.HTTPStream now returns (*Stream, error), and no longer sends an implicit 200 response: #5988, #5994

Notable Fixes

• QUIC v2 key updates now use the correct quicv2 ku label: #5973
• Connections using zero-length connection IDs no longer stop receiving packets after version negotiation: #6129
• Switching paths now uses a new connection ID, fixing servers that kept sending to the old address after repeated NAT rebindings: #6015
• Clients now send PATH_RESPONSE on the path the PATH_CHALLENGE was received on: #5980
• Path.Probe now succeeds on an already validated path: #6019
• Reordered and retransmitted NEW_CONNECTION_ID frames are now handled correctly: #6009, #6007
• DATAGRAM frames no longer starve ACKs, control frames and retransmissions: #5970
• CancelRead now unblocks Read and Peek after receiving RESET_STREAM_AT: #6022
• TryWriteAll no longer copies queued data quadratically: #6042, #6043
• http3: canceling the first request to a host no longer cancels the shared dial: #6132
• http3: bodies shorter than the announced Content-Length now fail with io.ErrUnexpectedEOF: #5913
• http3: Content-Length is no longer added to 204 and 304 responses, and is now sent for requests with http.NoBody: #6032, #6029
• http3: response writes that fail partway (e.g. on a write deadline) no longer corrupt the stream: #5993, #6002, #6001, #6003
• http3: canceling an Extended CONNECT request now interrupts waiting for SETTINGS: #6020
• qlog fixes:
  • incorrect or missing values for transport parameters, packet numbers, congestion metrics, timers, connection IDs and lengths: #6050, #6054, #6059, #6060, #6074, #6077, #6091, #6023, #5969
  • stateless resets are logged as remote closures: #6063
  • concurrently recorded events are written in order: #5956
  • traces of connections abandoned after version negotiation are closed: #6130
  • http3: traces no longer close before all events are recorded: #6090, #6083, #6041

Notable Changes

• Multiple DATAGRAM frames are now packed into a single packet: #5961, #5960
• qlog: new connection_state_updated and HTTP/3 stream_type_set events, and tuples for path probing and migration: #6111, #6113, #5977, #5979
• qlog: qlog.RedactIPs redacts IP addresses and ports: #5943
• qlog: HTTP/3 connections now use qlog.DefaultConnectionTracer; http3/qlog.DefaultConnectionTracer is removed: #5966
• Reduced allocations during the handshake: #6096, #6093, #6098, #6097, #6095

Changelog

• ci: bump CodSpeedHQ/action from 5.4.0 to 5.5.0 by @​dependabot[bot] in quic-go/quic-go#5945
• qlogwriter: fix ordering of concurrently recorded events by @​marten-seemann in quic-go/quic-go#5956
• omit the length field of the last DATAGRAM frame in a packet by @​marten-seemann in quic-go/quic-go#5960
• remove obsolete curve ID helpers from handshake tests by @​marten-seemann in quic-go/quic-go#5968
• handshake: remove obsolete session ticket error workaround by @​marten-seemann in quic-go/quic-go#5967
• pack multiple DATAGRAM frames into a packet by @​marten-seemann in quic-go/quic-go#5961
• qlog: register event schemas on init, remove Trace.SupportsSchemas by @​marten-seemann in quic-go/quic-go#5966

... (truncated)

Commits

• aa265c3 http3: don't cancel a shared dial when the first request is canceled (#6132)
• 7c2906f qlog: close the trace of a connection abandoned after version negotiation (#6...
• faa3b83 remove the old connection immediately after version negotiation (#6129)
• 946bda4 ci: use a daily Go build cache for unit and integration tests (#6124)
• 99d6d1e qlog: map packet drop reasons to packet_dropped triggers (#6055)
• 91d541c ci: delete outdated cross-compilation build caches (#6122)
• 3ee97eb README: list tools supporting quic-go (#6123)
• 3316624 ci: run benchmarks for a fixed number of iterations (#6121)
• 220eda8 ci: cancel outdated PR runs (#6118)
• 0bf3ea5 qlog: update event schema URIs to quic-events-14 and h3-events-14 (#6120)
• Additional commits viewable in compare view

Updates golang.org/x/sync from 0.24.0 to 0.25.0

Commits

• 1f920df syncmap: rename DeepCopyMap to CopyMap
• See full diff in compare view

Updates golang.org/x/sys from 0.48.0 to 0.50.0

Commits

• 00227f1 unix: avoid using stale written count from sendfile on freebsd/386 after EINVAL
• aa1b965 unix: don't skip directory entries with zero inodes on Linux
• 37845fb unix: reject a short SCM_CREDENTIALS payload in ParseUnixCredentials
• 313c631 unix: add IoctlGetUint64
• 4a36a34 cpu: add wasm32 "architecture"
• 908ab59 windows: use SyscallN consistently for Windows system calls
• f5cb030 unix: set R12 before the ppc64x syscall branch
• 0e9e10f windows: remove MemoryBasicInformation.PartitionId field on windows/386
• 9b24ac0 windows: fix PSAPI_WORKING_SET_EX_BLOCK bit accessors
• 69a6691 windows/mkwinsyscall: read 32-bit results from the low half of the return reg...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions