P4suta · Oct 23, 2026 · Oct 22, 2026 · Oct 23, 2026
@@ -9,5 +9,5 @@
 test/fixtures/** -text
 packages/http3/test/fixtures/** -text
 packages/quic_core/test/fixtures/** -text
-packages/http3/test/interop/requirements.lock -text
+packages/http3/test/interop/requirements.txt -text
 packages/http3/test/interop/quicgo/go.sum -text
@@ -26,7 +26,7 @@ jobs:
           persist-credentials: false
 
       - name: Install pinned tools
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
         with:
           version: 2026.8.10
 
@@ -52,7 +52,7 @@ jobs:
           persist-credentials: false
 
       - name: Install pinned tools
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
         with:
           version: 2026.8.10
 
@@ -75,7 +75,7 @@ jobs:
           persist-credentials: false
 
       - name: Install pinned tools
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
         with:
           version: 2026.8.10
 

@@ -35,7 +35,7 @@ jobs:
           persist-credentials: false
 
       - name: Install pinned tools
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
         with:
           version: 2026.8.10
 
@@ -80,7 +80,7 @@ jobs:
           persist-credentials: false
 
       - name: Install pinned tools
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
         with:
           version: 2026.8.10
 
@@ -110,7 +110,7 @@ jobs:
           persist-credentials: false
 
       - name: Install pinned tools
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
         with:
           version: 2026.8.10
 
@@ -151,7 +151,7 @@ jobs:
           persist-credentials: false
 
       - name: Install pinned tools
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
         with:
           version: 2026.8.10
 
@@ -209,7 +209,7 @@ jobs:
           persist-credentials: false
 
       - name: Install pinned tools
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
         with:
           version: 2026.8.10
 
@@ -242,7 +242,7 @@ jobs:
           persist-credentials: false
 
       - name: Install pinned tools
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
         with:
           version: 2026.8.10
 
@@ -275,7 +275,7 @@ jobs:
           persist-credentials: false
 
       - name: Install pinned tools
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
         with:
           version: 2026.8.10
 
@@ -311,7 +311,7 @@ jobs:
           persist-credentials: false
 
       - name: Install pinned tools
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
         with:
           version: 2026.8.10
 
@@ -343,7 +343,7 @@ jobs:
           persist-credentials: false
 
       - name: Install pinned tools
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
         with:
           version: 2026.8.10
 
@@ -373,7 +373,7 @@ jobs:
           persist-credentials: false
 
       - name: Install pinned tools
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
         with:
           version: 2026.8.10
 
@@ -411,7 +411,7 @@ jobs:
           persist-credentials: false
 
       - name: Install pinned tools
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
         with:
           version: 2026.8.10
 

@@ -0,0 +1,6 @@
+[extend]
+useDefault = true
+
+[[allowlists]]
+description = "Installed interoperability peer packages"
+paths = ['''^packages/http3/build/interop-venv/''']
@@ -4,15 +4,15 @@ erlang = "29.0.5"
 elixir = "1.20.3"
 rebar = "3.27.0"
 actionlint = "1.7.12"
-go = "1.27.0"
+go = "1.27.3"
 python = "3.12.13"
 uv = "0.12.5"
 taplo = "0.10.0"
 typos = "1.49.0"
 markdownlint-cli2 = "0.22.1"
 shellcheck = "0.11.0"
 shfmt = "3.13.1"
-"pipx:reuse" = "6.2.0"
+"pipx:reuse" = { version = "6.2.0", extras = "charset-normalizer" }
 gitleaks = "8.30.1"
 osv-scanner = "2.5.1"
 semgrep = "1.174.0"
@@ -224,13 +224,13 @@ run = [
   # Addressing the environment by directory rather than by interpreter path
   # keeps this working where `uv venv` lays the interpreter out differently;
   # Windows puts it in Scripts/python.exe rather than bin/python.
-  "uv pip sync --python build/interop-venv --require-hashes --strict test/interop/requirements.lock",
+  "uv pip sync --python build/interop-venv --require-hashes --strict test/interop/requirements.txt",
 ]
 
 [tasks.interop-lock]
 description = "Regenerate the hash-locked aioquic peer dependency set"
-dir = "{{ config_root }}/packages/http3"
-run = "uv pip compile test/interop/requirements.txt --output-file test/interop/requirements.lock --generate-hashes --universal --python-version 3.12 --exclude-newer 2026-08-24 --custom-compile-command 'mise run interop-lock'"
+dir = "{{ config_root }}/packages/http3/test/interop"
+run = "uv pip compile requirements.in --output-file=requirements.txt --generate-hashes --universal --python-version=3.12"
 
 [tasks.interop-aioquic]
 description = "Run bidirectional advanced aioquic interoperability"

@@ -15,6 +15,7 @@ path = [
   "*.md",
   "coverage-*.json",
   "qualification.json",
+  "renovate.json",
   "*.toml",
   "mix.lock",
   "LICENSE",

@@ -63,9 +63,10 @@ then falls back to `python3`.
 
 ## Updating a peer
 
-The direct aioquic intent is pinned in `requirements.txt`; every transitive
-version and distribution hash is retained in `requirements.lock`. Regenerate
-the lock deliberately with:
+The direct Python dependencies are pinned in `requirements.in`.
+The generated `requirements.txt` holds every transitive version and distribution hash.
+Renovate maintains this lock through its pip-compile manager.
+Regenerate it with:
 
 ```sh
 mise run interop-lock

@@ -156,7 +156,7 @@ def generate(path: Path) -> None:
 
     require(blocked_cases >= 2, "oracle corpus lost blocked-stream coverage")
     require(dynamic_steps >= 2, "oracle corpus lost dynamic-table coverage")
-    lock = repository_root() / "packages/http3/test/interop/requirements.lock"
+    lock = repository_root() / "packages/http3/test/interop/requirements.txt"
     write_json(
         path,
         {
@@ -165,7 +165,7 @@ def generate(path: Path) -> None:
             "oracle": {
                 "name": "pylsqpack",
                 "version": pylsqpack.__version__,
-                "requirements_lock": "packages/http3/test/interop/requirements.lock",
+                "requirements_lock": "packages/http3/test/interop/requirements.txt",
                 "requirements_lock_sha256": sha256(lock),
             },
             "configuration": {

@@ -6,8 +6,8 @@ require github.com/quic-go/quic-go v0.61.0
 
 require (
 	github.com/quic-go/qpack v0.6.0 // indirect
-	golang.org/x/crypto v0.56.0 // indirect
-	golang.org/x/net v0.57.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/crypto v0.57.0 // indirect
+	golang.org/x/net v0.60.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
 )
@@ -12,13 +12,13 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
 go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
-golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
-golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
@@ -0,0 +1,2 @@
+aioquic==1.3.0
+certifi==2026.10.19