fix: update dependabot vulnerabilities (#505)

* docs: add dependabot remediation design

* docs: add dependabot remediation plan

* fix: update backend pgx dependency

* fix: update frontend vulnerable dependencies

* fix: update gost quic dependencies

* fix: migrate gost dtls dependency

* fix: sync gost main dependencies

* fix: enable webtransport stream reset partial delivery

* fix: restore backend bcrypt dependency

go-gost/x/dialer/dtls/dialer.go

@@ -10,7 +10,8 @@ import (
 	md "github.com/go-gost/core/metadata"
 	xdtls "github.com/go-gost/x/internal/util/dtls"
 	"github.com/go-gost/x/registry"
-	"github.com/pion/dtls/v2"
+	"github.com/pion/dtls/v3"
+	dtlsnet "github.com/pion/dtls/v3/pkg/net"
 )
 
 func init() {
@@ -66,9 +67,13 @@ func (d *dtlsDialer) Dial(ctx context.Context, addr string, opts ...dialer.DialO
 		MTU:                  d.md.mtu,
 	}
 
-	c, err := dtls.ClientWithContext(ctx, conn, &config)
+	c, err := dtls.Client(dtlsnet.PacketConnFromConn(conn), conn.RemoteAddr(), &config)
 	if err != nil {
 		return nil, err
 	}
+	if err := c.HandshakeContext(ctx); err != nil {
+		_ = c.Close()
+		return nil, err
+	}
 	return xdtls.Conn(c, d.md.bufferSize), nil
 }

go-gost/x/dialer/http3/dialer.go

@@ -72,7 +72,7 @@ func (d *http3Dialer) Dial(ctx context.Context, addr string, opts ...dialer.Dial
 				// Timeout:   60 * time.Second,
 				Transport: &http3.Transport{
 					TLSClientConfig: d.options.TLSConfig,
-					Dial: func(ctx context.Context, adr string, tlsCfg *tls.Config, cfg *quic.Config) (quic.EarlyConnection, error) {
+					Dial: func(ctx context.Context, adr string, tlsCfg *tls.Config, cfg *quic.Config) (*quic.Conn, error) {
 						// d.options.Logger.Infof("dial: %s/%s, %s", addr, network, host)
 						udpAddr, err := net.ResolveUDPAddr("udp", addr)
 						if err != nil {

go-gost/x/dialer/http3/wt/dialer.go

@@ -74,7 +74,7 @@ func (d *wtDialer) Dial(ctx context.Context, addr string, opts ...dialer.DialOpt
 			header: d.md.header,
 			dialer: &wt.Dialer{
 				TLSClientConfig: d.options.TLSConfig,
-				DialAddr: func(ctx context.Context, adr string, tlsCfg *tls.Config, cfg *quic.Config) (quic.EarlyConnection, error) {
+				DialAddr: func(ctx context.Context, adr string, tlsCfg *tls.Config, cfg *quic.Config) (*quic.Conn, error) {
 					// d.options.Logger.Infof("dial: %s, %s, %s", addr, adr, host)
 					udpAddr, err := net.ResolveUDPAddr("udp", addr)
 					if err != nil {
@@ -97,8 +97,9 @@ func (d *wtDialer) Dial(ctx context.Context, addr string, opts ...dialer.DialOpt
 							quic.Version1,
 						},
 					*/
-					MaxIncomingStreams: int64(d.md.maxStreams),
-					EnableDatagrams:    true,
+					MaxIncomingStreams:               int64(d.md.maxStreams),
+					EnableDatagrams:                  true,
+					EnableStreamResetPartialDelivery: true,
 				},
 			},
 		}

go-gost/x/dialer/icmp/conn.go

@@ -8,7 +8,7 @@ import (
 )
 
 type quicSession struct {
-	session quic.EarlyConnection
+	session *quic.Conn
 }
 
 func (session *quicSession) GetConn() (*quicConn, error) {
@@ -28,7 +28,7 @@ func (session *quicSession) Close() error {
 }
 
 type quicConn struct {
-	quic.Stream
+	*quic.Stream
 	laddr net.Addr
 	raddr net.Addr
 }

go-gost/x/dialer/quic/conn.go

@@ -8,7 +8,7 @@ import (
 )
 
 type quicSession struct {
-	session quic.EarlyConnection
+	session *quic.Conn
 }
 
 func (session *quicSession) GetConn() (*quicConn, error) {
@@ -28,7 +28,7 @@ func (session *quicSession) Close() error {
 }
 
 type quicConn struct {
-	quic.Stream
+	*quic.Stream
 	laddr net.Addr
 	raddr net.Addr
 }