Merge 0a71eab38f7f1c0ef05380812d4bf51625459973 into 5f4f9643258dc2a65e684b63f12c8d543c936c67

Bumps the actions group with 2 updates in the / directory: [codecov/codecov-action](https://github.com/codecov/codecov-action) and [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action).


Updates `codecov/codecov-action` from 5 to 6
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codecov/codecov-action/compare/v5...v6)

Updates `aquasecurity/trivy-action` from 0.35.0 to 0.36.0
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](https://github.com/aquasecurity/trivy-action/compare/0.35.0...v0.36.0)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: aquasecurity/trivy-action
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/gin.yml

@@ -78,6 +78,6 @@ jobs:
         run: make test
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v6
         with:
           flags: ${{ matrix.os }},go-${{ matrix.go }},${{ matrix.test-tags }}

.github/workflows/trivy-scan.yml

@@ -27,7 +27,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run Trivy vulnerability scanner (source code)
-        uses: aquasecurity/trivy-action@0.35.0
+        uses: aquasecurity/trivy-action@v0.36.0
         with:
           scan-type: "fs"
           scan-ref: "."
@@ -44,7 +44,7 @@ jobs:
           sarif_file: "trivy-results.sarif"
 
       - name: Run Trivy scanner (table output for logs)
-        uses: aquasecurity/trivy-action@0.35.0
+        uses: aquasecurity/trivy-action@v0.36.0
         if: always()
         with:
           scan-type: "fs"

gin.go

@@ -169,6 +169,11 @@ type Engine struct {
 	// UseH2C enable h2c support.
 	UseH2C bool
 
+	// H2CConfig optionally specifies the http2.Server configuration used for h2c connections.
+	// If nil, a default &http2.Server{} is used. Set this to configure options such as
+	// MaxConcurrentStreams, IdleTimeout, etc.
+	H2CConfig *http2.Server
+
 	// ContextWithFallback enable fallback Context.Deadline(), Context.Done(), Context.Err() and Context.Value() when Context.Request.Context() is not nil.
 	ContextWithFallback bool
 
@@ -246,6 +251,9 @@ func (engine *Engine) Handler() http.Handler {
 	}
 
 	h2s := &http2.Server{}
+	if engine.H2CConfig != nil {
+		h2s = engine.H2CConfig
+	}
 	return h2c.NewHandler(engine, h2s)
 }
 

gin_test.go

@@ -120,6 +120,55 @@ func TestH2c(t *testing.T) {
 	assert.Equal(t, "<h1>Hello world</h1>", string(resp))
 }
 
+func TestH2CHandlerDefaultConfig(t *testing.T) {
+	r := Default()
+	r.UseH2C = true
+	handler := r.Handler()
+	// When UseH2C is true and H2CConfig is nil, Handler() should return an h2c handler (not the engine itself).
+	assert.NotEqual(t, r, handler)
+}
+
+func TestH2CHandlerWithCustomConfig(t *testing.T) {
+	ln, err := net.Listen("tcp", localhostIP+":0")
+	if err != nil {
+		t.Error(err)
+	}
+	r := Default()
+	r.UseH2C = true
+	r.H2CConfig = &http2.Server{
+		IdleTimeout: 60 * time.Second,
+	}
+	r.GET("/", func(c *Context) {
+		c.String(200, "<h1>Hello world</h1>")
+	})
+	go func() {
+		err := http.Serve(ln, r.Handler())
+		if err != nil {
+			t.Log(err)
+		}
+	}()
+	defer ln.Close()
+
+	url := "http://" + ln.Addr().String() + "/"
+
+	httpClient := http.Client{
+		Transport: &http2.Transport{
+			AllowHTTP: true,
+			DialTLS: func(netw, addr string, cfg *tls.Config) (net.Conn, error) {
+				return net.Dial(netw, addr)
+			},
+		},
+	}
+
+	res, err := httpClient.Get(url)
+	if err != nil {
+		t.Error(err)
+	}
+
+	resp, _ := io.ReadAll(res.Body)
+	assert.Equal(t, "<h1>Hello world</h1>", string(resp))
+}
+
 func TestLoadHTMLGlobTestMode(t *testing.T) {
 	ts := setupHTMLFiles(
 		t,