chore(deps): bump quinn-proto from 0.11.14 to 0.11.18

[dependabot]

Bumps quinn-proto from 0.11.14 to 0.11.18.

Release notes

Sourced from quinn-proto's releases.

quinn-proto 0.11.18, quinn 0.11.12

Three more security issues were reported and fixed since 0.11.17:

• GHSA-465w-v9q3-7j98: a remote peer can panic unordered reads from quinn-proto with five small STREAM frames
• https://github.com/quinn-rs/quinn/security/advisories/GHSA-ppcp-v39w-8jq2: Datagrams::send() double-subtracts payload_bytes on the drop-oldest path, panicking the sender
• https://github.com/quinn-rs/quinn/security/advisories/GHSA-3g6h-r5qx-f6hq: Peer minimum ACK delay can panic when ACK_FREQUENCY transmission is enabled

What's Changed

• 0.11.x: backport the black hole detector fixes by @​vcarus in quinn-rs/quinn#2799
• 0.11.x: fix payload_bytes double subtraction when evicting outgoing datagrams by @​vcarus in quinn-rs/quinn#2806
• 0.11.x: Backport #2816 (add min rtt to path stats) by @​somtochiama in quinn-rs/quinn#2817
• 0.11.x: Bundle ACK in packets with DATAGRAM or STREAM frames by @​anatawa12 in quinn-rs/quinn#2819
• quinn-proto: drop short packets with unsupported versions (0.11.x) by @​vcarus in quinn-rs/quinn#2823
• 0.11.x: backport: Avoid re-instantiating debug span in ConnectionDriver::poll by @​stormshield-fabs in quinn-rs/quinn#2829
• 0.11.x: backport #2814 (proto: coalesce contiguous chunks during defragment) by @​Ralith in quinn-rs/quinn#2826
• [0.11.x] proto: release the send window when rejecting 0-RTT by @​zerox80 in quinn-rs/quinn#2843
• [0.11.x] Reject DATAGRAMs larger than the send buffer by @​zerox80 in quinn-rs/quinn#2844
• 0.11.x: backport #2847 (proto: send DATA_BLOCKED and STREAM_DATA_BLOCKED when blocked by flow control) by @​heitzlki in quinn-rs/quinn#2852
• [0.11.x] proto: reset pacing state when resetting a path by @​zerox80 in quinn-rs/quinn#2850
• [0.11.x] proto: avoid duplicate flow-control credit for stopped streams by @​zerox80 in quinn-rs/quinn#2848
• [0.11.x] proto: prune queued DATAGRAMs after path MTU changes by @​zerox80 in quinn-rs/quinn#2849
• [0.11.x] proto: preserve the server config for pending incoming connections by @​zerox80 in quinn-rs/quinn#2865
• [0.11.x] proto: reject transport parameters with a mismatched length by @​MaxFreedomPollard in quinn-rs/quinn#2866
• [0.11.x] quinn: enforce read_to_end limits for reordered chunks by @​zerox80 in quinn-rs/quinn#2864
• [0.11.x] streams: bound retained send storage by the send window by @​zerox80 in quinn-rs/quinn#2863
• Prepare 0.11.18 by @​djc in quinn-rs/quinn#2867

quinn-proto 0.11.17

This release fixes three remote memory exhaustion issues. See GHSA-qfwj-vfxf-92j2, GHSA-2hv7-gw8g-gpq5, and GHSA-hmxj-32vh-65vr for more details, and quinn-rs/quinn#2789 for the fixes.

What's Changed

• fix(ci): fix clippy lints by @​LesnyRumcajs in quinn-rs/quinn#2752
• congestion: saturate CUBIC window increment to avoid overflow by @​LesnyRumcajs in quinn-rs/quinn#2751
• 0.11.x: Backport memory use fixes and prepare release by @​Ralith in quinn-rs/quinn#2790

Full Changelog: quinn-rs/quinn@quinn-proto-0.11.16...quinn-proto-0.11.17

quinn-proto-0.11.16

What's Changed

• 0.11.x: upgrade dependencies by @​djc in quinn-rs/quinn#2707

quinn-proto 0.11.15, quinn 0.11.11

This release fixes a remote memory exhaustion issue in the quinn-proto Assembler. See GHSA-4w2j-m93h-cj5j for more details and #2694 for the fix.

Two sponsoring organizations participated in coordinated disclosure. If this is relevant to your organization, please contact us to keep support Quinn maintenance.

What's Changed

... (truncated)

Commits

• eaec0db Bump versions to 0.11.18 / 0.11.12
• 4c92955 proto: handle empty ranges in RangeSet::replace
• 9a66201 proto: avoid panic on high minimum ACK delay
• abca008 streams: budget send windows against retained storage
• 3c0adcc streams: release abandoned send buffers on reset
• d2cf48f quinn: enforce cumulative read_to_end size limits
• daa5131 quinn: separate read_to_end buffer accumulation
• 811b548 proto: reject transport parameters with a mismatched length
• 9bd87c9 proto: preserve the server config for pending incoming connections
• a708a97 proto: prune queued DATAGRAMs when the active path changes
• Additional commits viewable in compare view

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[eveeifyeve]

@dependabot rebase

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 70f518c1-d8c5-4aed-bac8-518517bf7005

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}