Update rebar.config deps

[renovate]

This PR contains the following updates:

Package	Update	Change
cowboy (source)	minor	2.15.0 → 2.18.0
quic (source)	minor	1.6.1 → 1.8.1
rebar3_hex (source)	minor	7.1.0 → 7.2.0

---

Release Notes

ninenines/cowboy (cowboy)

v2.18.0

Compare Source

v2.17.0

Compare Source

v2.16.1

Compare Source

v2.16.0

Compare Source

benoitc/erlang_quic (quic)

v1.8.1

Compare Source

Added

• Post-quantum hybrid key exchange x25519mlkem768 (draft-ietf-tls-ecdhe-mlkem, ML-KEM-768 + X25519), opt-in via groups. Negotiable only when the crypto library provides the ML-KEM APIs (OTP 28.1+); a groups option naming an unsupported group is rejected up front from connect/4 and start_server/3 as {error, {unsupported_group, _}} instead of crashing during the handshake. (#​195, #​198)
• docs/INTERNAL_NETWORKS.md covers running without a CA on a trusted subnet: why TLS cannot be disabled, and the verify_none and PSK-only setups for both QUIC and Erlang distribution. (#​197)

Fixed

• Initial-level CRYPTO is now chunked across Initial packets, each within the 1200-byte pre-PMTU limit, and the whole flight is replayed on retransmit. A hybrid x25519mlkem768 ClientHello (~1360 bytes) or ServerHello Initial (~1225 bytes) no longer leaves as a single oversized datagram that is dropped on paths with an MTU below ~1470 (IPv6-over-PPPoE, WireGuard, mobile). (#​195, #​198)
• A peer key share that does not fit the negotiated group is answered with an illegal_parameter alert instead of raising inside crypto and taking the connection process down. The ServerHello key_share group is kept and checked against the negotiated one, each group accepts exactly one share length, and an all-zero ECDH shared secret is rejected (RFC 8446 §7.4.2). (#​198)
• start_server/3 returns {error, no_auth_method} when a listener has neither cert/key nor PSK configuration, as documented. The check ran after the listener had started, so the call returned {ok, Pid} and the pool then collapsed. (#​197)
• connect/4 and start_server/3 reject a groups option that is not a non-empty list rather than failing later inside the connection. (#​198)

Changed

• The verify default is documented correctly as verify_peer: clients validate the server certificate unless told otherwise. docs/CLIENT_GUIDE.md and docs/DEVELOPER_GUIDE.md both listed the default as no verification. (#​197)

v1.8.0

Compare Source

Fixed

• The client hostname check applies the RFC 6125 HTTPS rules, so a wildcard SAN such as *.example.com matches host.example.com. Servers behind a wildcard-only certificate, www.google.com among them, were rejected as {hostname_mismatch, _}. (#​188)
• A Happy Eyeballs winner hands its owner the events it delivered before reporting connected. A server that sends its HTTP/3 SETTINGS in the same flight as the handshake had them dropped, so quic_h3:connect/3 timed out for a multi-address host. (#​188)
• A client that receives a Retry keeps counting Initial packet numbers up (RFC 9000 §17.2.5.3) instead of restarting at 0, so the retried Initial is not a replay of the packet the Retry answered. The pre-Retry Initials leave loss detection instead of staying charged as bytes in flight.
• A client acts on a Version Negotiation packet (RFC 9000 §6.2) instead of misparsing and dropping it: no shared version closes the connection as {version_negotiation, Versions}, and a packet that arrives late, carries a foreign connection ID, or offers back our own version is discarded.
• The advertised max_udp_payload_size is what we are willing to receive rather than the PMTU probing ceiling: the max_udp_payload_size option when set, otherwise 1472 over IPv4 and 1452 over IPv6. Both roles used to advertise 1500, which does not fit a 1500-byte path. (#​184)

Changed

• A handshake failure reaches the owner as {quic, Conn, {error, Reason}}, tagged with the connection handle like every other owner event; the connection reference used to be the tag and nothing matched it. quic_h3:connect/3 passes the reason through, so a rejected certificate returns {error, {certificate_invalid, _}} rather than {error, connect_timeout}, and an exhausted Happy Eyeballs race returns the last attempt's reason rather than all_attempts_failed. Owners matching {quic, ConnRef, {error, _}} must match the handle instead.

v1.7.1

Compare Source

Fixed

• An HTTP/3 connection process now stops with normal when the underlying QUIC connection closes cleanly (graceful drain, idle timeout, shutdown), instead of the abnormal reason quic_closed. Clean closes no longer emit ERROR and CRASH reports or kill non-trapping linked owners; an abnormal QUIC exit still stops the H3 process, now as {quic_closed, Reason}. The owner also receives the {quic_h3, Conn, closed} notification on this path, which was previously skipped. (#​186)

v1.7.0

Compare Source

Added

• Stateless reset on restart (RFC 9000 §10.3). A server advertises a stateless_reset_token transport parameter bound to its initial connection ID and, after losing connection state (for example a restart), replies to an unroutable 1-RTT packet with a stateless reset derived from the same secret. A client stores the advertised token and recognises the reset, tearing the dead connection down promptly instead of waiting for its idle timer. Contributed by sstrollo (#​177).
• require_client_cert server option for mutual TLS. With verify => true the server requests a client certificate and validates any presented chain against cacerts; require_client_cert => true additionally rejects a client that sends no certificate (certificate_required), making mutual TLS mandatory. Contributed by sstrollo (#​178).

Security

• The server now validates the client certificate chain in mutual TLS. With verify => true a presented client certificate is checked against the configured trust anchors (cacerts, OS store by default) in addition to the CertificateVerify signature, so a self-signed or otherwise untrusted certificate is rejected instead of accepted. An empty client certificate is still accepted by default (optional mTLS, RFC 8446 §4.4.2.4); set require_client_cert => true to require one. Contributed by sstrollo (#​178).

Fixed

• HTTP/3 client connections close cleanly on an invalid peer SETTINGS frame instead of crashing the connection process. A SETTINGS violation (for example SETTINGS_H3_DATAGRAM advertised without the QUIC max_datagram_frame_size transport parameter) is reported to the owner as {error, 265, _} (H3_SETTINGS_ERROR) and the connection closes, rather than the state machine terminating with bad_return_from_state_function and taking the owner's request down. (#​172)
• The connection idle timer is driven by received activity (RFC 9000 §10.1): it restarts on every received packet and on the first ack-eliciting packet sent since the last receive, but not on subsequent sends. A connection sending keep-alive PINGs or PTO retransmits into a black hole now idle-closes instead of holding its own timer open forever, while a reactivated idle connection is not closed before its first ack returns. Contributed by sstrollo (#​174).
• Connection-level MAX_DATA slides forward with received bytes instead of capping the absolute limit at the receive window, so a sustained transfer no longer stalls permanently once the connection has received fc_max_receive_window (8 MiB) bytes in total. Contributed by sstrollo (#​176), reported independently by maslowalex (#​173).

Changed

• Per-packet routing traces in the listener are logged at debug instead of info, so a busy or post-restart listener no longer floods the log. Contributed by sstrollo (#​175).

v1.6.5

Compare Source

Added

• quic_h3:respond/5 sends an HTTP/3 response status, headers and full body with end-stream in a single connection call, coalescing what previously took send_response/4 plus send_data/4. HEAD, 204 and 304 responses send no body.
• quic:start_server/3 accepts a sni_callback that selects the server certificate and key per connection from the ClientHello SNI (RFC 6066 §3), so an HTTP/3 listener can present different certificates per hostname. The callback is invoked with the parsed server_name and returns {ok, #{cert => Cert, key => Key, cert_chain => Chain}} or {error, _}; an error, malformed result or raised exception fails the handshake with a handshake_failure alert. The static cert/key remain the default when no callback is set.

v1.6.4

Compare Source

Changed

• HTTP/3 no longer accumulates received DATA payloads in the stream record. Data still reaches owners and handlers through the existing delivery path, while Content-Length and unbounded-body limits are enforced from a byte counter. The #h3_stream.body field is retained for compatibility but is no longer populated.

v1.6.3

Compare Source

Added

• quic:safe_close/1,2,3 closes a connection and ignores any error if it is already gone, for teardown paths that must not crash.

Fixed

• HTTP/3 connection errors now send a CONNECTION_CLOSE. handle_connection_error passed the error reason straight to quic:close/3, but several call sites supply a non-binary reason, which failed the function's binary guard and was swallowed by a surrounding catch, so the connection was left open. The reason is now coerced to a binary phrase.

Changed

• Replaced the deprecated bare catch expressions in the library and test suites with try ... catch, clearing the OTP 27+ compiler warnings. CI now runs the unit tests on OTP 26, 27, 28 and 29 (the matrix previously collapsed to one OTP version per OS).

v1.6.2

Compare Source

Fixed

• Happy Eyeballs + HTTP/3: a client connecting to a hostname that resolves to more than one address (so the race path runs) could hang in quic_h3:connect/3 until connect_timeout. The QUIC connection completes its handshake while owned by the race coordinator, so the server's HTTP/3 control stream and SETTINGS were delivered to the transient owner and dropped before the H3 connection process existed. set_owner re-delivers {connected} but not that already-arrived stream data; the race coordinator and quic_h3:connect/3 now forward the buffered {quic, Conn, _} backlog to the new owner at each ownership handoff. Diagnosed and originally fixed by ycastorium (#​160, #​161).
• Server certificate validation recovers from an expired cross-signed root. When the served chain anchors at an expired cross-signed root (Let's Encrypt ISRG Root X2 cross-signed by the now-expired ISRG Root X1) and the trust store holds a still-valid root with the same public key, the client retries the alternative trust anchors instead of failing with cert_expired. A genuinely expired leaf or intermediate still fails.

erlef/rebar3_hex (rebar3_hex)

v7.2.0

Compare Source

What's Changed

• Harden GitHub Actions security by @​maennchen in #​359
• Bump the actions group with 2 updates by @​dependabot[bot] in #​360
• Bump github/codeql-action from 4.35.1 to 4.35.2 in the actions group by @​dependabot[bot] in #​362
• Bump github/codeql-action from 4.35.2 to 4.35.3 in the actions group by @​dependabot[bot] in #​363
• Upgrade hex_core to 0.17.0 by @​maennchen in #​364
• Bump the actions group with 3 updates by @​dependabot[bot] in #​365
• Bump the actions group across 1 directory with 3 updates by @​dependabot[bot] in #​369
• Bump the actions group with 2 updates by @​dependabot[bot] in #​371
• Bump the actions group across 1 directory with 3 updates by @​dependabot[bot] in #​373
• Add rebar3 hex outdated command by @​saleyn in #​368
• Bump the actions group across 1 directory with 4 updates by @​dependabot[bot] in #​375

New Contributors

• @​dependabot[bot] made their first contribution in #​360

Full Changelog: erlef/rebar3_hex@v7.1.0...v7.2.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.