chore(deps): bump quinn-proto from 0.11.9 to 0.11.15

[dependabot]

Bumps quinn-proto from 0.11.9 to 0.11.15.

Release notes

Sourced from quinn-proto's releases.

quinn-proto 0.11.15, quinn 0.11.11

This release fixes a remote memory exhaustion issue in the quinn-proto Assembler. See GHSA-4w2j-m93h-cj5j for more details and #2694 for the fix.

Two sponsoring organizations participated in coordinated disclosure. If this is relevant to your organization, please contact us to keep support Quinn maintenance.

What's Changed

• Prepare 0.11.x branch for release by @​djc in quinn-rs/quinn#2645
• Backport of #2495 to 0.11.x by @​stablebits in quinn-rs/quinn#2674
• 0.11.x backport | quinn-proto: drop Initials silently when saturated by @​stablebits in quinn-rs/quinn#2688
• Backport #2677 to 0.11.x by @​syszery in quinn-rs/quinn#2690
• congestion: avoid double-reducing CUBIC fast convergence (0.11.x) by @​0xdeafbeef in quinn-rs/quinn#2641
• proto: yield error on too many gaps in assembler by @​djc in quinn-rs/quinn#2694

quinn-proto 0.11.14

@​jxs reported a denial of service issue in quinn-proto 5 days ago:

• GHSA-6xvm-j4wr-6v98

We coordinated with them to release this version to patch the issue. Unfortunately the maintainers missed these issues during code review and we did not have enough fuzzing coverage -- we regret the oversight and have added an additional fuzzing target.

Organizations that want to participate in coordinated disclosure can contact us privately to discuss terms.

What's Changed

• Fix over-permissive proto dependency edge by @​Ralith in quinn-rs/quinn#2385
• 0.11.x: avoid unwrapping VarInt decoding during parameter parsing by @​djc in quinn-rs/quinn#2559

quinn-proto 0.11.13, quinn 0.11.9

What's Changed

• quinn: Remove explicit write future structs by @​gretchenfrage in quinn-rs/quinn#2226
• proto: Make BytesSource private by @​gretchenfrage in quinn-rs/quinn#2233
• feat: Make the future returned by SendStream::stopped static by @​Frando in quinn-rs/quinn#2220
• refactor(quinn): Remove some usage of execute_poll by @​gretchenfrage in quinn-rs/quinn#2232
• Fix false positive GSO detection by @​inetic in quinn-rs/quinn#2248
• expose Connection::side() in quinn by @​abonander in quinn-rs/quinn#2261
• refactor(quinn): Configure out async_io::UdpSocket when unused by @​matheus23 in quinn-rs/quinn#2264
• proto: upgrade to rustls-platform-verifier 0.6 by @​djc in quinn-rs/quinn#2276
• Don't violate client CID limits when advertising a preferred address by @​Ralith in quinn-rs/quinn#2282
• Various enhancement to quinn perf by @​stormshield-damiend in quinn-rs/quinn#2279
• Updated quinn::Connection::send_datagram() docs by @​gry8t in quinn-rs/quinn#2284
• Collect qlog recovery metrics by @​stormshield-fabs in quinn-rs/quinn#2278
• proto: Add option to pad all application data packets to MTU by @​FlorianUekermann in quinn-rs/quinn#2274
• Update to socket2 v0.6 by @​Thomasdezeeuw in quinn-rs/quinn#2291
• Upgrade to fastbloom 0.12 by @​djc in quinn-rs/quinn#2290
• Fix flaky key update test by @​Ralith in quinn-rs/quinn#2292
• chore(Cargo.toml): support both socket2 v0.5 and v0.6 by @​mxinden in quinn-rs/quinn#2294
• Tiny clean up of a comment that was in the wrong place by @​flub in quinn-rs/quinn#2306
• Do not track lost_packets twice by @​flub in quinn-rs/quinn#2308

... (truncated)

Commits

• a7499b8 Bump versions for release
• 7c1970f proto: yield error on too many gaps in assembler
• fe5ac49 congestion: avoid double-reducing CUBIC fast convergence
• c1e903b fix(quinn): handle overdue timers without polling the async timer
• b3b20e1 quinn-udp: allow to use windows-sys 0.61
• 6f03ca3 quinn-proto: drop Initials silently when saturated
• 41c8527 quinn: fix ref count logic for ConnectionRef and EndpointRef
• 73ea1dd Remove RecvStreams from blocked_readers on stop
• cf16bfd Early return in RecvStream::drop()
• af2e4e5 Fix the (pre-existing) rightward drift by inverting conditions
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.