Skip to content

Bump quinn-proto from 0.11.14 to 0.11.17 - #217

Merged
rmburg merged 1 commit into
mainfrom
dependabot/cargo/quinn-proto-0.11.16
Aug 21, 2026
Merged

Bump quinn-proto from 0.11.14 to 0.11.17#217
rmburg merged 1 commit into
mainfrom
dependabot/cargo/quinn-proto-0.11.16

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 28, 2026

Copy link
Copy Markdown
Contributor

Bumps quinn-proto from 0.11.14 to 0.11.17.

Release notes

Sourced from quinn-proto's releases.

quinn-proto 0.11.17

This release fixes three remote memory exhaustion issues. See GHSA-qfwj-vfxf-92j2, GHSA-2hv7-gw8g-gpq5, and GHSA-hmxj-32vh-65vr for more details, and quinn-rs/quinn#2789 for the fixes.

What's Changed

Full Changelog: quinn-rs/quinn@quinn-proto-0.11.16...quinn-proto-0.11.17

quinn-proto-0.11.16

What's Changed

quinn-proto 0.11.15, quinn 0.11.11

This release fixes a remote memory exhaustion issue in the quinn-proto Assembler. See GHSA-4w2j-m93h-cj5j for more details and #2694 for the fix.

Two sponsoring organizations participated in coordinated disclosure. If this is relevant to your organization, please contact us to keep support Quinn maintenance.

What's Changed

Commits
  • 0343120 proto: bump version to 0.11.17
  • d7bf3d0 Limit total memory used to buffer outgoing datagrams
  • 31ca5d2 Limit total memory used to buffer incoming datagrams
  • 3a78b60 Factor out DatagramBuffer for queues in either direction
  • b37ced3 proto: check limits when processing already retired CIDs
  • 6a984b8 proto: extract method for checking CID retirements
  • 499dba8 proto: bound assembler chunk count regardless of over-allocation
  • 33ce0c2 congestion: saturate CUBIC window increment to avoid overflow
  • c8ad7e6 fix(ci): fix clippy lints
  • a96949f Take semver-compatible update for anyhow
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update Rust code labels Jul 28, 2026
@dependabot dependabot Bot added the rust Pull requests that update Rust code label Jul 28, 2026
@rmburg

rmburg commented Aug 21, 2026

Copy link
Copy Markdown
Member

@dependabot rebase

Bumps [quinn-proto](https://github.com/quinn-rs/quinn) from 0.11.14 to 0.11.17.
- [Release notes](https://github.com/quinn-rs/quinn/releases)
- [Commits](quinn-rs/quinn@quinn-proto-0.11.14...quinn-proto-0.11.17)

---
updated-dependencies:
- dependency-name: quinn-proto
  dependency-version: 0.11.16
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump quinn-proto from 0.11.14 to 0.11.16 Bump quinn-proto from 0.11.14 to 0.11.17 Aug 21, 2026
@dependabot
dependabot Bot force-pushed the dependabot/cargo/quinn-proto-0.11.16 branch from 4ffc19d to 1a9552e Compare August 21, 2026 11:32
@rmburg
rmburg merged commit 5d9dbce into main Aug 21, 2026
1 check passed
@rmburg
rmburg deleted the dependabot/cargo/quinn-proto-0.11.16 branch August 21, 2026 11:36
@github-project-automation github-project-automation Bot moved this from Todo to Done in Development Aug 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update Rust code

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

1 participant