[dependabot]

Bumps aioquic from 1.3.0 to 1.6.1.

Changelog

Sourced from aioquic's changelog.

1.6.1

• Fix handshakes stalling under packet loss:

  • Install the client's Handshake write key on receiving the ServerHello, as :rfc:8446 and :rfc:9001 allow. If the server's EncryptedExtensions was lost, the client could not acknowledge the server's Handshake packets, which deadlocked against servers whose probes carry no data.
  • Retransmit the oldest unacknowledged packet's data when the PTO fires, instead of sending a bare PING, as :rfc:9002 recommends. Lost data such as HANDSHAKE_DONE or a request's STREAM frame no longer waits for the probe's acknowledgement to be retransmitted.

• Stop treating a PTO expiry or a CRYPTO data retransmission as a congestion event, as :rfc:9002 requires.

• Fail pending requests and WebSocket reads in the http3_client example when the connection terminates, instead of waiting indefinitely.

1.6.0

• Abort the TLS handshake with an alert, instead of raising an exception which left the connection hung, when the peer sends a malformed certificate, a certificate whose key cannot be loaded, a CertificateVerify algorithm which does not match its key, a ClientHello or ServerHello without a key share, a server name which is not ASCII, or an empty Certificate message.

• Only use RSASSA-PSS for RSA signatures in CertificateVerify and reject PKCS#1 v1.5 signatures from the peer, as :rfc:8446 requires.

• Close the connection with no_application_protocol when ALPN negotiation fails, including when the server selects no protocol, several protocols or one the client did not offer.

• Fix session resumption failing with a BufferWriteError when the session ticket or the key share is large, such as with X25519MLKEM768.

• Send session tickets only after the client's Finished. A client which never completed the handshake could make the server retransmit them indefinitely.

• Harden connection establishment as :rfc:9000 and :rfc:9001 require:

  • Close the connection with INVALID_TOKEN when a Retry token is invalid, instead of leaving the client waiting for its idle timeout.
  • Discard packets whose Source Connection ID differs from the server's first Initial, and Retry packets reusing the original Destination Connection ID.
  • Treat a non-empty legacy_session_id in the ClientHello as a PROTOCOL_VIOLATION.
  • Reject initial_max_streams transport parameters above 2^60.
  • Defer key updates requested before the handshake is confirmed.

• Improve loss recovery and congestion control as :rfc:9002 requires: do not arm the PTO for application data before the handshake is confirmed, keep the

... (truncated)

Commits

• 974e934 1.6.1
• 9763419 Fail pending requests when the HTTP/3 client's connection terminates
• 2969776 Retransmit the oldest packet's data when the PTO fires
• f5f8abd Group the handshake packet loss tests and check their timelines
• 8588d2f Install the client's Handshake write key on ServerHello
• 9c05048 1.6.0
• 1c96bf5 Reject a push stream received by a server
• 5abd749 Treat MAX_PUSH_ID as the largest allowed push ID
• f37090c Resume a blocked PUSH_PROMISE as a PUSH_PROMISE
• 9946c19 Report stream end after the last complete frame
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #58.