[dependabot]

Bumps aioquic from 1.3.0 to 1.7.0.

Changelog

Sourced from aioquic's changelog.

1.7.0

• Migrate clients to the server's preferred address, as :rfc:9000 allows.

  .. note::

  If you drive :class:~aioquic.quic.connection.QuicConnection with your own I/O, you must send each datagram to the address returned alongside it by datagrams_to_send(). That address may now differ from the one passed to connect(), so a connected UDP socket or a tunnel with a single fixed destination no longer works.

• Add :meth:~aioquic.quic.connection.QuicConnection.get_peer_address, which returns the address datagrams are currently sent to. It can change when either endpoint migrates.

• Improve path validation and connection migration as :rfc:9000 requires:

  • Discard datagrams received by clients from unknown server addresses.
  • Pad datagrams carrying PATH_CHALLENGE or PATH_RESPONSE frames to 1200 bytes, within the anti-amplification limit.
  • Retransmit lost PATH_CHALLENGE frames on servers, abandon failed validations and revert to the last validated address.
  • Answer path probes on servers on the path they arrive on, with a connection ID kept for each path.
  • Keep outstanding PATH_CHALLENGE data for each path, and ignore a PATH_RESPONSE that matches no challenge instead of closing the connection.
  • Keep clients on the preferred address when the server probes them from its original address.
  • Reset the spin bit when changing connection ID.

• Grant MAX_STREAMS credit as the peer's streams close, instead of whenever half the limit was used, so the stream limit bounds concurrency. Stream IDs an application skips can no longer be used later.

• Restart the idle timer when sending the first ack-eliciting packet after receiving one, as :rfc:9000 requires.

• Fix handshakes stalling or failing:

  • Pad datagrams carrying INITIAL packets to 1200 bytes even when the congestion window is full, as :rfc:9000 requires. A client sending 0-RTT data could send short datagrams, which servers discard.
  • Acknowledge 0-RTT packets before the handshake completes, as :rfc:9000 requires.
  • Send lost HANDSHAKE data even when the congestion window is full, instead of stalling until the idle timeout when no probe timer was armed.
  • Only assume the server's INITIAL packets were lost while the client is waiting for the ServerHello, as :rfc:9002 describes, instead of sending spurious probes for packets it cannot decrypt later on.

... (truncated)

Commits

• 8c5c6b4 1.7.0
• b732937 Do not arm timers the anti-amplification limit leaves no room for
• 1761a80 Harden retry token handling
• f5ab651 Limit the ACK ranges which are kept and sent
• afba91b Only visit the sent packets which ACK ranges cover
• 824ceb8 Reject ACK frames with negative packet numbers
• bda4ab5 Send stranded HANDSHAKE data even when the congestion window is full
• 2f2a0c3 Only speed up the handshake before the client has handshake keys
• 7cf1878 Ask contributors to review their changes critically
• 4b1c2c9 Leave room for header protection padding in the first frame
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)