Skip to content

build(deps): bump quinn-proto from 0.11.14 to 0.11.17 - #6699

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/cargo/quinn-proto-0.11.16
Open

build(deps): bump quinn-proto from 0.11.14 to 0.11.17#6699
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/cargo/quinn-proto-0.11.16

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 28, 2026

Copy link
Copy Markdown
Contributor

Bumps quinn-proto from 0.11.14 to 0.11.17.

Release notes

Sourced from quinn-proto's releases.

quinn-proto 0.11.17

This release fixes three remote memory exhaustion issues. See GHSA-qfwj-vfxf-92j2, GHSA-2hv7-gw8g-gpq5, and GHSA-hmxj-32vh-65vr for more details, and quinn-rs/quinn#2789 for the fixes.

What's Changed

Full Changelog: quinn-rs/quinn@quinn-proto-0.11.16...quinn-proto-0.11.17

quinn-proto-0.11.16

What's Changed

quinn-proto 0.11.15, quinn 0.11.11

This release fixes a remote memory exhaustion issue in the quinn-proto Assembler. See GHSA-4w2j-m93h-cj5j for more details and #2694 for the fix.

Two sponsoring organizations participated in coordinated disclosure. If this is relevant to your organization, please contact us to keep support Quinn maintenance.

What's Changed

Commits
  • 0343120 proto: bump version to 0.11.17
  • d7bf3d0 Limit total memory used to buffer outgoing datagrams
  • 31ca5d2 Limit total memory used to buffer incoming datagrams
  • 3a78b60 Factor out DatagramBuffer for queues in either direction
  • b37ced3 proto: check limits when processing already retired CIDs
  • 6a984b8 proto: extract method for checking CID retirements
  • 499dba8 proto: bound assembler chunk count regardless of over-allocation
  • 33ce0c2 congestion: saturate CUBIC window increment to avoid overflow
  • c8ad7e6 fix(ci): fix clippy lints
  • a96949f Take semver-compatible update for anyhow
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update Rust code labels Jul 28, 2026
Bumps [quinn-proto](https://github.com/quinn-rs/quinn) from 0.11.14 to 0.11.17.
- [Release notes](https://github.com/quinn-rs/quinn/releases)
- [Commits](quinn-rs/quinn@quinn-proto-0.11.14...quinn-proto-0.11.17)

---
updated-dependencies:
- dependency-name: quinn-proto
  dependency-version: 0.11.16
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title build(deps): bump quinn-proto from 0.11.14 to 0.11.16 build(deps): bump quinn-proto from 0.11.14 to 0.11.17 Aug 25, 2026
@dependabot
dependabot Bot force-pushed the dependabot/cargo/quinn-proto-0.11.16 branch from 7f96ada to b64fcee Compare August 25, 2026 16:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update Rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants