dependabot[bot] opened a new pull request, #356: URL: https://github.com/apache/paimon-cpp/pull/356
Bumps [quinn-proto](https://github.com/quinn-rs/quinn) from 0.11.13 to 0.11.18. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/quinn-rs/quinn/releases";>quinn-proto's releases</a>.</em></p> <blockquote> <h2>quinn-proto 0.11.18, quinn 0.11.12</h2> <p>Three more security issues were reported and fixed since 0.11.17:</p> <ul> <li><a href="https://github.com/quinn-rs/quinn/security/advisories/GHSA-465w-v9q3-7j98";>https://github.com/quinn-rs/quinn/security/advisories/GHSA-465w-v9q3-7j98</a>: a remote peer can panic unordered reads from quinn-proto with five small STREAM frames</li> <li><a href="GHSA-ppcp-v39w-8jq2">https://github.com/quinn-rs/quinn/security/advisories/GHSA-ppcp-v39w-8jq2</a>: <code>Datagrams::send()</code> double-subtracts <code>payload_bytes</code> on the drop-oldest path, panicking the sender</li> <li><a href="GHSA-3g6h-r5qx-f6hq">https://github.com/quinn-rs/quinn/security/advisories/GHSA-3g6h-r5qx-f6hq</a>: Peer minimum ACK delay can panic when ACK_FREQUENCY transmission is enabled</li> </ul> <h2>What's Changed</h2> <ul> <li>0.11.x: backport the black hole detector fixes by <a href="https://github.com/vcarus";><code>@vcarus</code></a> in <a href="https://redirect.github.com/quinn-rs/quinn/pull/2799";>quinn-rs/quinn#2799</a></li> <li>0.11.x: fix payload_bytes double subtraction when evicting outgoing datagrams by <a href="https://github.com/vcarus";><code>@vcarus</code></a> in <a href="https://redirect.github.com/quinn-rs/quinn/pull/2806";>quinn-rs/quinn#2806</a></li> <li>0.11.x: Backport <a href="https://redirect.github.com/quinn-rs/quinn/issues/2816";>#2816</a> (add min rtt to path stats) by <a href="https://github.com/somtochiama";><code>@somtochiama</code></a> in <a href="https://redirect.github.com/quinn-rs/quinn/pull/2817";>quinn-rs/quinn#2817</a></li> <li>0.11.x: Bundle ACK in packets with DATAGRAM or STREAM frames by <a href="https://github.com/anatawa12";><code>@anatawa12</code></a> in <a href="https://redirect.github.com/quinn-rs/quinn/pull/2819";>quinn-rs/quinn#2819</a></li> <li>quinn-proto: drop short packets with unsupported versions (0.11.x) by <a href="https://github.com/vcarus";><code>@vcarus</code></a> in <a href="https://redirect.github.com/quinn-rs/quinn/pull/2823";>quinn-rs/quinn#2823</a></li> <li>0.11.x: backport: Avoid re-instantiating debug span in ConnectionDriver::poll by <a href="https://github.com/stormshield-fabs";><code>@stormshield-fabs</code></a> in <a href="https://redirect.github.com/quinn-rs/quinn/pull/2829";>quinn-rs/quinn#2829</a></li> <li>0.11.x: backport <a href="https://redirect.github.com/quinn-rs/quinn/issues/2814";>#2814</a> (proto: coalesce contiguous chunks during defragment) by <a href="https://github.com/Ralith";><code>@Ralith</code></a> in <a href="https://redirect.github.com/quinn-rs/quinn/pull/2826";>quinn-rs/quinn#2826</a></li> <li>[0.11.x] proto: release the send window when rejecting 0-RTT by <a href="https://github.com/zerox80";><code>@zerox80</code></a> in <a href="https://redirect.github.com/quinn-rs/quinn/pull/2843";>quinn-rs/quinn#2843</a></li> <li>[0.11.x] Reject DATAGRAMs larger than the send buffer by <a href="https://github.com/zerox80";><code>@zerox80</code></a> in <a href="https://redirect.github.com/quinn-rs/quinn/pull/2844";>quinn-rs/quinn#2844</a></li> <li>0.11.x: backport <a href="https://redirect.github.com/quinn-rs/quinn/issues/2847";>#2847</a> (proto: send DATA_BLOCKED and STREAM_DATA_BLOCKED when blocked by flow control) by <a href="https://github.com/heitzlki";><code>@heitzlki</code></a> in <a href="https://redirect.github.com/quinn-rs/quinn/pull/2852";>quinn-rs/quinn#2852</a></li> <li>[0.11.x] proto: reset pacing state when resetting a path by <a href="https://github.com/zerox80";><code>@zerox80</code></a> in <a href="https://redirect.github.com/quinn-rs/quinn/pull/2850";>quinn-rs/quinn#2850</a></li> <li>[0.11.x] proto: avoid duplicate flow-control credit for stopped streams by <a href="https://github.com/zerox80";><code>@zerox80</code></a> in <a href="https://redirect.github.com/quinn-rs/quinn/pull/2848";>quinn-rs/quinn#2848</a></li> <li>[0.11.x] proto: prune queued DATAGRAMs after path MTU changes by <a href="https://github.com/zerox80";><code>@zerox80</code></a> in <a href="https://redirect.github.com/quinn-rs/quinn/pull/2849";>quinn-rs/quinn#2849</a></li> <li>[0.11.x] proto: preserve the server config for pending incoming connections by <a href="https://github.com/zerox80";><code>@zerox80</code></a> in <a href="https://redirect.github.com/quinn-rs/quinn/pull/2865";>quinn-rs/quinn#2865</a></li> <li>[0.11.x] proto: reject transport parameters with a mismatched length by <a href="https://github.com/MaxFreedomPollard";><code>@MaxFreedomPollard</code></a> in <a href="https://redirect.github.com/quinn-rs/quinn/pull/2866";>quinn-rs/quinn#2866</a></li> <li>[0.11.x] quinn: enforce read_to_end limits for reordered chunks by <a href="https://github.com/zerox80";><code>@zerox80</code></a> in <a href="https://redirect.github.com/quinn-rs/quinn/pull/2864";>quinn-rs/quinn#2864</a></li> <li>[0.11.x] streams: bound retained send storage by the send window by <a href="https://github.com/zerox80";><code>@zerox80</code></a> in <a href="https://redirect.github.com/quinn-rs/quinn/pull/2863";>quinn-rs/quinn#2863</a></li> <li>Prepare 0.11.18 by <a href="https://github.com/djc";><code>@djc</code></a> in <a href="https://redirect.github.com/quinn-rs/quinn/pull/2867";>quinn-rs/quinn#2867</a></li> </ul> <h2>quinn-proto 0.11.17</h2> <p>This release fixes three remote memory exhaustion issues. See GHSA-qfwj-vfxf-92j2, GHSA-2hv7-gw8g-gpq5, and GHSA-hmxj-32vh-65vr for more details, and <a href="https://redirect.github.com/quinn-rs/quinn/pull/2789";>quinn-rs/quinn#2789</a> for the fixes.</p> <h2>What's Changed</h2> <ul> <li>fix(ci): fix clippy lints by <a href="https://github.com/LesnyRumcajs";><code>@LesnyRumcajs</code></a> in <a href="https://redirect.github.com/quinn-rs/quinn/pull/2752";>quinn-rs/quinn#2752</a></li> <li>congestion: saturate CUBIC window increment to avoid overflow by <a href="https://github.com/LesnyRumcajs";><code>@LesnyRumcajs</code></a> in <a href="https://redirect.github.com/quinn-rs/quinn/pull/2751";>quinn-rs/quinn#2751</a></li> <li>0.11.x: Backport memory use fixes and prepare release by <a href="https://github.com/Ralith";><code>@Ralith</code></a> in <a href="https://redirect.github.com/quinn-rs/quinn/pull/2790";>quinn-rs/quinn#2790</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/quinn-rs/quinn/compare/quinn-proto-0.11.16...quinn-proto-0.11.17";>https://github.com/quinn-rs/quinn/compare/quinn-proto-0.11.16...quinn-proto-0.11.17</a></p> <h2>quinn-proto-0.11.16</h2> <h2>What's Changed</h2> <ul> <li>0.11.x: upgrade dependencies by <a href="https://github.com/djc";><code>@djc</code></a> in <a href="https://redirect.github.com/quinn-rs/quinn/pull/2707";>quinn-rs/quinn#2707</a></li> </ul> <h2>quinn-proto 0.11.15, quinn 0.11.11</h2> <p>This release fixes a remote memory exhaustion issue in the quinn-proto <code>Assembler</code>. See <a href="https://github.com/quinn-rs/quinn/security/advisories/GHSA-4w2j-m93h-cj5j";>https://github.com/quinn-rs/quinn/security/advisories/GHSA-4w2j-m93h-cj5j</a> for more details and <a href="https://redirect.github.com/quinn-rs/quinn/issues/2694";>#2694</a> for the fix.</p> <p>Two sponsoring organizations participated in coordinated disclosure. If this is relevant to your organization, please contact us to keep support Quinn maintenance.</p> <h2>What's Changed</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/quinn-rs/quinn/commit/eaec0db4bcb698f76df736d89938743c88a2ad5f";><code>eaec0db</code></a> Bump versions to 0.11.18 / 0.11.12</li> <li><a href="https://github.com/quinn-rs/quinn/commit/4c9295547509a9daa8156f2766d0a67cc57bddf3";><code>4c92955</code></a> proto: handle empty ranges in RangeSet::replace</li> <li><a href="https://github.com/quinn-rs/quinn/commit/9a66201eaf31fa3ec9e94fabcae8244554bc00c6";><code>9a66201</code></a> proto: avoid panic on high minimum ACK delay</li> <li><a href="https://github.com/quinn-rs/quinn/commit/abca00897ed85b145f0582499ab2edb050970056";><code>abca008</code></a> streams: budget send windows against retained storage</li> <li><a href="https://github.com/quinn-rs/quinn/commit/3c0adcc01ca36c1acec84055384ddbe72c0e9b8b";><code>3c0adcc</code></a> streams: release abandoned send buffers on reset</li> <li><a href="https://github.com/quinn-rs/quinn/commit/d2cf48f12b9cf95de51f317e16ee8976ca3afc2c";><code>d2cf48f</code></a> quinn: enforce cumulative read_to_end size limits</li> <li><a href="https://github.com/quinn-rs/quinn/commit/daa513181540c85f2f1ffeb4aad3cb8bad42aef8";><code>daa5131</code></a> quinn: separate read_to_end buffer accumulation</li> <li><a href="https://github.com/quinn-rs/quinn/commit/811b548241253e337a3bb4c7bd08b2a7f69b443d";><code>811b548</code></a> proto: reject transport parameters with a mismatched length</li> <li><a href="https://github.com/quinn-rs/quinn/commit/9bd87c9e3e433f05bf5419af173643b8d8850dec";><code>9bd87c9</code></a> proto: preserve the server config for pending incoming connections</li> <li><a href="https://github.com/quinn-rs/quinn/commit/a708a979c291f6b2baf0141d3096f265353cbce1";><code>a708a97</code></a> proto: prune queued DATAGRAMs when the active path changes</li> <li>Additional commits viewable in <a href="https://github.com/quinn-rs/quinn/compare/quinn-proto-0.11.13...quinn-proto-0.11.18";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/paimon-cpp/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
