6.md (10635B)
1 # PR #6 Bump h2 from 0.3.13 to 0.3.21 2 3 - **Status:** open 4 - **Author:** @dependabot[bot] 5 - **Created:** 2023-10-07T17:33:52Z 6 - **Branch:** dependabot/cargo/h2-0.3.21 → main 7 - **Labels:** dependencies 8 - **Diff:** [6.diff](./6.diff) 9 10 --- 11 12 Bumps [h2](https://github.com/hyperium/h2) from 0.3.13 to 0.3.21. 13 <details> 14 <summary>Release notes</summary> 15 <p><em>Sourced from <a href="https://github.com/hyperium/h2/releases">h2's releases</a>.</em></p> 16 <blockquote> 17 <h2>v0.3.21</h2> 18 <h2>What's Changed</h2> 19 <ul> 20 <li>Fix opening of new streams over peer's max concurrent limit.</li> 21 <li>Fix <code>RecvStream</code> to return data even if it has received a <code>CANCEL</code> stream error.</li> 22 <li>Update MSRV to 1.63.</li> 23 </ul> 24 <h2>New Contributors</h2> 25 <ul> 26 <li><a href="https://github.com/DDtKey"><code>@DDtKey</code></a> made their first contribution in <a href="https://redirect.github.com/hyperium/h2/pull/703">hyperium/h2#703</a></li> 27 <li><a href="https://github.com/jwilm"><code>@jwilm</code></a> made their first contribution in <a href="https://redirect.github.com/hyperium/h2/pull/707">hyperium/h2#707</a></li> 28 </ul> 29 <h2>v0.3.20</h2> 30 <h2>Bug Fixes</h2> 31 <ul> 32 <li>Fix panic if a server received a request with a <code>:status</code> pseudo header in the 1xx range. (<a href="https://redirect.github.com/hyperium/h2/issues/695">#695</a>)</li> 33 <li>Fix panic if a reset stream had pending push promises that were more than allowed. (<a href="https://redirect.github.com/hyperium/h2/issues/685">#685</a>)</li> 34 <li>Fix potential flow control overflow by subtraction, instead returning a connection error. (<a href="https://redirect.github.com/hyperium/h2/issues/692">#692</a>)</li> 35 </ul> 36 <h2>New Contributors</h2> 37 <ul> 38 <li><a href="https://github.com/f0rki"><code>@f0rki</code></a> made their first contribution in <a href="https://redirect.github.com/hyperium/h2/pull/690">hyperium/h2#690</a></li> 39 </ul> 40 <h2>v0.3.19</h2> 41 <h2>What's Changed</h2> 42 <ul> 43 <li>Fix counting reset streams when triggered by a GOAWAY.</li> 44 <li>Send <code>too_many_resets</code> in opaque debug data of GOAWAY when too many resets received.</li> 45 </ul> 46 <h2>New Contributors</h2> 47 <ul> 48 <li><a href="https://github.com/Herbstein"><code>@Herbstein</code></a> made their first contribution in <a href="https://redirect.github.com/hyperium/h2/pull/673">hyperium/h2#673</a></li> 49 <li><a href="https://github.com/foresterre"><code>@foresterre</code></a> made their first contribution in <a href="https://redirect.github.com/hyperium/h2/pull/680">hyperium/h2#680</a></li> 50 </ul> 51 <h2>v0.3.18</h2> 52 <h2>What's Changed</h2> 53 <ul> 54 <li>fix: pending-accept remotely-reset streams pattern was checking is_local by <a href="https://github.com/seanmonstar"><code>@seanmonstar</code></a> in <a href="https://redirect.github.com/hyperium/h2/pull/676">hyperium/h2#676</a></li> 55 </ul> 56 <h2>v0.3.17</h2> 57 <h2>What's Changed</h2> 58 <ul> 59 <li>Add <code>Error::is_library()</code> method to check if the originated inside <code>h2</code>.</li> 60 <li>Add <code>max_pending_accept_reset_streams(usize)</code> option to client and server 61 builders.</li> 62 <li>Fix theoretical memory growth when receiving too many HEADERS and then 63 RST_STREAM frames faster than an application can accept them off the queue. 64 (CVE-2023-26964)</li> 65 </ul> 66 <h2>v0.3.16</h2> 67 <h2>What's Changed</h2> 68 <ul> 69 <li>Set <code>Protocol</code> extension on requests when received Extended CONNECT requests.</li> 70 <li>Remove <code>B: Unpin + 'static</code> bound requiremented of bufs</li> 71 <li>Fix releasing of frames when stream is finished, reducing memory usage.</li> 72 <li>Fix panic when trying to send data and connection window is available, but stream window is not.</li> 73 <li>Fix spurious wakeups when stream capacity is not available.</li> 74 </ul> 75 <!-- raw HTML omitted --> 76 </blockquote> 77 <p>... (truncated)</p> 78 </details> 79 <details> 80 <summary>Changelog</summary> 81 <p><em>Sourced from <a href="https://github.com/hyperium/h2/blob/master/CHANGELOG.md">h2's changelog</a>.</em></p> 82 <blockquote> 83 <h1>0.3.21 (August 21, 2023)</h1> 84 <ul> 85 <li>Fix opening of new streams over peer's max concurrent limit.</li> 86 <li>Fix <code>RecvStream</code> to return data even if it has received a <code>CANCEL</code> stream error.</li> 87 <li>Update MSRV to 1.63.</li> 88 </ul> 89 <h1>0.3.20 (June 26, 2023)</h1> 90 <ul> 91 <li>Fix panic if a server received a request with a <code>:status</code> pseudo header in the 1xx range.</li> 92 <li>Fix panic if a reset stream had pending push promises that were more than allowed.</li> 93 <li>Fix potential flow control overflow by subtraction, instead returning a connection error.</li> 94 </ul> 95 <h1>0.3.19 (May 12, 2023)</h1> 96 <ul> 97 <li>Fix counting reset streams when triggered by a GOAWAY.</li> 98 <li>Send <code>too_many_resets</code> in opaque debug data of GOAWAY when too many resets received.</li> 99 </ul> 100 <h1>0.3.18 (April 17, 2023)</h1> 101 <ul> 102 <li>Fix panic because of opposite check in <code>is_remote_local()</code>.</li> 103 </ul> 104 <h1>0.3.17 (April 13, 2023)</h1> 105 <ul> 106 <li>Add <code>Error::is_library()</code> method to check if the originated inside <code>h2</code>.</li> 107 <li>Add <code>max_pending_accept_reset_streams(usize)</code> option to client and server 108 builders.</li> 109 <li>Fix theoretical memory growth when receiving too many HEADERS and then 110 RST_STREAM frames faster than an application can accept them off the queue. 111 (CVE-2023-26964)</li> 112 </ul> 113 <h1>0.3.16 (February 27, 2023)</h1> 114 <ul> 115 <li>Set <code>Protocol</code> extension on requests when received Extended CONNECT requests.</li> 116 <li>Remove <code>B: Unpin + 'static</code> bound requiremented of bufs</li> 117 <li>Fix releasing of frames when stream is finished, reducing memory usage.</li> 118 <li>Fix panic when trying to send data and connection window is available, but stream window is not.</li> 119 <li>Fix spurious wakeups when stream capacity is not available.</li> 120 </ul> 121 <h1>0.3.15 (October 21, 2022)</h1> 122 <ul> 123 <li>Remove <code>B: Buf</code> bound on <code>SendStream</code>'s parameter</li> 124 <li>add accessor for <code>StreamId</code> u32</li> 125 </ul> 126 <h1>0.3.14 (August 16, 2022)</h1> 127 <ul> 128 <li>Add <code>Error::is_reset</code> function.</li> 129 <li>Bump MSRV to Rust 1.56.</li> 130 <li>Return <code>RST_STREAM(NO_ERROR)</code> when the server early responds.</li> 131 </ul> 132 </blockquote> 133 </details> 134 <details> 135 <summary>Commits</summary> 136 <ul> 137 <li><a href="https://github.com/hyperium/h2/commit/da38b1c49c39ccf7e2e0dca51ebf8505d6905597"><code>da38b1c</code></a> v0.3.21</li> 138 <li><a href="https://github.com/hyperium/h2/commit/ee042922780651349915afb9cfe9b86d6b1084f9"><code>ee04292</code></a> Fix opening new streams over max concurrent (<a href="https://redirect.github.com/hyperium/h2/issues/707">#707</a>)</li> 139 <li><a href="https://github.com/hyperium/h2/commit/9bd62a2efc19da072ff6b55c92586b02a714194e"><code>9bd62a2</code></a> Test that client reacts correctly on rogue HEADERS (<a href="https://redirect.github.com/hyperium/h2/issues/667">#667</a>)</li> 140 <li><a href="https://github.com/hyperium/h2/commit/da9f34bc808a38be2c36f0f8e3a78c0164548419"><code>da9f34b</code></a> chore: fix up some clippy nags (<a href="https://redirect.github.com/hyperium/h2/issues/709">#709</a>)</li> 141 <li><a href="https://github.com/hyperium/h2/commit/cdcc641902a2c5b058da62980c5b1bede16671a4"><code>cdcc641</code></a> msrv: bump to 1.63 (<a href="https://redirect.github.com/hyperium/h2/issues/708">#708</a>)</li> 142 <li><a href="https://github.com/hyperium/h2/commit/633116ef68b4e7b5c4c5699fb5d10b58ef5818ac"><code>633116e</code></a> fix: do not ignore result of <code>ensure_recv_open</code> (<a href="https://redirect.github.com/hyperium/h2/issues/687">#687</a>)</li> 143 <li><a href="https://github.com/hyperium/h2/commit/46fb80bfd07b4dc6b8ee87b9c2e6415399830910"><code>46fb80b</code></a> test: early server response with data (<a href="https://redirect.github.com/hyperium/h2/issues/703">#703</a>)</li> 144 <li><a href="https://github.com/hyperium/h2/commit/6a75f232330374d5f329aaae91afc2dee7ed2b1f"><code>6a75f23</code></a> v0.3.20</li> 145 <li><a href="https://github.com/hyperium/h2/commit/0189722fd64d3cb5acd9764fdb85bb9a95232ea8"><code>0189722</code></a> Fix for a fuzzer-discovered integer underflow of the flow control window size...</li> 146 <li><a href="https://github.com/hyperium/h2/commit/478f7b9889e9d8d53756558cca45cebd68aeaea0"><code>478f7b9</code></a> Fix for invalid header panic corrected (<a href="https://redirect.github.com/hyperium/h2/issues/695">#695</a>)</li> 147 <li>Additional commits viewable in <a href="https://github.com/hyperium/h2/compare/v0.3.13...v0.3.21">compare view</a></li> 148 </ul> 149 </details> 150 <br /> 151 152 153 [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) 154 155 Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. 156 157 [//]: # (dependabot-automerge-start) 158 [//]: # (dependabot-automerge-end) 159 160 --- 161 162 <details> 163 <summary>Dependabot commands and options</summary> 164 <br /> 165 166 You can trigger Dependabot actions by commenting on this PR: 167 - `@dependabot rebase` will rebase this PR 168 - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it 169 - `@dependabot merge` will merge this PR after your CI passes on it 170 - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it 171 - `@dependabot cancel merge` will cancel a previously requested merge and block automerging 172 - `@dependabot reopen` will reopen this PR if it is closed 173 - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually 174 - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency 175 - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) 176 - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) 177 - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) 178 You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/MTRNord/matrix-fuzz/network/alerts). 179 180 </details> 181