⚠️ Security:

• Fixed unbounded PathEvent queue growth when an authenticated peer sends valid packets from rapidly changing source ports. Path events are now bounded by the configured path capacity.
• Hardened HTTP/3 frame parsing against memory exhaustion by enforcing payload limits as soon as frame lengths are known, allocating frame buffers incrementally, and skipping unknown frame payloads without buffering them.
• Fixed HTTP/3 field-section size enforcement to include the 32-byte per-field overhead required by RFC 9114, preventing the configured limit from being bypassed with many small fields.

Highlights:

• h3::Config::new() now advertises and enforces a default SETTINGS_MAX_FIELD_SECTION_SIZE of 32 KiB. Applications that accept larger field sections must configure a higher limit with h3::Config::set_max_field_section_size().
• Added h3::Config::set_max_priority_update_size() to configure the maximum PRIORITY_UPDATE frame payload size. The default is 256 bytes.
• Connection and stream receive flow-control windows now always start at their configured initial maximum data values instead of being clamped to smaller defaults. The related Rust and C configuration setters are deprecated no-ops.
• Fixed destination connection ID retirement when connection IDs arrive out of sequence, including associated path retirement bookkeeping.
• Fixed PTO backoff arithmetic overflow on connections with prolonged packet loss.

Full changelog at 0.29.2...0.29.3

⚠️ Security:

• Fixed a use-after-free in quiche_connection_id_iter_next(), which is part of quiche's C FFI API. The iterator previously returned a pointer to a cloned connection ID whose backing storage was dropped before the caller could read it. It now returns pointers to connection IDs owned by the iterator.
• Fixed a use-after-free in quiche_conn_retired_scid_next(), which is also part of the C FFI API. The function previously returned a pointer to a retired source connection ID whose backing storage was dropped before the caller could read it. It has been replaced by quiche_conn_retired_scid_iter(), which drains retired source connection IDs into an iterator before exposing them to callers.

The C FFI API is disabled by default via the ffi feature. The normal Rust API is not affected by these issues.

Breaking changes:

• The C API function quiche_conn_retired_scid_next() was removed and replaced with quiche_conn_retired_scid_iter() to avoid returning pointers to temporary memory. Applications using quiche_conn_retired_scid_next() should call quiche_conn_retired_scid_iter(conn), iterate with quiche_connection_id_iter_next(), and release the iterator with quiche_connection_id_iter_free().

Highlights:

• Fixed stream send-buffer accounting so congestion controller app-limited detection and Stats::tx_buffered_state track the actual bytes buffered in stream send buffers. This avoids buffered byte-count drift across retransmissions, ACKs, and stream shutdown/reset paths.

Full changelog at 0.29.1...0.29.2

Highlights:

• Added Connection::stream_closed() to query whether a stream is fully closed.
• Fixed bandwidth arithmetic overflow in recovery and pacing calculations at high bandwidth or over long time periods.
• Fixed PTO retransmission bookkeeping so consecutive PTOs do not duplicate pending lost frames, while preserving overflow protection.
• Increased the PTO backoff cap to allow longer exponential backoff before hitting the cap.
• Fixed HTTP/3 stream cleanup when the local send side finishes before the receive side, avoiding stream state leaks.
• Late PRIORITY_UPDATE frames for closed streams are now ignored instead of recreating HTTP/3 stream state.
• Other bug fixes and performance improvements.

Full changelog at 0.29.0...0.29.1

Breaking Changes:

• Removed the openssl and boringssl-vendored features, as well as the vendored BoringSSL source. The default TLS backend is now boringssl-boring-crate.
• The minimum supported Rust version was raised to 1.88.
• Connection::stream_send_zc() no longer takes the len argument. Callers now pass the stream ID, buffer, and FIN flag.
• Stats, PathStats, and h3::Stats are now marked #[non_exhaustive], so downstream code should not construct or exhaustively match them.

Highlights:

• Added Stats::amplification_limited_count to count sends blocked by the anti-amplification limit.
• Added PathStats::dgram_lost to track lost DATAGRAM frames per path.
• Added the C API quiche_config_set_use_initial_max_data_as_flow_control_win().
• Hardened HTTP/3 request-stream frame processing, rejected unsupported push streams on both endpoints, and fixed varint parsing for PRIORITY_UPDATE and PUSH_PROMISE.
• Fixed PTO and loss-detection overflow cases that could cause panics or tight timeout loops.
• Made C FFI *_free(NULL) calls safe, and fixed a source connection ID accounting underflow during connection ID rotation.
• Config::set_ack_delay_exponent() now clamps values to RFC 9000's maximum, exposed as MAX_ACK_DELAY_EXPONENT.
• Other bug fixes and performance improvements.

Full changelog at 0.28.0...0.29.0

⚠️ The 0.27.0 release has been yanked and should not be used. The 0.28.0 release is the non-yanked replacement and contains the same quiche crate changes, with only the crate version changed from 0.27.0 to 0.28.0.

Breaking Changes:

• The zero-copy buffer APIs changed. BufFactory now includes DATAGRAM buffer support, and dgram_send_vec() / dgram_recv_vec() were replaced by Connection::dgram_send_buf() and Connection::dgram_recv_buf().
• Stats and the C quiche_stats structure gained counters for received STREAMS_BLOCKED frames.
• qlog output was updated to newer qlog drafts. Applications consuming qlog output may need parser updates for renamed HTTP/3 event types, changed time precision, ACK range serialization, wall-clock reference time, and related schema changes.

Highlights:

• Added bytes::BufMut receive APIs via Connection::stream_recv_buf() and h3::Connection::recv_body_buf().
• Added Config::set_use_initial_max_data_as_flow_control_win() to use the advertised initial max data as the initial flow-control window, avoiding pathological MAX_DATA and MAX_STREAM_DATA update behavior with large windows.
• Added the CUBIC idle-restart fix, enabled by default, with Config::set_enable_cubic_idle_restart_fix() and related handshake and C API controls.
• Added optional STREAMS_BLOCKED signaling via Config::set_enable_send_streams_blocked().
• Updated qlog output to include PTO information and align with newer QUIC and HTTP/3 qlog drafts.
• Other bug fixes and performance improvements.

Full changelog at 0.26.1...0.28.0

Highlights:

• Fixed CUBIC congestion control during application-limited periods, avoiding cases where small-cwnd packet trains could keep a connection stuck in recovery or at the minimum congestion window after loss.

Full changelog at 0.26.0...0.26.1

Breaking Changes:

• Added Error::InvalidDcidInitialization for invalid custom client destination connection ID initialization, so exhaustive matches on Error need to be updated.

Highlights:

• Added the custom-client-dcid feature, with connect_with_dcid() and connect_with_dcid_and_buffer_factory(), for clients that need to provide the initial destination connection ID. Applications using this feature must satisfy RFC 9000 requirements for destination connection ID unpredictability and length.
• Added C API support for custom client destination connection IDs via quiche_conn_new_with_tls_and_client_dcid() when the custom-client-dcid feature is enabled.
• Fixed retransmission of lost flow-control credit updates, including MAX_DATA, MAX_STREAM_DATA, and MAX_STREAMS_* frames.
• Fixed stream-cancellation retransmission so lost RESET_STREAM frames are retransmitted even after stream collection, and STOP_SENDING frames are retransmitted only while useful.
• Improved stream-limit behavior for long-lived connections by sending MAX_STREAMS updates when available stream credit drops to half of the initial limit.
• Gracefully handles DPLPMTUD probe errors instead of surfacing non-critical send failures.
• Added qlog loss metrics in MetricsUpdated.ex_data, including lost packet and byte totals and deltas.
• Other bug fixes and performance improvements.

Full changelog at 0.25.0...0.26.0

Breaking Changes:

• Connection::set_discover_pmtu_in_handshake() now takes a max_probes argument.
• The C API congestion control enum now exposes QUICHE_CC_BBR2_GCONGESTION instead of QUICHE_CC_BBR and QUICHE_CC_BBR2. The bbr and bbr2 string aliases still select the gcongestion BBR2 implementation.
• StartupExitReason gained a ConservativeSlowStartRounds variant, so exhaustive matches need to be updated.

Highlights:

• Added Config::set_pmtud_max_probes() so DPLPMTUD can tolerate multiple lost probes before treating a probe size as failed.
• Added accept_with_retry() and RetryConnectionIds, allowing servers to use a fresh connection source connection ID that is distinct from the Retry source connection ID.
• Improved qlog congestion metrics with Cloudflare-specific delivery, send, and ACK rate values in MetricsUpdated.ex_data.
• Fixed in-handshake recovery and configuration overrides so they still apply after ACK-only packets in multi-packet handshakes.
• Other bug fixes and performance improvements.

Full changelog at 0.24.9...0.25.0

Highlights:

• Added Connection::stream_discard() to discard received stream data without copying it into an application buffer.
• Updated BBR2 default parameters to behave closer to draft-ietf-ccwg-bbr-04, disabling older experiments that could hurt bandwidth estimates, high-loss behavior, and buffering.
• Other bug fixes and performance improvements.

Full changelog at 0.24.8...0.24.9

Breaking Changes:

• Connection::stream_capacity() now takes &mut self, so stopped streams can be collected after reporting Error::StreamStopped.

Highlights:

• Fixed a race where Error::StreamStopped could be lost if the peer ACKed a RESET_STREAM before the application handled writable streams.
• Added Connection::early_data_reason() to expose BoringSSL's early-data decision for logging and debugging 0-RTT behavior.
• Fixed BBR2 RTT accounting and ProbeBW upward accounting to better match the BBR draft.
• Other bug fixes and performance improvements.

Full changelog at 0.24.7...0.24.8