Fixes several advisories:

• MAX_STREAM_DATA frame opens streams over the stream limit
• Retry packet with a long token panics or exhausts client memory

• 0.11.x updates by @djc in https://github.com/quinn-rs/quinn/pull/2882
• backport: fix: make handshake_data cancellation-safe by @robertkiel in https://github.com/quinn-rs/quinn/pull/2881
• backport: fix: potential CID leak in connect() by @robertkiel in https://github.com/quinn-rs/quinn/pull/2878
• backport: fix: cleanup state if transmit failed by @robertkiel in https://github.com/quinn-rs/quinn/pull/2879
• backport: fix: stale waker in blocked_readers by @robertkiel in https://github.com/quinn-rs/quinn/pull/2880
• quinn-proto: Pad Initial datagrams to the configured minimum MTU (0.11) by @idevelop in https://github.com/quinn-rs/quinn/pull/2894
• [0.11.x] quinn: Wake wait_idle when the endpoint driver is dropped by @njaremko in https://github.com/quinn-rs/quinn/pull/2902
• Prepare 0.11.19 by @djc in https://github.com/quinn-rs/quinn/pull/2905

• Prepare 0.11.19 by @djc in https://github.com/quinn-rs/quinn/pull/2905

• udp: fix cmsg provenance by @djc in https://github.com/quinn-rs/quinn/pull/2876
• udp: handle receive errors before truncation flags by @djc in https://github.com/quinn-rs/quinn/pull/2906

Three more security issues were reported and fixed since 0.11.17:

• https://github.com/quinn-rs/quinn/security/advisories/GHSA-465w-v9q3-7j98: a remote peer can panic unordered reads from quinn-proto with five small STREAM frames
• https://github.com/quinn-rs/quinn/security/advisories/GHSA-ppcp-v39w-8jq2: Datagrams::send() double-subtracts payload_bytes on the drop-oldest path, panicking the sender
• https://github.com/quinn-rs/quinn/security/advisories/GHSA-3g6h-r5qx-f6hq: Peer minimum ACK delay can panic when ACK_FREQUENCY transmission is enabled

• 0.11.x: backport the black hole detector fixes by @vcarus in https://github.com/quinn-rs/quinn/pull/2799
• 0.11.x: fix payload_bytes double subtraction when evicting outgoing datagrams by @vcarus in https://github.com/quinn-rs/quinn/pull/2806
• 0.11.x: Backport #2816 (add min rtt to path stats) by @somtochiama in https://github.com/quinn-rs/quinn/pull/2817
• 0.11.x: Bundle ACK in packets with DATAGRAM or STREAM frames by @anatawa12 in https://github.com/quinn-rs/quinn/pull/2819
• quinn-proto: drop short packets with unsupported versions (0.11.x) by @vcarus in https://github.com/quinn-rs/quinn/pull/2823
• 0.11.x: backport: Avoid re-instantiating debug span in ConnectionDriver::poll by @stormshield-fabs in https://github.com/quinn-rs/quinn/pull/2829
• 0.11.x: backport #2814 (proto: coalesce contiguous chunks during defragment) by @Ralith in https://github.com/quinn-rs/quinn/pull/2826
• [0.11.x] proto: release the send window when rejecting 0-RTT by @zerox80 in https://github.com/quinn-rs/quinn/pull/2843
• [0.11.x] Reject DATAGRAMs larger than the send buffer by @zerox80 in https://github.com/quinn-rs/quinn/pull/2844
• 0.11.x: backport #2847 (proto: send DATA_BLOCKED and STREAM_DATA_BLOCKED when blocked by flow control) by @heitzlki in https://github.com/quinn-rs/quinn/pull/2852
• [0.11.x] proto: reset pacing state when resetting a path by @zerox80 in https://github.com/quinn-rs/quinn/pull/2850
• [0.11.x] proto: avoid duplicate flow-control credit for stopped streams by @zerox80 in https://github.com/quinn-rs/quinn/pull/2848
• [0.11.x] proto: prune queued DATAGRAMs after path MTU changes by @zerox80 in https://github.com/quinn-rs/quinn/pull/2849
• [0.11.x] proto: preserve the server config for pending incoming connections by @zerox80 in https://github.com/quinn-rs/quinn/pull/2865
• [0.11.x] proto: reject transport parameters with a mismatched length by @MaxFreedomPollard in https://github.com/quinn-rs/quinn/pull/2866
• [0.11.x] quinn: enforce read_to_end limits for reordered chunks by @zerox80 in https://github.com/quinn-rs/quinn/pull/2864
• [0.11.x] streams: bound retained send storage by the send window by @zerox80 in https://github.com/quinn-rs/quinn/pull/2863
• Prepare 0.11.18 by @djc in https://github.com/quinn-rs/quinn/pull/2867

• fix: Patches for Redox targets by @willnode in https://github.com/quinn-rs/quinn/pull/2659
• feat(udp): add support for IP_RECVERR and IPV6_RECVERR (Linux/Android) by @syszery in https://github.com/quinn-rs/quinn/pull/2646
• feat: implement kernel receive timestamps on Linux/Android by @syszery in https://github.com/quinn-rs/quinn/pull/2634
• quinn-udp: handle EIO from sendmsg in the cmsg fallback (not just EINVAL) by @SkeletonGamer in https://github.com/quinn-rs/quinn/pull/2719
• fix(quinn-udp): avoid permanent EWOULDBLOCK from macOS sendmsg bug by @larseggert in https://github.com/quinn-rs/quinn/pull/2727
• Ignore EMSGSIZE error triggered by ICMP Frag Needed (Path To Big) by @zoltanszatmary in https://github.com/quinn-rs/quinn/pull/2736
• Fix quinn-udp compile errors and assertions on musl by @thomaseizinger in https://github.com/quinn-rs/quinn/pull/2750
• chore(udp): deprecate UdpSocketState::send by @thomaseizinger in https://github.com/quinn-rs/quinn/pull/2779
• Add GNU/Hurd support by @sthibaul in https://github.com/quinn-rs/quinn/pull/2807
• feat(udp): make transport error reception opt-in on Linux/Android by @syszery in https://github.com/quinn-rs/quinn/pull/2765
• quinn-udp: support wasm32-wasip2 and remove the fallback backend by @temporaryfix in https://github.com/quinn-rs/quinn/pull/2755
• fix(windows): disable USO after probing for GSO support by @shitz in https://github.com/quinn-rs/quinn/pull/2824
• fix(udp): don't panic in UdpSocketState::new on unbound socket by @thomaseizinger in https://github.com/quinn-rs/quinn/pull/2821
• fix: resolve WSARecvMsg per socket by @larseggert in https://github.com/quinn-rs/quinn/pull/2825

Note that the minimum supported Rust version rose from 1.80.0 to 1.88.0 in this release, via https://github.com/quinn-rs/quinn/pull/2599, https://github.com/quinn-rs/quinn/pull/2602 and https://github.com/quinn-rs/quinn/pull/2669.

• @willnode made their first contribution in https://github.com/quinn-rs/quinn/pull/2659
• @SkeletonGamer made their first contribution in https://github.com/quinn-rs/quinn/pull/2719
• @sthibaul made their first contribution in https://github.com/quinn-rs/quinn/pull/2807
• @temporaryfix made their first contribution in https://github.com/quinn-rs/quinn/pull/2755
• @shitz made their first contribution in https://github.com/quinn-rs/quinn/pull/2824

Full Changelog: https://github.com/quinn-rs/quinn/compare/quinn-udp-0.6.1...quinn-udp-0.6.2

This release fixes three remote memory exhaustion issues. See GHSA-qfwj-vfxf-92j2, GHSA-2hv7-gw8g-gpq5, and GHSA-hmxj-32vh-65vr for more details, and https://github.com/quinn-rs/quinn/pull/2789 for the fixes.

• fix(ci): fix clippy lints by @LesnyRumcajs in https://github.com/quinn-rs/quinn/pull/2752
• congestion: saturate CUBIC window increment to avoid overflow by @LesnyRumcajs in https://github.com/quinn-rs/quinn/pull/2751
• 0.11.x: Backport memory use fixes and prepare release by @Ralith in https://github.com/quinn-rs/quinn/pull/2790

Full Changelog: https://github.com/quinn-rs/quinn/compare/quinn-proto-0.11.16...quinn-proto-0.11.17

• 0.11.x: upgrade dependencies by @djc in https://github.com/quinn-rs/quinn/pull/2707

• quinn-udp: allow to use windows-sys 0.61 in 0.11.x branch by @zh-jq in https://github.com/quinn-rs/quinn/pull/2689
• 0.11.x: upgrade dependencies by @djc in https://github.com/quinn-rs/quinn/pull/2707

This release fixes a remote memory exhaustion issue in the quinn-proto Assembler. See https://github.com/quinn-rs/quinn/security/advisories/GHSA-4w2j-m93h-cj5j for more details and #2694 for the fix.

Two sponsoring organizations participated in coordinated disclosure. If this is relevant to your organization, please contact us to keep support Quinn maintenance.

• Prepare 0.11.x branch for release by @djc in https://github.com/quinn-rs/quinn/pull/2645
• Backport of #2495 to 0.11.x by @stablebits in https://github.com/quinn-rs/quinn/pull/2674
• 0.11.x backport | quinn-proto: drop Initials silently when saturated by @stablebits in https://github.com/quinn-rs/quinn/pull/2688
• Backport #2677 to 0.11.x by @syszery in https://github.com/quinn-rs/quinn/pull/2690
• congestion: avoid double-reducing CUBIC fast convergence (0.11.x) by @0xdeafbeef in https://github.com/quinn-rs/quinn/pull/2641
• proto: yield error on too many gaps in assembler by @djc in https://github.com/quinn-rs/quinn/pull/2694

• fix: reuse existing socket for probing GRO/GSO support by @thomaseizinger in https://github.com/quinn-rs/quinn/pull/2565
• refactor(quinn-udp): add retry_if_interrupted helper by @larseggert in https://github.com/quinn-rs/quinn/pull/2583
• fix(unix): disable GSO after probing by @thomaseizinger in https://github.com/quinn-rs/quinn/pull/2584
• fix: Resolve sendmsg_x/recvmsg_x via dlsym by @larseggert in https://github.com/quinn-rs/quinn/pull/2571
• chore: bump quinn-udp to 0.6.1 by @larseggert in https://github.com/quinn-rs/quinn/pull/2586