Skip to content

chore(deps): bump quinn-proto from 0.11.14 to 0.11.19 - #283

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/quinn-proto-0.11.19
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/quinn-proto-0.11.19

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 9, 2026

Copy link
Copy Markdown
Contributor

Bumps quinn-proto from 0.11.14 to 0.11.19.

Release notes

Sourced from quinn-proto's releases.

quinn-proto 0.11.19

Fixes several advisories:

What's Changed

quinn-proto 0.11.18, quinn 0.11.12

Three more security issues were reported and fixed since 0.11.17:

What's Changed

quinn-proto 0.11.17

This release fixes three remote memory exhaustion issues. See GHSA-qfwj-vfxf-92j2, GHSA-2hv7-gw8g-gpq5, and GHSA-hmxj-32vh-65vr for more details, and quinn-rs/quinn#2789 for the fixes.

What's Changed

... (truncated)

Commits
  • 8192ed3 udp: bump version to 0.5.16
  • 6862d3d udp: backport receive error handling to 0.11.x
  • 78d30dc proto: bump version to 0.11.19
  • 73114d8 Check MAX_STREAM_DATA on remote bidi streams against limit
  • a6e78d1 proto: reserve close frame space after large Initial headers
  • 74c33ff proto: reject Initial tokens that prevent packet construction
  • f97fb5a quinn: Wake wait_idle when the endpoint driver is dropped
  • 8ada074 quinn-proto: Pad Initial datagrams to the configured minimum MTU
  • 16ecc70 fix: stale waker in blocked_readers
  • 12d7f07 fix: cleanup state if transmit failed
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [quinn-proto](https://github.com/quinn-rs/quinn) from 0.11.14 to 0.11.19.
- [Release notes](https://github.com/quinn-rs/quinn/releases)
- [Commits](quinn-rs/quinn@quinn-proto-0.11.14...quinn-proto-0.11.19)

---
updated-dependencies:
- dependency-name: quinn-proto
  dependency-version: 0.11.19
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner October 9, 2026 08:59
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Oct 9, 2026
@github-actions

github-actions Bot commented Oct 9, 2026

Copy link
Copy Markdown
Contributor

posthog-rs-v0 Compliance Report

Date: 2026-10-09 09:02:16 UTC
Duration: 15549ms

✅ All Tests Passed!

46/46 tests passed


Capture Tests

✅ 29/29 tests passed

View Details
Test Status Duration
Format Validation.Event Has Required Fields ✅ 135ms
Format Validation.Event Has Uuid ✅ 135ms
Format Validation.Event Has Lib Properties ✅ 147ms
Format Validation.Distinct Id Is String ✅ 145ms
Format Validation.Token Is Present ✅ 145ms
Format Validation.Custom Properties Preserved ✅ 135ms
Format Validation.Event Has Timestamp ✅ 140ms
Retry Behavior.Retries On 503 ✅ 5149ms
Retry Behavior.Does Not Retry On 400 ✅ 2145ms
Retry Behavior.Does Not Retry On 401 ✅ 2145ms
Retry Behavior.Respects Retry After Header ✅ 5109ms
Retry Behavior.Implements Backoff ✅ 15113ms
Retry Behavior.Retries On 500 ✅ 5108ms
Retry Behavior.Retries On 502 ✅ 5103ms
Retry Behavior.Retries On 504 ✅ 5100ms
Retry Behavior.Max Retries Respected ✅ 15104ms
Deduplication.Generates Unique Uuids ✅ 105ms
Deduplication.Preserves Uuid On Retry ✅ 5024ms
Deduplication.Preserves Uuid And Timestamp On Retry ✅ 10037ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry ✅ 5045ms
Deduplication.No Duplicate Events In Batch ✅ 26ms
Deduplication.Different Events Have Different Uuids ✅ 24ms
Compression.Sends Gzip When Enabled ✅ 23ms
Batch Format.Uses Proper Batch Structure ✅ 26ms
Batch Format.Flush With No Events Sends Nothing ✅ 52ms
Batch Format.Multiple Events Batched Together ✅ 131ms
Error Handling.Does Not Retry On 403 ✅ 2073ms
Error Handling.Does Not Retry On 413 ✅ 2099ms
Error Handling.Retries On 408 ✅ 5085ms

Feature_Flags Tests

✅ 17/17 tests passed

View Details
Test Status Duration
Request Payload.Request With Person Properties Device Id ✅ 68ms
Request Payload.Flags Request Uses V2 Query Param ✅ 52ms
Request Payload.Flags Request Hits Flags Path Not Decide ✅ 28ms
Request Payload.Flags Request Omits Authorization Header ✅ 29ms
Request Payload.Token In Flags Body Matches Init ✅ 27ms
Request Payload.Groups Round Trip ✅ 38ms
Request Payload.Groups Default To Empty Object ✅ 52ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False ✅ 31ms
Request Payload.Disable Geoip Omitted Defaults To False ✅ 33ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key ✅ 41ms
Request Lifecycle.No Flags Request On Init Alone ✅ 35ms
Request Lifecycle.No Flags Request On Normal Capture ✅ 55ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests ✅ 47ms
Request Lifecycle.Mock Response Value Is Returned To Caller ✅ 58ms
Retry Behavior.Retries Flags On 502 ✅ 235ms
Retry Behavior.Retries Flags On 504 ✅ 244ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event ✅ 36ms

@github-actions

github-actions Bot commented Oct 9, 2026

Copy link
Copy Markdown
Contributor

posthog-rs-v1 Compliance Report

Date: 2026-10-09 09:02:51 UTC
Duration: 23061ms

✅ All Tests Passed!

111/111 tests passed


Capture_V1 Tests

✅ 94/94 tests passed

View Details
Test Status Duration
Endpoint And Method.Targets V1 Endpoint ✅ 168ms
Endpoint And Method.Does Not Use Legacy Endpoints ✅ 167ms
Required Headers.Has Authorization Bearer Header ✅ 150ms
Required Headers.Has Content Type Json ✅ 166ms
Required Headers.Has Posthog Sdk Info Format ✅ 166ms
Required Headers.Has Posthog Attempt Header ✅ 162ms
Required Headers.Has Posthog Request Id ✅ 163ms
Required Headers.Has Posthog Request Timestamp ✅ 163ms
Required Headers.Has User Agent ✅ 158ms
Body Format.Body Has Created At And Batch ✅ 160ms
Body Format.No Api Key In Body ✅ 135ms
Body Format.No Sent At In Body ✅ 138ms
Event Format.Event Has Required Root Fields ✅ 136ms
Event Format.Event Uuid Is Valid ✅ 136ms
Event Format.Event Timestamp Is Rfc3339 ✅ 136ms
Event Format.Distinct Id Is String ✅ 137ms
Event Format.Distinct Id At Root Not Properties ✅ 132ms
Event Format.Custom Properties Preserved ✅ 134ms
Event Format.Set Properties Preserved ✅ 134ms
Event Format.Set Once Properties Preserved ✅ 138ms
Event Format.Groups Properties Preserved ✅ 130ms
Event Format.Sdk Generates Uuid If Not Provided ✅ 117ms
Event Format.Event Has Required Root Fields Batch ✅ 149ms
Event Format.Event Uuid Is Valid Batch ✅ 168ms
Event Format.Event Timestamp Is Rfc3339 Batch ✅ 146ms
Event Format.Distinct Id Is String Batch ✅ 167ms
Event Format.Distinct Id At Root Not Properties Batch ✅ 168ms
Event Format.Custom Properties Preserved Batch ✅ 167ms
Event Format.Set Properties Preserved Batch ✅ 174ms
Event Format.Set Once Properties Preserved Batch ✅ 161ms
Event Format.Groups Properties Preserved Batch ✅ 172ms
Event Format.Sdk Generates Uuid If Not Provided Batch ✅ 129ms
Batch Behavior.Multiple Events In Single Batch ✅ 225ms
Batch Behavior.Batch Envelope Smoke ✅ 181ms
Batch Behavior.Flush With No Events Sends Nothing ✅ 121ms
Batch Behavior.Flush At Triggers Batch ✅ 1152ms
Batch Behavior.Created At Reflects Batch Creation Time ✅ 140ms
Deduplication.Generates Unique Uuids ✅ 217ms
Deduplication.Different Events Same Content Different Uuids ✅ 147ms
Deduplication.Preserves Uuid On Retry ✅ 5142ms
Deduplication.Preserves Timestamp On Retry ✅ 5103ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry ✅ 5116ms
Deduplication.No Duplicate Events In Batch ✅ 122ms
Header Behavior On Retry.Attempt Header Starts At One ✅ 83ms
Header Behavior On Retry.Attempt Header Increments On Retry ✅ 10092ms
Header Behavior On Retry.Request Id Preserved On Retry ✅ 5065ms
Header Behavior On Retry.Different Requests Have Different Request Ids ✅ 2067ms
Header Behavior On Retry.Request Timestamp Changes On Retry ✅ 5050ms
Response Format Validation.Success Response Has Uuid Keyed Results ✅ 56ms
Response Format Validation.Success Response Has Ok For Each Event ✅ 58ms
Response Format Validation.Success No Retry After When All Ok ✅ 29ms
Response Format Validation.Success Retry After Present When Retry Events ✅ 36ms
Response Format Validation.Success No Retry After When Drop Only ✅ 38ms
Response Format Validation.Response Echoes Request Id ✅ 30ms
Retry Behavior.Retries On 408 ✅ 5033ms
Retry Behavior.Retries On 500 ✅ 5028ms
Retry Behavior.Retries On 503 ✅ 5026ms
Retry Behavior.Retries On 504 ✅ 5025ms
Retry Behavior.Retryable Errors Have Retry After ✅ 2027ms
Retry Behavior.Respects Retry After On Retryable Error ✅ 8025ms
Retry Behavior.Does Not Retry On 400 ✅ 2034ms
Retry Behavior.Does Not Retry On 401 ✅ 2031ms
Retry Behavior.Does Not Retry On 402 ✅ 2024ms
Retry Behavior.Does Not Retry On 413 ✅ 2033ms
Retry Behavior.Does Not Retry On 415 ✅ 2028ms
Retry Behavior.Non Retryable Errors Have No Retry After ✅ 2025ms
Retry Behavior.Implements Backoff ✅ 15032ms
Retry Behavior.Max Retries Respected ✅ 15029ms
Partial Batch Handling.Handles 200 Full Success ✅ 2036ms
Partial Batch Handling.Handles 200 With All Ok ✅ 3040ms
Partial Batch Handling.Does Not Retry Dropped Events ✅ 3041ms
Partial Batch Handling.Does Not Retry Limited Events ✅ 3032ms
Partial Batch Handling.Prunes Ok Events On Partial Retry ✅ 5034ms
Partial Batch Handling.Prunes Dropped Events On Partial Retry ✅ 5027ms
Partial Batch Handling.Retries Only Retry Events From Partial ✅ 5029ms
Partial Batch Handling.Partial Retry Preserves Uuids ✅ 5027ms
Partial Batch Handling.Partial Retry Attempt Header Increments ✅ 5032ms
Partial Batch Handling.Partial Retry Request Id Preserved ✅ 5038ms
Partial Batch Handling.Respects Retry After On Partial ✅ 5026ms
Partial Batch Handling.Unknown Result Treated As Terminal ✅ 3026ms
Partial Batch Handling.Mixed Ok Drop Limited No Retry ✅ 3029ms
Compression.Sends Gzip Content Encoding ✅ 25ms
Compression.No Content Encoding When Disabled ✅ 24ms
Compression.Compressed Body Is Decompressible ✅ 24ms
Error Handling.Does Not Retry On Unknown 4Xx ✅ 2024ms
Event Options.Cookieless Mode Override ✅ 25ms
Event Options.Disable Skew Correction Override ✅ 23ms
Event Options.Process Person Profile Override ✅ 24ms
Event Options.Product Tour Id Override ✅ 23ms
Event Options.Unset Options Omitted ✅ 24ms
Event Options.Options Override In Batch ✅ 25ms
Geoip And Historical Migration.Geoip Disable Injected Into Properties ✅ 23ms
Geoip And Historical Migration.Historical Migration Set In Body ✅ 24ms
Geoip And Historical Migration.Historical Migration Absent By Default ✅ 24ms

Feature_Flags Tests

✅ 17/17 tests passed

View Details
Test Status Duration
Request Payload.Request With Person Properties Device Id ✅ 16ms
Request Payload.Flags Request Uses V2 Query Param ✅ 18ms
Request Payload.Flags Request Hits Flags Path Not Decide ✅ 18ms
Request Payload.Flags Request Omits Authorization Header ✅ 15ms
Request Payload.Token In Flags Body Matches Init ✅ 15ms
Request Payload.Groups Round Trip ✅ 16ms
Request Payload.Groups Default To Empty Object ✅ 15ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False ✅ 16ms
Request Payload.Disable Geoip Omitted Defaults To False ✅ 17ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key ✅ 19ms
Request Lifecycle.No Flags Request On Init Alone ✅ 14ms
Request Lifecycle.No Flags Request On Normal Capture ✅ 24ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests ✅ 19ms
Request Lifecycle.Mock Response Value Is Returned To Caller ✅ 16ms
Retry Behavior.Retries Flags On 502 ✅ 221ms
Retry Behavior.Retries Flags On 504 ✅ 221ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event ✅ 27ms

@ioannisj

Copy link
Copy Markdown
Contributor

Closing this one. quinn-proto 0.11.15+ needs Rust 1.85, and so does the rand 0.10 / getrandom 0.4 family it pulls in (edition 2024). posthog-rs still supports 1.78, so both MSRV checks fail while parsing rand_core 0.10.1. Same reason the sha1 0.11 bumps were closed in #211, #214 and #217.

The advisories fixed in this range don't apply to the SDK. quinn is only in Cargo.lock because of reqwest's optional http3 feature, which we never enable, so it doesn't get compiled under any feature set.

We can pick this up if we ever raise the MSRV or start using HTTP/3.

@ioannisj ioannisj closed this Oct 12, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 12, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/cargo/quinn-proto-0.11.19 branch October 12, 2026 17:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant