Update rebar.config deps

[renovate]

This PR contains the following updates:

Package	Update	Change
cowboy (source)	minor	2.15.0 → 2.18.0
quic (source)	minor	1.6.1 → 1.8.0

---

Release Notes

ninenines/cowboy (cowboy)

v2.18.0

Compare Source

v2.17.0

Compare Source

v2.16.1

Compare Source

v2.16.0

Compare Source

benoitc/erlang_quic (quic)

v1.8.0

Compare Source

Fixed

• The client hostname check applies the RFC 6125 HTTPS rules, so a wildcard SAN such as *.example.com matches host.example.com. Servers behind a wildcard-only certificate, www.google.com among them, were rejected as {hostname_mismatch, _}. (#​188)
• A Happy Eyeballs winner hands its owner the events it delivered before reporting connected. A server that sends its HTTP/3 SETTINGS in the same flight as the handshake had them dropped, so quic_h3:connect/3 timed out for a multi-address host. (#​188)
• A client that receives a Retry keeps counting Initial packet numbers up (RFC 9000 §17.2.5.3) instead of restarting at 0, so the retried Initial is not a replay of the packet the Retry answered. The pre-Retry Initials leave loss detection instead of staying charged as bytes in flight.
• A client acts on a Version Negotiation packet (RFC 9000 §6.2) instead of misparsing and dropping it: no shared version closes the connection as {version_negotiation, Versions}, and a packet that arrives late, carries a foreign connection ID, or offers back our own version is discarded.
• The advertised max_udp_payload_size is what we are willing to receive rather than the PMTU probing ceiling: the max_udp_payload_size option when set, otherwise 1472 over IPv4 and 1452 over IPv6. Both roles used to advertise 1500, which does not fit a 1500-byte path. (#​184)

Changed

• A handshake failure reaches the owner as {quic, Conn, {error, Reason}}, tagged with the connection handle like every other owner event; the connection reference used to be the tag and nothing matched it. quic_h3:connect/3 passes the reason through, so a rejected certificate returns {error, {certificate_invalid, _}} rather than {error, connect_timeout}, and an exhausted Happy Eyeballs race returns the last attempt's reason rather than all_attempts_failed. Owners matching {quic, ConnRef, {error, _}} must match the handle instead.

v1.7.1

Compare Source

Fixed

• An HTTP/3 connection process now stops with normal when the underlying QUIC connection closes cleanly (graceful drain, idle timeout, shutdown), instead of the abnormal reason quic_closed. Clean closes no longer emit ERROR and CRASH reports or kill non-trapping linked owners; an abnormal QUIC exit still stops the H3 process, now as {quic_closed, Reason}. The owner also receives the {quic_h3, Conn, closed} notification on this path, which was previously skipped. (#​186)

v1.7.0

Compare Source

Added

• Stateless reset on restart (RFC 9000 §10.3). A server advertises a stateless_reset_token transport parameter bound to its initial connection ID and, after losing connection state (for example a restart), replies to an unroutable 1-RTT packet with a stateless reset derived from the same secret. A client stores the advertised token and recognises the reset, tearing the dead connection down promptly instead of waiting for its idle timer. Contributed by sstrollo (#​177).
• require_client_cert server option for mutual TLS. With verify => true the server requests a client certificate and validates any presented chain against cacerts; require_client_cert => true additionally rejects a client that sends no certificate (certificate_required), making mutual TLS mandatory. Contributed by sstrollo (#​178).

Security

• The server now validates the client certificate chain in mutual TLS. With verify => true a presented client certificate is checked against the configured trust anchors (cacerts, OS store by default) in addition to the CertificateVerify signature, so a self-signed or otherwise untrusted certificate is rejected instead of accepted. An empty client certificate is still accepted by default (optional mTLS, RFC 8446 §4.4.2.4); set require_client_cert => true to require one. Contributed by sstrollo (#​178).

Fixed

• HTTP/3 client connections close cleanly on an invalid peer SETTINGS frame instead of crashing the connection process. A SETTINGS violation (for example SETTINGS_H3_DATAGRAM advertised without the QUIC max_datagram_frame_size transport parameter) is reported to the owner as {error, 265, _} (H3_SETTINGS_ERROR) and the connection closes, rather than the state machine terminating with bad_return_from_state_function and taking the owner's request down. (#​172)
• The connection idle timer is driven by received activity (RFC 9000 §10.1): it restarts on every received packet and on the first ack-eliciting packet sent since the last receive, but not on subsequent sends. A connection sending keep-alive PINGs or PTO retransmits into a black hole now idle-closes instead of holding its own timer open forever, while a reactivated idle connection is not closed before its first ack returns. Contributed by sstrollo (#​174).
• Connection-level MAX_DATA slides forward with received bytes instead of capping the absolute limit at the receive window, so a sustained transfer no longer stalls permanently once the connection has received fc_max_receive_window (8 MiB) bytes in total. Contributed by sstrollo (#​176), reported independently by maslowalex (#​173).

Changed

• Per-packet routing traces in the listener are logged at debug instead of info, so a busy or post-restart listener no longer floods the log. Contributed by sstrollo (#​175).

v1.6.5

Compare Source

Added

• quic_h3:respond/5 sends an HTTP/3 response status, headers and full body with end-stream in a single connection call, coalescing what previously took send_response/4 plus send_data/4. HEAD, 204 and 304 responses send no body.
• quic:start_server/3 accepts a sni_callback that selects the server certificate and key per connection from the ClientHello SNI (RFC 6066 §3), so an HTTP/3 listener can present different certificates per hostname. The callback is invoked with the parsed server_name and returns {ok, #{cert => Cert, key => Key, cert_chain => Chain}} or {error, _}; an error, malformed result or raised exception fails the handshake with a handshake_failure alert. The static cert/key remain the default when no callback is set.

v1.6.4

Compare Source

Changed

• HTTP/3 no longer accumulates received DATA payloads in the stream record. Data still reaches owners and handlers through the existing delivery path, while Content-Length and unbounded-body limits are enforced from a byte counter. The #h3_stream.body field is retained for compatibility but is no longer populated.

v1.6.3

Compare Source

Added

• quic:safe_close/1,2,3 closes a connection and ignores any error if it is already gone, for teardown paths that must not crash.

Fixed

• HTTP/3 connection errors now send a CONNECTION_CLOSE. handle_connection_error passed the error reason straight to quic:close/3, but several call sites supply a non-binary reason, which failed the function's binary guard and was swallowed by a surrounding catch, so the connection was left open. The reason is now coerced to a binary phrase.

Changed

• Replaced the deprecated bare catch expressions in the library and test suites with try ... catch, clearing the OTP 27+ compiler warnings. CI now runs the unit tests on OTP 26, 27, 28 and 29 (the matrix previously collapsed to one OTP version per OS).

v1.6.2

Compare Source

Fixed

• Happy Eyeballs + HTTP/3: a client connecting to a hostname that resolves to more than one address (so the race path runs) could hang in quic_h3:connect/3 until connect_timeout. The QUIC connection completes its handshake while owned by the race coordinator, so the server's HTTP/3 control stream and SETTINGS were delivered to the transient owner and dropped before the H3 connection process existed. set_owner re-delivers {connected} but not that already-arrived stream data; the race coordinator and quic_h3:connect/3 now forward the buffered {quic, Conn, _} backlog to the new owner at each ownership handoff. Diagnosed and originally fixed by ycastorium (#​160, #​161).
• Server certificate validation recovers from an expired cross-signed root. When the served chain anchors at an expired cross-signed root (Let's Encrypt ISRG Root X2 cross-signed by the now-expired ISRG Root X1) and the trust store holds a still-valid root with the same public key, the client retries the alternative trust anchors instead of failing with cert_expired. A genuinely expired leaf or intermediate still fails.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.