Bump quiche from 0.28.0 to 0.29.2 in /fuzz

[dependabot]

Bumps quiche from 0.28.0 to 0.29.2.

Release notes

Sourced from quiche's releases.

🛡️ 0.29.2

⚠️ Security:

• Fixed a use-after-free in quiche_connection_id_iter_next(), which is part of quiche's C FFI API. The iterator previously returned a pointer to a cloned connection ID whose backing storage was dropped before the caller could read it. It now returns pointers to connection IDs owned by the iterator.
• Fixed a use-after-free in quiche_conn_retired_scid_next(), which is also part of the C FFI API. The function previously returned a pointer to a retired source connection ID whose backing storage was dropped before the caller could read it. It has been replaced by quiche_conn_retired_scid_iter(), which drains retired source connection IDs into an iterator before exposing them to callers.

The C FFI API is disabled by default via the ffi feature. The normal Rust API is not affected by these issues.

Breaking changes:

• The C API function quiche_conn_retired_scid_next() was removed and replaced with quiche_conn_retired_scid_iter() to avoid returning pointers to temporary memory. Applications using quiche_conn_retired_scid_next() should call quiche_conn_retired_scid_iter(conn), iterate with quiche_connection_id_iter_next(), and release the iterator with quiche_connection_id_iter_free().

Highlights:

• Fixed stream send-buffer accounting so congestion controller app-limited detection and Stats::tx_buffered_state track the actual bytes buffered in stream send buffers. This avoids buffered byte-count drift across retransmissions, ACKs, and stream shutdown/reset paths.

Full changelog at 0.29.1...0.29.2

🩹 0.29.1

Highlights:

• Added Connection::stream_closed() to query whether a stream is fully closed.
• Fixed bandwidth arithmetic overflow in recovery and pacing calculations at high bandwidth or over long time periods.
• Fixed PTO retransmission bookkeeping so consecutive PTOs do not duplicate pending lost frames, while preserving overflow protection.
• Increased the PTO backoff cap to allow longer exponential backoff before hitting the cap.
• Fixed HTTP/3 stream cleanup when the local send side finishes before the receive side, avoiding stream state leaks.
• Late PRIORITY_UPDATE frames for closed streams are now ignored instead of recreating HTTP/3 stream state.
• Other bug fixes and performance improvements.

Full changelog at 0.29.0...0.29.1

🧱 0.29.0

Breaking Changes:

• Removed the openssl and boringssl-vendored features, as well as the vendored BoringSSL source. The default TLS backend is now boringssl-boring-crate.
• The minimum supported Rust version was raised to 1.88.
• Connection::stream_send_zc() no longer takes the len argument. Callers now pass the stream ID, buffer, and FIN flag.
• Stats, PathStats, and h3::Stats are now marked #[non_exhaustive], so downstream code should not construct or exhaustively match them.

Highlights:

• Added Stats::amplification_limited_count to count sends blocked by the anti-amplification limit.
• Added PathStats::dgram_lost to track lost DATAGRAM frames per path.
• Added the C API quiche_config_set_use_initial_max_data_as_flow_control_win().
• Hardened HTTP/3 request-stream frame processing, rejected unsupported push streams on both endpoints, and fixed varint parsing for PRIORITY_UPDATE and PUSH_PROMISE.
• Fixed PTO and loss-detection overflow cases that could cause panics or tight timeout loops.
• Made C FFI *_free(NULL) calls safe, and fixed a source connection ID accounting underflow during connection ID rotation.
• Config::set_ack_delay_exponent() now clamps values to RFC 9000's maximum, exposed as MAX_ACK_DELAY_EXPONENT.
• Other bug fixes and performance improvements.

... (truncated)

Commits

• 839b23d quiche: release 0.29.2
• f2db946 ffi: fix use-after-free in quiche_conn_retired_scid_next
• 386ad63 ffi: fix use-after-free in quiche_connection_id_iter_next
• 65a85fb Fix tx_buffered computation so it matches the sum of bytes in stream buffers ...
• 6b5a13c Remove unused imports in qlog-dancer component (#2511)
• f0c7193 quiche: release 0.29.1
• 2315431 Increase MAX_PTO_EXPONENT to 20 (#2498)
• 7dd390a Only add to lost_frames on PTO if there is indication that previous added fra...
• 1acc5ba h3: ignore priority updates for closed streams
• cbc8173 h3: clear streams when send finishes before recv
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.