commit 6a22a4d7a111f6b52391910e40ad3681a09cfb9c
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-11-02
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-11-02

    Bump package and library versions

commit 520569b3941c67671cf9a49a4417347e3d381ceb
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-11-02
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-11-02

    Update AUTHORS

commit 7e8c8af74fe5cae4c33b0c0b48f33cd9bd8061ac
Merge: a08611c0 91344a96
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-11-02
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-11-02

    Merge pull request #2403 from ngtcp2/gha-remove-macos-15
    
    GHA: Remove macos-15

commit 91344a96fbffb4b84b98f5c8a966f49e48b0d80b
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-11-02
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-11-02

    GHA: Remove macos-15

commit a08611c06a2a5c564fc539fee87fa3bef8009a96
Merge: b7dd8906 b7993be0
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-11-01
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-11-01

    Merge pull request #2402 from ngtcp2/deal-with-if_indextoname-failure
    
    examples: Deal with if_indextoname failure

commit b7993be0496b7c7c92605727ab468a60fbcf320f
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-11-01
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-11-01

    examples: Deal with if_indextoname failure

commit b7dd890633803272c298620e55d2a52bd12a84c9
Merge: dcc02866 0176e583
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-11-01
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-11-01

    Merge pull request #2400 from TheClockTwister/main
    
    Fix heap overruns when malloc is only 4-byte aligned (like on ESP32)

commit dcc028661b4de096f8b43763324df2a50c2dc027
Merge: d7a8f9bd 6d7f8f57
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-11-01
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-11-01

    Merge pull request #2401 from ngtcp2/bump-tls-deps
    
    Bump tls deps

commit 6d7f8f5715c4d686cf1dbeb7325ea84b610f70f2
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-11-01
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-11-01

    Disable picotls-ossl resume and earlydata tests

commit 4ba419a82c64a445663736f4e796e1c523c067ee
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-11-01
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-11-01

    Deal with the TLS stacks that emit 0RTT key more than once

commit 0176e5839eb8ff1c2d139cce2d01070761daff8d
Author:     TheClockTwister <wiesen.leon@gmail.com>
AuthorDate: 2026-10-31
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-31

    balloc: reserve enough space to align the first object
    
    ngtcp2_balloc_get() reserves 8 bytes to align the objects of a block
    to 16 bytes.  This is only enough if malloc returns 8-byte aligned
    memory.  With a 4-byte aligned allocator, the objects can start 12
    bytes after the header, and the last object overruns the allocation
    by 4 bytes.

commit b10bd7dd4d073ae5c34764ea44c8d2ca3fcadaa9
Author:     TheClockTwister <wiesen.leon@gmail.com>
AuthorDate: 2026-10-31
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-31

    fix heap overrun in conn_new when malloc is only 4-byte aligned

commit 1f6b76e61e58dd08905cf25a7aac1a322b90a4d9
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-31
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-31

    Fix build error with picotls

commit d3de1f03b49e6b2904f1943b46ab3bab0f65f957
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-31
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-31

    Bump wolfssl to v5.9.4-stable

commit 3959573eede054ca57080b8eb6bc48aa5b0e844d
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-31
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-31

    Bump picotls

commit 1d9484342cc28abc42cca1638e2177c09182ffdc
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-31
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-31

    Bump aws-lc to v5.12.0

commit ab0f12e0ae6591a81af6aa7a706cc66ba9cd0626
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-31
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-31

    Bump boringssl

commit d7a8f9bd8c10e3c586b255aba181b98851ad18a1
Merge: ddb4e893 38c5de04
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-31
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-31

    Merge pull request #2397 from ngtcp2/simplify-map-insertion
    
    Simplify map insert

commit 38c5de04e7c40b43fd87a637a4e5c692bf15211c
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-31
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-31

    Simplify map insert

commit ddb4e8934fe6a34abd619136704bf17cfc6a6996
Merge: acf20f81 e520e684
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-31
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-31

    Merge pull request #2396 from ngtcp2/stop-path-validation-upfront
    
    Stop the path validation upfront

commit e520e684165cc26cf97dc89486bd13331620ab52
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-30
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-30

    Stop the path validation upfront
    
    Stop the path validation upfront which makes the state back to the
    previous state.

commit acf20f81dc6afa6306a23bff452494b6eb886e2c
Merge: 96169df5 90e2eee7
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-29
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-29

    Merge pull request #2395 from ngtcp2/fix-vec-merge
    
    Fix ngtcp2_vec_merge

commit 90e2eee70b0efc4b0680da38ac8fc189776e344e
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-29
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-29

    Fix ngtcp2_vec_merge

commit 96169df561b7453c7ff9a7d87fdd5ca4225ceb88
Merge: 1095bfe0 f96b3560
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-29
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-29

    Merge pull request #2394 from ngtcp2/write-stream-data-thresh
    
    Write stream data thresh

commit f96b3560683e921bdccf16d6405acc12d3cb6e50
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-29
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-29

    examples/server: Add write-stream-data-thresh option

commit a2693adc1b193616eae6cd56d21a35b7cd3a7a2a
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-29

    Introduce ngtcp2_settings.write_stream_data_thresh

commit 1095bfe05729348979506e23f078383ce1788ee7
Merge: 4a3e4db3 9cf58000
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2393 from ngtcp2/remove-problematic-glitch-counter
    
    Remove problematic glitch counter for some frames

commit 9cf5800091fb66a703227e3cab6982d5c08ef040
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    Remove problematic glitch counter for some frames

commit 4a3e4db3fc4b2d81b546cdd8fc1fcf5366d6f78e
Merge: bc003578 7be28b21
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2392 from ngtcp2/deal-with-nomem-after-getting-conn-id
    
    Deal with out of memory after getting Connection ID

commit 7be28b2174c9034b0ad797d3b66f6c5f4d98d6ef
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    Deal with out of memory after getting Connection ID
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-XK7VSMXB

commit bc0035782af7f95a8a543dabc6306f266dd6721f
Merge: d4df37a6 76aa253f
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2391 from ngtcp2/fix-qlog-padding-only-frame
    
    Fix invalid qlog with PADDING only packet

commit 76aa253f1022cfa8c2aa5e6d691672853a161e29
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    Fix invalid qlog with PADDING only packet
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-UBFKEVDG

commit d4df37a68d9a08c7d5ef7f035acb22c84abadc6b
Merge: ae13aad6 88fb9a06
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2390 from ngtcp2/revert-count-empty-stream-frame-glitch
    
    Revert "Count empty STREAM frame toward glitch counter"

commit 88fb9a068481fccfd4ede5b5044e89a0827b8a35
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    Revert "Count empty STREAM frame toward glitch counter"
    
    This reverts commit 051e1aec8e3f143bcee7e17e2b02c709b2d6bbba.

commit ae13aad644ce852d4dc85ec3577488716e90e39c
Merge: 4653e8e0 e21be2c8
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2389 from ngtcp2/send-ctrl-frames-0rtt
    
    Send the control frames in 0RTT

commit e21be2c859343eaa75c19626864b238cffeb0bf8
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    Send the control frames in 0RTT
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-RC8APQ16

commit 4653e8e09c7274354879250e4caa527779ad8e45
Merge: adb200e5 9a933c85
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2388 from ngtcp2/zero-rtt-not-discarded-with-callback
    
    Fix 0RTT key not discarded with callback

commit 9a933c8572e72a8e4990970d41c54f74097309a4
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    Fix 0RTT key not discarded with callback
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-P30ZH6G2

commit adb200e57fe0838425ae50a4da3813d89bdf890e
Merge: d3823921 a4cb5868
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2387 from ngtcp2/hqclient-remove-stream-on-close
    
    hqclient: Remove streams on close

commit a4cb586805ff8f23e2a026802588c719d7a983c1
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    hqclient: Remove streams on close
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-NAGRGHO5

commit d3823921f21c2053de4d4f2f9fd7268179d9d8a9
Merge: 8e040bae bd9bfb7f
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2386 from ngtcp2/ossl-guard-tx_level
    
    crypto/ossl: Guard tx_level from 0RTT as well

commit bd9bfb7fa12a37cfcf36494e38fd8e4d0612d141
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    crypto/ossl: Guard tx_level from 0RTT as well
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-M8VQKOLA

commit 8e040baea59cbeed00948c0ff8ba7482edda7b44
Merge: f5df6957 aa5d59f4
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2385 from ngtcp2/fix-lost-datagram-not-called
    
    Fix bug that lost_datagram is not called

commit aa5d59f42b574b92fc1060f1db7288842ab13976
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    Fix bug that lost_datagram is not called
    
    Discovered by Anthropic's OSS Scanner:  ANT-2026-M5QC6QOO

commit f5df69578fdf39144c01354363f6de33f986412e
Merge: be6eb7bf 4e1a29ea
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2384 from ngtcp2/leave-pto-eliciting-flag
    
    Do not clear PTO eliciting flag

commit 4e1a29ea201b4c065c45329c1c2b290fc0c8bcc0
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    Do not clear PTO eliciting flag
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-L7U6UXML

commit be6eb7bfbb57eb8f30103a935e8a035608dc4695
Merge: af9a8ccb 051e1aec
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2383 from ngtcp2/count-empty-stream-frame-glitch
    
    Count empty STREAM frame toward glitch counter

commit 051e1aec8e3f143bcee7e17e2b02c709b2d6bbba
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    Count empty STREAM frame toward glitch counter
    
    ADiscovered by Anthropic's OSS Scanner: NT-2026-F7HO8HSL

commit af9a8ccbca9a51f842cf57e25f1f2524c834b3e2
Merge: e7c7305a bad97a2e
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2382 from ngtcp2/ppe-ensure-frame
    
    Ensure at least 1 byte frame is allocated on encoding

commit bad97a2e2bd451a352b1c8a7f51868de34d8f3a6
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    Ensure at least 1 byte frame is allocated on encoding
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-ERANASWP

commit e7c7305a18becf7c12214f6d95a4c4a6c9705901
Merge: d51f6668 28090a2d
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2381 from ngtcp2/paddr-before-05rtt-pkts
    
    Install preferred address before reading server 0.5RTT packets

commit 28090a2db4430d5a0825aeed6a015f2ed6ff9228
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    Install preferred address before reading server 0.5RTT packets
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-DBVEWBTA

commit d51f6668b625d135be9c8f3c5219274ec55e6041
Merge: 8603acdc ac6fcf38
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2380 from ngtcp2/server-fix-handler-leak
    
    examples/server Fix handler leak

commit ac6fcf381705ab9445a3c7f6f511d8e0af3c16c6
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    examples/server Fix handler leak
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-AJ14IDN8

commit 8603acdc1ed3dc99754d3f319914f5ba38f3eab4
Merge: 6784fdd6 3ee1e2ff
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2379 from ngtcp2/count-decryption-failrue
    
    Count decryption failures for Handshake and 0RTT keys

commit 3ee1e2ff83533479449304d76b4f1f294be71c3a
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    Count decryption failures for Handshake and 0RTT keys
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-A1W5N1DQ

commit 6784fdd61aeeee1ff8eebfd5b8a4d1b1d9da493f
Merge: a2db7d6c e5b80423
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2378 from ngtcp2/fix-mem-leak
    
    Fix memory leak

commit e5b804230851ede606c7d7aa73b8229c08b63dd7
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    Fix memory leak
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-8UH2DDQ4

commit a2db7d6c976464150a0a85a67441db165c70cd37
Merge: 9b39a5bd c18068e5
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2377 from ngtcp2/tweak-key-update-confirmation
    
    Tweak key update confirmation

commit c18068e5be32698d41c916143be4eb25000c2d57
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    Tweak key update confirmation
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-4Z7DSYYU

commit 9b39a5bd3e32d92943b14c334665963a5aaf59b9
Merge: 3b0c8dd1 e4b26f6e
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2376 from ngtcp2/fix-conn-shutdown-stream-read
    
    Fix conn_shutdown_stream_read

commit e4b26f6ea147bd679902d7be77a6c4379c7a0b51
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    Fix conn_shutdown_stream_read
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-1HO1RD4B

commit 3b0c8dd1286eded89c813fc5a13b13b896f6327a
Merge: 19117324 5c37f641
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2375 from ngtcp2/reset-cubic-undo
    
    Reset CUBIC undo variables once a loss is confirmed

commit 5c37f64117e666c8d49a4120e1b5d49122f05f7a
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    Reset CUBIC undo variables once a loss is confirmed
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-WQ2Q88SG

commit 1911732447a22e684be7c85bb93fb06f9ca2a7b1
Merge: 84b2567a 80336959
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2374 from ngtcp2/do-not-block-path-response
    
    Do not block PATH_RESPONSE due to lack of DCID and credit

commit 84b2567a47aa360d3d9542a55cc294122da7b98e
Merge: 760f566e 5a27f1c4
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2373 from ngtcp2/revert-ppe-pending-assertions
    
    Revert "Make sure that NGTCP2_CONN_FLAG_PPE_PENDING is not leaked"

commit 8033695969454e2360e0e5b659bf9c18dd1f330e
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    Do not block PATH_RESPONSE due to lack of DCID and credit
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-DRZWOIXW

commit 5a27f1c4bc415a845a1fb4edcc75358a55589261
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    Revert "Make sure that NGTCP2_CONN_FLAG_PPE_PENDING is not leaked"
    
    This reverts commit 2c473aef365a16e02438328c6119eb7c220d6235.

commit 760f566edb72ded6e440e3d08b669f1862e73bb8
Merge: fe9d53d6 b541fcb2
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2372 from ngtcp2/delay-dcid-status-after-handshake
    
    Do not call dcid_status callback until handshake completes

commit b541fcb2ef2105e9e2ad1ba6fb7c5e675a68446a
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    Do not call dcid_status callback until handshake completes
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-AHG1HZHL

commit fe9d53d677ea73668529af65605eabcb13fd2067
Merge: 77c63f0f 4753b44c
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2371 from ngtcp2/avoid-active-dcid-retirement-take2
    
    Prevent a used DCID from being retired in the another way

commit 4753b44c5d6387959ce291edf5708d302c29b576
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-28
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    Prevent a used DCID from being retired in the another way

commit 77c63f0f0581f3948af9f6da0621978e067e340a
Merge: 812ad6a8 6e8ed36a
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2370 from ngtcp2/derive-ini-key-before-vneg
    
    Derive initial key before version is negotiated

commit 6e8ed36a5da3bdaebcfbc26640fc1e532a277a66
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-27
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    Derive initial key before version is negotiated
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-5LJE4MXI

commit 812ad6a884c80b8cc419e432fc7852a07e288637
Merge: 52938556 d4ccb557
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2369 from ngtcp2/avoid-dcid-reuse
    
    Avoid DCID reuse

commit d4ccb557ff70b25be2bbccd8a45106f955f9b826
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-27
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    Avoid DCID reuse
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-40ILVIHL

commit 5293855625fd915b2c524c720e64d351c1fef2e5
Merge: 988eb237 ad4e1036
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2368 from ngtcp2/init-key-update-during-handshake
    
    Return error when ngtcp2_conn_initiate_key_update called during handshake

commit ad4e103609f91d31134be51f58138a6e9f591c87
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-27
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-28

    Return error when ngtcp2_conn_initiate_key_update called during handshake
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-3Z96TJ84

commit 988eb237c590f006c5dd3dcf4da34833ed32e783
Merge: d31be83c 921a2021
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-28
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-28

    Merge pull request #2367 from ngtcp2/avoid-dcid-stranded
    
    Avoid abandoned DCID stranded

commit 921a20219dc1d3b0aa6056e4cde61ee4bd91dc7a
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-25
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-27

    Avoid abandoned DCID stranded
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-0NID57J1

commit d31be83c0b93e1cd5067390a7b37c8e24c0ca5f0
Merge: 6f00573e a359eba9
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-27
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-27

    Merge pull request #2366 from ngtcp2/avoid-active-dcid-retirement
    
    Prevent a used DCID from being retired

commit a359eba92519ebed1339e1efbd309fc00c65a1d7
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-25
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-27

    Prevent a used DCID from being retired
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-0M0ZL419

commit 6f00573e40e5846b6691a3248c6f9f0270eff854
Merge: 0452969b a2ccd168
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-27
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-27

    Merge pull request #2365 from ngtcp2/revert-stop-buffering-data-after-stop-sending
    
    Revert "Stop buffering data after shutting downstream read"

commit a2ccd1687656992d316d48036b2c918bc851929e
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-25
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-27

    Revert "Stop buffering data after shutting downstream read"
    
    This reverts commit 3204235b34db669f88ba3676daadda3bbd792006.

commit 0452969bf8f09bb7f42a4e00c9405c355be9f856
Merge: b38a1a7a 907a33d1
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-27
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-27

    Merge pull request #2364 from ngtcp2/stream-shutdown-inside-stop-sending
    
    Deal with stream shutdown in stop_sending callback

commit 907a33d117da009e7a0abc1e36858e10f1b4f03b
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-25
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-27

    Deal with stream shutdown in stop_sending callback
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-XB084G26

commit b38a1a7a289922b8723fe700f957eef244d7b3a0
Merge: 1ae69ddd a51504b6
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-27
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-27

    Merge pull request #2363 from ngtcp2/reset-ppe-state
    
    Reset ppe pending state without WRITE_MORE flag set

commit a51504b60497731341408338549e7a38f5dd3df4
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-25
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-27

    Reset ppe pending state without WRITE_MORE flag set
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-VMTWMRAN

commit 1ae69ddd0aa39916f0c5ebfc6cbbf4c3d1292ed8
Merge: dbcd9fc1 f95272be
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-27
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-27

    Merge pull request #2362 from ngtcp2/remove-handshake-addr-rejection
    
    Remove rejection from handshake address because it is unreliable

commit f95272beb65844ee985a6e1ae617c796bf024dbb
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-25
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-27

    Remove rejection from handshake address because it is unreliable

commit dbcd9fc12d7724c26c1504b85ef184bdfab6f7ee
Merge: 90e85240 f67c9a08
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-27
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-27

    Merge pull request #2361 from ngtcp2/reject-ack-future-pkt
    
    Reject ACK that acknowledges packet that is sent later

commit f67c9a08805645071d855329e0077687dcf8ce9c
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-25
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-27

    Reject ACK that acknowledges packet that is sent later
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-TKDASE3H

commit 90e852406c2425983350400fa8a362ab3172ac06
Merge: 7d36160f 18baa5b8
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-27
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-27

    Merge pull request #2360 from ngtcp2/conn-id-limit-error
    
    Deal with the connection ID limit error

commit 18baa5b829469185d211e2428aa118990b1e117f
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-25
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-27

    Deal with the connection ID limit error
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-TF2RWXOV

commit 7d36160f79aaee9205e96d0123327c39fbc36124
Merge: bc241bcd 67ff4fdc
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-27
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-27

    Merge pull request #2359 from ngtcp2/fix-pkt-num-decoding
    
    Fix packet number decoding

commit 67ff4fdc89af2761a08edd23609c05636104ca47
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-25
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-27

    Fix packet number decoding
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-TELGO1RO

commit bc241bcdb8e7d3b53c2b1c87f8df8aed70a276ff
Merge: aec31bea 82de9494
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-27
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-27

    Merge pull request #2358 from ngtcp2/tls-no-tp
    
    Deal with TLS stack that does not bail out without transport params

commit 82de9494a1f9ebe86c0b812b17d7b10f0335b012
Author:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
AuthorDate: 2026-10-25
Commit:     Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
CommitDate: 2026-10-27

    Deal with TLS stack that does not bail out without transport params
    
    Discovered by Anthropic's OSS Scanner: ANT-2026-TAWRSE60

commit aec31beae24dc6c61d432e93118410daa668443d
Merge: 3c266f8d 41c0e0f1
Author:     Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
AuthorDate: 2026-10-27
Commit:     GitHub <noreply@github.com>
CommitDate: 2026-10-27

    Merge pull request #2357 from ngtcp2/keep-congestion-state
    
