build(deps): bump aioquic from 1.3.0 to 1.5.0 in /tools/base

[dependabot]

Bumps aioquic from 1.3.0 to 1.5.0.

Changelog

Sourced from aioquic's changelog.

1.5.0

• Fix several ways a peer could make memory usage grow without bound:

  • Retire HTTP/3 unidirectional streams once they end, and HTTP/3 streams which are reset or stopped by the peer, or which end while blocked on QPACK.
  • Stop delivering stream events after a stream's receiving side has finished, so a duplicate FIN or RESET_STREAM is not reported again.
  • Forget peer connection ID sequence numbers below retire_prior_to.

• When a reset stream is reset again or receives more data, do not count its final size against connection-level flow control a second time. Counting it twice could close a well-behaved peer's connection with FLOW_CONTROL_ERROR.

• Close the connection with H3_FRAME_ERROR when a SETTINGS or PUSH_PROMISE frame is truncated, instead of raising an exception to the application.

• Abort the TLS handshake with an illegal_parameter alert when the peer's key share is invalid, and only accept key shares for groups the server supports.

• Stop using assertions to validate data received from the peer, so malformed input closes the connection or drops the packet, including when running with -O.

• Raise :class:ValueError for invalid arguments and :class:RuntimeError for calls made in the wrong state, such as writing to a stream after it has ended or been reset, instead of failing an assertion.

• Send a QPACK Stream Cancellation when a stream with a blocked header block is reset, and treat resetting or stopping an HTTP/3 control or QPACK stream as a connection error, as :rfc:9114 and :rfc:9204 require.

• Do not send a FIN when closing the writer of a receive-only stream in the :doc:asyncio API <asyncio>.

• Require pylsqpack_ 1.0 or later.

1.4.0

• Perform header protection and payload encryption in Python using cryptography_ instead of a C extension linked to OpenSSL_. This fixes memory safety issues when handling malformed packets, lifts the 1500-byte limit on received packets and removes the need for OpenSSL development headers when building from source.
• Discard duplicate packets as required by :rfc:9000 section 12.3.
• Limit the number of network paths per connection.
• Do not reply to Version Negotiation packets with another Version Negotiation packet.
• Discard unknown HTTP/3 frames incrementally instead of buffering them.
• Handle HTTP/3 frame types as defined by :rfc:9114.
• Add support for Python 3.15, drop support for Python 3.10.

Commits

• bc9b363 1.5.0
• d6aa43d Forget peer CID sequence numbers below retire_prior_to
• 9f9088b Retire H3 streams which end while blocked on QPACK
• 6ddbab9 Retire H3 streams reset or stopped by the peer
• c5f569c Only accept key shares for groups the server supports
• c1029b6 Abort the TLS handshake when the peer's key share is invalid
• 7ab9c6b Close the connection when a SETTINGS or PUSH_PROMISE frame is truncated
• 601fb70 Raise exceptions instead of asserting on invalid arguments or calls
• 7765c16 Stop using asserts to validate data received from the peer
• 023504b Count a reset's final size towards the highest received offset
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #55.