Version 1.7.0

1.7.0 (2026-03-23)

Added

• Encrypted Hello (ECH) support based on RFC 9849 specifications.
  We do not support ECH for the server-side. Only intended for client-side usage.

Changed

• Updated aws-lc-rs v1.16.0 to v1.16.2 (aws-lc-sys/aws-lc relicensed to Apache-2.0)
• Updated lsqpack implementation v2.6.1 (e33719e) to v2.6.2 (1e9c5b8) via ls-qpack-rs v0.3.0.

Fixed

• True GREASE following RFC 8701.

Security

• Fixed AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN (GHSA-394x-vwmw-crm3)
• Fixed CRL Distribution Point Scope Check Logic Error in AWS-LC (GHSA-9f94-5g5w-gf6r)

Misc

• Release the GIL during qpack encode and decode operations.

Version 1.6.0

1.6.0 (2026-03-01)

Added

• Client side MTU discovery to probe for max datagram size.
• Setting UDP datagram size at configuration level. (#69)
• SBOM artifact (cyclonedx) for the Rust side is now generated and integrated into the pre-built wheel.

Changed

• Updated aws-lc-rs v1.14.0 to v1.16.0
• Minor performance improvement in hot code paths.
• Remove default Reno congestion algorithm in favor to the Cubic implementation (RFC 9438).

Version 1.5.6

1.5.6 (2025-11-09)

Fixed

• backport (aiortc#604) avoid assertion error when receiving multiple STOP_SENDING.
• backport (aiortc#603) limit the number of remote path challenges stored per path.
• backport (aiortc#606) update PATH_CHALLENGE / PATH_RESPONSE state after sending.
• backport (aiortc#606) send PATH_CHALLENGE before other frame types.
• backport (aiortc#590) remove stream objects when stream is ended.

Changed

• Various minor performance improvements in our Rust code.

Misc

• OCSP internals improved for better reliability (niquests usage only).

Version 1.5.5

1.5.5 (2025-10-05)

Changed

• Upgraded aws-lc-rs to v1.14.0
• Upgraded rustls to v0.23.32
• Upgraded pyo3 to v0.26.0

Added

• Explicit support for Python 3.14

Misc

• Initial support for pre-built RISCV wheels

Version 1.5.4

1.5.4 (2025-08-11)

Changed

• Upgraded aws-lc-rs to v1.13.3
• Upgraded rustls to v0.23.31

Misc

• OCSP and CRL related helpers improved. This is not useful for end users of qh3.

Version 1.5.3

1.5.3 (2025-06-16)

Removed

• The caextra recently added in the Configuration is reverted. After much consideration this was a mistake.
  End-users are already pushing either willingly or by accident intermediate CA or even non TLS client auth or server
  auth certificate in the regular CA bundle. We had to find another way.

Changed

• Caching the trust store loading in-memory to avoid unnecessary overhead on each TLS handshake.
• Upgraded pyo3 to 0.25.1

Fixed

• Aligned our TLS certificate chain validation with CPython+OpenSSL default behaviors. Pushing intermediates CA
  in the main CA bundle will still require that the trust anchors (root ca) is present.

Misc

• Changed CRL helpers and add the validation layer (signature).
• Added the validation layer to OCSP response (signature).

Version 1.5.2

1.5.2 (2025-06-01)

Added

• Passing extra intermediates CA in the configuration so that we could discretely rebuild the chain before validation.
  This is most useful in a corporate environment where server may misbehave and miss sending the full chain in the TLS handshake.
  The list of intermediate may be available in the OS trust store. It is not fetched automatically, you will have to provide
  them in the configuration. See the caextra property.

Fixed

• Default CA root list loading when none are given.

Changed

• Upgraded aws-lc-rs to 1.13.1
• Upgraded rustls to 0.23.27
• Upgraded pyo3 to 0.25.0

Misc

• Added CRL helpers.

Version 1.5.1

1.5.1 (2025-05-02)

Fixed

• Parsing of SEC1/PKCS8 EC Private Key. #73

Version 1.5.0

1.5.0 (2025-04-20)

Misc

• General performance improvements in various parts of the code. Up to 5% faster (against 1.4.5).

Changed

• GIL is now released during AEAD encryption/decryption.

Added

• OCSP stapling support for the client.

Version 1.4.5

1.4.5 (2025-04-17)

Misc

• General performance improvements in various parts of the code. Up to 15% faster (against 1.4.4).

Fixed

• unclosed StreamWriter warning in our asyncio Protocol implementation.

Removed

• submodule qh3.buffer as well as qh3._crypto. Those were not supposed to be used externally anyway.