Release 4.8.0 (#651)

- [API] Deprecate all gQUIC versions.
- [FIX] http1x: check size of Cookie: header.
- [FIX] Add checks to gQUIC client session resume code.
- [FIX] 32-bit parser bounds checks.
- [FIX] Use ls-qpack v2.6.3 to pick up a bunch of fixes.
- [DOCS] FAQ: example programs do work with google.com etc.

Author: dtikhonov

CHANGELOG

@@ -1,3 +1,12 @@
+2026-06-15
+    - 4.8.0
+    - [API] Deprecate all gQUIC versions.
+    - [FIX] http1x: check size of Cookie: header.
+    - [FIX] Add checks to gQUIC client session resume code.
+    - [FIX] 32-bit parser bounds checks.
+    - [FIX] Use ls-qpack v2.6.3 to pick up a bunch of fixes.
+    - [DOCS] FAQ: example programs do work with google.com etc.
+
 2026-06-05
     - 4.7.2
     - [FIX] Only ignore Priority: header after PRIORITY_UPDATE and in

CONTRIBUTORS.txt

@@ -42,6 +42,7 @@ to the LiteSpeed QUIC and HTTP/3 Library:
     - Kirill Sabitov -- Bug fixes
     - Harold Newman -- Bug fixes
     - Richard Ramos -- Windows fixes
+    - youngseaz -- 32-bit transport param parser bug report
 
 Thank you!
 

README.md

@@ -14,8 +14,9 @@ and HTTP/3 functionality for servers and clients.  Most of the code in this
 distribution is used in our own products: LiteSpeed Web Server, LiteSpeed ADC,
 and OpenLiteSpeed.
 
-Currently supported QUIC versions are v1, v2, Internet-Draft versions 29, and 27;
-and the older "Google" QUIC versions Q043, Q046, an Q050.
+QUIC versions v1, v2, and Internet-Draft version 29 are enabled by default.
+Deprecated versions ID-27 and the older "Google" QUIC versions Q043, Q046,
+and Q050 are still supported, but are not enabled by default.
 
 Standard Compliance
 -------------------

docs/apiref.rst

@@ -28,23 +28,23 @@ has the form MAJOR.MINOR.PATCH, where
 QUIC Versions
 -------------
 
-LSQUIC supports two types of QUIC protocol: Google QUIC and IETF QUIC.  The
-former will at some point become obsolete, while the latter is still being
-developed by the IETF.  Both types are included in a single enum:
+LSQUIC supports two types of QUIC protocol: Google QUIC and IETF QUIC.
+Google QUIC versions are deprecated and are not enabled by default.  Both
+types are included in a single enum:
 
 .. type:: enum lsquic_version
 
     .. member:: LSQVER_043
 
-        Google QUIC version Q043
+        Google QUIC version Q043; this version is deprecated.
 
     .. member:: LSQVER_046
 
-        Google QUIC version Q046
+        Google QUIC version Q046; this version is deprecated.
 
     .. member:: LSQVER_050
 
-        Google QUIC version Q050
+        Google QUIC version Q050; this version is deprecated.
 
     .. member:: LSQVER_ID27
 
@@ -54,14 +54,13 @@ developed by the IETF.  Both types are included in a single enum:
 
         IETF QUIC version ID 29
 
-    .. member:: LSQVER_ID34
+    .. member:: LSQVER_I001
 
-        IETF QUIC version ID 34
+        IETF QUIC version 1.
 
-    .. member:: LSQVER_I001
+    .. member:: LSQVER_I002
 
-        IETF QUIC version 1.  (This version is disabled by default until
-        the QUIC RFC is released).
+        IETF QUIC version 2.
 
     .. member:: N_LSQVER
 
@@ -84,7 +83,8 @@ Experimental versions.
 
 .. macro:: LSQUIC_DEPRECATED_VERSIONS
 
-Deprecated versions.
+Deprecated versions.  Deprecated versions are supported, but they are not
+enabled by default.
 
 .. macro:: LSQUIC_GQUIC_HEADER_VERSIONS
 
@@ -491,7 +491,7 @@ settings structure:
        this number of times in a row without making progress (that is,
        reading, writing, or changing stream state), loop break will occur.
 
-       The defaut value is :macro:`LSQUIC_DF_PROGRESS_CHECK`.
+       The default value is :macro:`LSQUIC_DF_PROGRESS_CHECK`.
 
     .. member:: int             es_rw_once
 
@@ -631,7 +631,7 @@ settings structure:
        send PING frames in the absence of other activity.
 
        By default, the server does not send PINGs and the period is set to zero.
-       The client's defaut value is :macro:`LSQUIC_DF_PING_PERIOD`.
+       The client's default value is :macro:`LSQUIC_DF_PING_PERIOD`.
 
        IETF QUIC only.
 

docs/conf.py

@@ -24,9 +24,9 @@
 author = u'LiteSpeed Technologies'
 
 # The short X.Y version
-version = u'4.7'
+version = u'4.8'
 # The full version, including alpha/beta/rc tags
-release = u'4.7.2'
+release = u'4.8.0'
 
 
 # -- General configuration ---------------------------------------------------

docs/faq.rst

@@ -20,28 +20,9 @@ To aid development, there is a :macro:`LSQUIC_FORCED_TCID0_VERSIONS` that
 specifies the list of versions with 0-sized connections.  (If you, for
 example, want to turn them off.)
 
-Once gQUIC becomes deprecated in the future, there will remain no technical
-reason why a single engine instance could not be used both for client and
-server connections.  It will be just work.  For example, the single
+gQUIC versions are deprecated and disabled by default.  There remains no
+technical reason why a single engine instance could not be used both for
+client and server connections.  It is just work.  For example, the single
 engine settings :type:`lsquic_engine_settings` will have to be separated
 into client and server settings, as the two usually do need to have
 separate settings.
-
-Example Programs
-================
-
-*http_client does not work with www.google.com, www.facebook.com, etc.*
-
-Check the version.  By defaut, ``http_client`` will use the latest supported
-version (at the time of this writing, "h3-31"), while the server may be using
-an older version, such as "h3-29".  Adding ``-o version=h3-29`` to the
-command line may well solve your issue.
-
-There is an `outstanding bug`_ where lsquic client does not perform version
-negotiation correctly for HTTP/3.  We do not expect this to be fixed, because
-a) this version negotiation mechanism is likely to become defunct when QUIC v1
-is released and b) version negotiation is not necessary for an HTTP/3 client,
-because the other side's version is communicated to it via the ``Alt-Svc`` HTTP
-header.
-
-.. _`outstanding bug`: https://github.com/litespeedtech/lsquic/issues/180

docs/index.rst

@@ -16,8 +16,9 @@ Most of the code in this distribution has been  used in our own products
 -- `LiteSpeed Web Server`_, `LiteSpeed Web ADC`_, and OpenLiteSpeed_ --
 since 2017.
 
-Currently supported QUIC versions are v1, Internet-Draft versions 29, and 27;
-and the older "Google" QUIC versions Q043, Q046, an Q050.
+QUIC versions v1, v2, and Internet-Draft version 29 are enabled by default.
+Deprecated versions ID-27 and the older "Google" QUIC versions Q043, Q046,
+and Q050 are still supported, but are not enabled by default.
 
 LSQUIC is licensed under the `MIT License`_; see LICENSE in the source
 distribution for details.

docs/tutorial.rst

@@ -832,22 +832,23 @@ QUIC versions in LSQUIC are gathered in an enum, :type:`lsquic_version`, and hav
 
   enum lsquic_version {
       LSQVER_043, LSQVER_046, LSQVER_050,     /* Google QUIC */
-      LSQVER_ID27, LSQVER_ID28, LSQVER_ID29,  /* IETF QUIC */
+      LSQVER_ID27, LSQVER_ID29,               /* IETF QUIC drafts */
+      LSQVER_I001, LSQVER_I002,               /* IETF QUIC RFC versions */
       /* ...some special entries skipped */
       N_LSQVER    /* <====================== Special value */
   };
 
 The special value "N_LSQVER" is used to let the engine pick the QUIC version.
-It picks the latest non-experimental version, so in this case it picks ID-29.
-(Experimental from the point of view of the library.)
+It picks the latest version that is neither deprecated nor experimental.
+(Deprecated and experimental from the point of view of the library.)
 
 Because version enum values are small -- and that is by design -- a list of
 versions can be passed around as bitmasks.
 
 ::
 
   /* This allows list of versions to be specified as bitmask: */
-  es_versions = (1 << LSQVER_ID28) | (1 << LSQVER_ID29);
+  es_versions = (1 << LSQVER_I001) | (1 << LSQVER_I002);
 
 This is done, for example, when
 specifying list of versions to enable in engine settings using :member:`lsquic_engine_api.ea_versions`.
@@ -932,7 +933,7 @@ is parsed to see which setting to alter.
 
   while (/* getopt */)
   {
-      case 'o':   /* For example: -o version=h3-27 -o cc_algo=2 */
+      case 'o':   /* For example: -o version=h3 -o cc_algo=2 */
         if (!settings_initialized) {
           lsquic_engine_init_settings(&settings,
                           cert_file || key_file ? LSENG_SERVER : 0);

include/lsquic.h

@@ -26,8 +26,8 @@ extern "C" {
 #endif
 
 #define LSQUIC_MAJOR_VERSION 4
-#define LSQUIC_MINOR_VERSION 7
-#define LSQUIC_PATCH_VERSION 2
+#define LSQUIC_MINOR_VERSION 8
+#define LSQUIC_PATCH_VERSION 0
 
 #define LSQUIC_QUOTE(x)     #x
 #define LSQUIC_SVAL(v)      LSQUIC_QUOTE(v)
@@ -107,8 +107,9 @@ enum lsquic_version
 };
 
 /**
- * We currently support versions 43, 46, 50, Draft-27, Draft-29,
- * and IETF QUIC v1.
+ * We currently support Google QUIC versions Q043, Q046, and Q050,
+ * IETF QUIC Draft-27 and Draft-29, and IETF QUIC v1 and v2.
+ * Deprecated and experimental versions are not enabled by default.
  * @see lsquic_version
  */
 #define LSQUIC_SUPPORTED_VERSIONS ((1 << N_LSQVER) - 1)
@@ -121,7 +122,8 @@ enum lsquic_version
 #define LSQUIC_EXPERIMENTAL_VERSIONS ( \
                             (1 << LSQVER_RESVED))
 
-#define LSQUIC_DEPRECATED_VERSIONS ((1 << LSQVER_ID27))
+#define LSQUIC_DEPRECATED_VERSIONS ((1 << LSQVER_043) | (1 << LSQVER_046) | \
+                                    (1 << LSQVER_050) | (1 << LSQVER_ID27))
 
 #define LSQUIC_GQUIC_HEADER_VERSIONS (1 << LSQVER_043)
 
@@ -670,7 +672,7 @@ struct lsquic_engine_settings {
      * this number of times in a row without making progress (that is,
      * reading, writing, or changing stream state), loop break will occur.
      *
-     * The defaut value is @ref LSQUIC_DF_PROGRESS_CHECK.
+     * The default value is @ref LSQUIC_DF_PROGRESS_CHECK.
      */
     unsigned        es_progress_check;
 
@@ -864,7 +866,7 @@ struct lsquic_engine_settings {
      * send PING frames in the absence of other activity.
      *
      * By default, the server does not send PINGs and the period is set to zero.
-     * The client's defaut value is @ref LSQUIC_DF_PING_PERIOD.
+     * The client's default value is @ref LSQUIC_DF_PING_PERIOD.
      */
     unsigned        es_ping_period;