## Description
- Uses `--locked` to ensure we only use deps from the lock file
- Adds cooldown period to dependabot
- pins actions versions
- introduces zizimor and pinact
## Breaking Changes
<!-- Optional, if there are any breaking changes document them,
including how to migrate older code. -->
## Notes & open questions
<!-- Any notes, remarks or open questions you have to make about the -->
<!-- PR. -->
## Change checklist
<!-- Remove any that are not relevant. -->
- [ ] Self-review.
- [ ] Documentation updates following the [style
guide](https://rust-lang.github.io/rfcs/1574-more-api-documentation-conventions.html#appendix-a-full-conventions-text),
if relevant.
- [ ] Tests if relevant.
- [ ] All breaking changes documented.
- [ ] This PR was created by a human that thought critically about the
proposed change and wrote an as clear and concise description as
they could.
- [ ] This PR isn't slop, and is carefully crafted to do have the
intented effect.
- [ ] `cargo make` passes locally.
---------
Co-authored-by: Friedel Ziegelmayer <me@dignifiedquire.com>
* Switch to `aes-gcm` crate for retry token logic when using rustls
* Split `rustls-ring` and `rustls-aws-lc-rs` features into `rustls`, `ring` and `aws-lc-rs` features.
* Better document the features.
* `cargo make format`
* Fix outdated feature references
* Avoid double-defining `configured_provider`
* File an issue about suddenly working PQC handshakes now breaking a test
* Fix rebase
* Only enable `aes-gcm` dependency when needed
* Add features for backwards compatibility
* Add some links to the spec's retry packet integrity section
Previously `quinn*` would provide the `log` feature to log events via `log` if
no `tracing` subscriber exists.
Later https://github.com/quinn-rs/quinn/pull/1923 allowed `quinn-udp` to log via
`log` directly, making `tracing` an optional dependency. For that, it introduced
the `direct-log` feature, a workaround name in order to not introduce a breaking
change.
This commit cleans up the above, renaming the `log` feature to `tracing-log` and
the `direct-log` to `log`. This is a breaking change and thus `quinn-udp` is
bumped to `v0.6.0`.
See https://github.com/quinn-rs/quinn/pull/1921 for the full history.
Basically all of the `actions-rs/*` actions are unmaintained. See
<https://github.com/actions-rs/toolchain/issues/216> for more
information. Due to their age they generate several warnings in
CI runs.
To get rid of those warnings the occurrences of
`actions-rs/toolchain` are replaced by `dtolnay/rust-toolchain`,
and the occurrences of `actions-rs/cargo` are replaced by direct
invocations of `cargo`.
Asmir Avdicevic