chore: release 1.3.3

[kixelated]

Releases 1.3.3 from release/1.3. Bumps workspace.package.version and the internal path-dep pins to 1.3.3 and adds its CHANGELOG-MOQ.md entry covering:

• fix(proto): bound assembler chunk count (RUSTSEC-2026-0185) (1.3) #26 (backport of fix(proto): bound assembler chunk count (RUSTSEC-2026-0185) #25): bound the stream and CRYPTO reassembly buffers at 1024 chunks after compaction, closing the connection with INTERNAL_ERROR past it (RUSTSEC-2026-0185). Matches quinn-proto 0.11.18.
• fix(web-transport-moq): report a stream reset before its header as a reset (1.3) #20 (backport of fix(web-transport-moq): report a stream reset before its header as a reset #19): a stream reset before its WebTransport header is reported as the reset and logged at debug, instead of UnknownSession at WARN.
• fix(web-transport-moq): keep the HTTP/3 streams open until the close capsule is delivered (1.3) #24 (backport of fix(web-transport-moq): keep the HTTP/3 streams open until the close capsule is delivered #23): keep a web-transport-moq session's HTTP/3 streams open until its close capsule is delivered.

release/1.3 is merged in, so this branch carries all three.

Public API: none. Wire: a peer that exceeds the reassembly cap is closed with INTERNAL_ERROR. Parent unchanged. cargo test --workspace --locked and cargo publish --workspace --locked --dry-run pass locally.

After merge, tag the merge commit v1.3.3 to publish via moq-release.

(Written by Claude Opus 5.5)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-29T00:22:42.205517Z	7da65e9	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kixelated]

Decisions (from the maintainer, via the coordinating agent): fold the reassembly cap (#26, backport of #25; RUSTSEC-2026-0185, matching quinn-proto 0.11.18) and #24 into this 1.3.3 release. moq main then pins 1.3.3.

This branch is not updated yet. My agent session was not permitted to rewrite or extend release/1.3.3, so a maintainer needs to do one of the following.

• A (merge, no force-push):

  git fetch origin
  git switch -c tmp origin/release/1.3.3
  git merge origin/fix/assembler-chunk-cap-1.3
  

  Then add these lines to the 1.3.3 entry of CHANGELOG-MOQ.md, above and below the fix(web-transport-moq): report a stream reset before its header as a reset (1.3) #20 line, commit, and git push origin tmp:release/1.3.3.
• B (rebuild, force-push): cherry-pick this PR's release commit 7da65e96 onto origin/fix/assembler-chunk-cap-1.3, edit the changelog the same way, and git push --force-with-lease=release/1.3.3:7da65e96 origin HEAD:release/1.3.3. This mirrors how chore: release 2.0.1 #22 was rebuilt on fix(proto): bound assembler chunk count (RUSTSEC-2026-0185) #25.

Changelog lines (the #26 line goes above the #20 line, and the #24 line below it):

- [#26](https://github.com/moq-dev/noq/pull/26) bound the stream and CRYPTO reassembly buffers at 1024 chunks after compaction, closing the connection with `INTERNAL_ERROR` past it ([RUSTSEC-2026-0185](https://rustsec.org/advisories/RUSTSEC-2026-0185.html)). Carries [quinn-rs/quinn#2694](https://github.com/quinn-rs/quinn/pull/2694), [#2789](https://github.com/quinn-rs/quinn/pull/2789), and [#2814](https://github.com/quinn-rs/quinn/pull/2814), matching quinn-proto 0.11.18. Backport of [#25](https://github.com/moq-dev/noq/pull/25). Upstream: [n0-computer/noq#828](https://github.com/n0-computer/noq/pull/828) (open).
- [#24](https://github.com/moq-dev/noq/pull/24) keep a `web-transport-moq` session's HTTP/3 control and QPACK streams open until its close capsule is delivered, so browsers see the close code and reason instead of "Connection lost.". Backport of [#23](https://github.com/moq-dev/noq/pull/23). Fork-only.

Also change the entry's trailing "No API change." to "No API change. A peer that exceeds the reassembly cap is now closed."

The result was checked locally: cargo publish --workspace --locked --dry-run passes for 1.3.3 with the fix. After that, merge #26 into release/1.3 first, then this PR, both with "Create a merge commit" (or merge only this PR and close #26 as included). Then tag the merge commit v1.3.3.

(Written by Claude Opus 5.5)