• Breaking change: Connection is now an enum instead of a trait. You can abstract over ClientConnection and ServerConnection with a bound like where C: Deref<ConnectionCommon<SD>>, SD: SideData.
• Breaking change: the SNI arguments to ClientCertVerifier methods have been removed. The Acceptor API now allows selecting a ServerConfig based on the ClientHello instead.
• Unclean TCP closure is now tracked by the library. This means a new error is possible when reading plaintext: ErrorKind::UnexpectedEof will be returned in this case.
• Breaking change: insulate the rustls public API from webpki API changes:
  • PKI errors are now reported using rustls-specific errors.
  • There is now a rustls-specific root trust anchor type.
• Breaking change: the following types are no longer exposed in the crate root, and can instead be imported through the client module exposed in the crate root: ResolvesClientCert, StoresClientSessions, WriteEarlyData, ClientSessionMemoryCache, NoClientSessionStorage, HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier, WebPkiVerifier and DangerousClientConfig.
• Breaking change: the following types are no longer exposed in the crate root, and can instead be imported through the server module exposed in the crate root: AllowAnonymousOrAuthenticatedClient, AllowAnyAuthenticatedClient, NoClientAuth, ResolvesServerCertUsingSni, NoServerSessionStorage, ServerSessionMemoryCache, StoresServerSessions, ClientHello, ProducesTickets, ResolvesServerCert, ClientCertVerified and ClientCertVerifier.
• Breaking API change: QuicExt::write_hs() now returns a KeyChange type that returns handshake or 1-RTT keys. In the case of 1-RTT keys, a KeyChange also includes a Secrets type that must be used to derive further key updates, independent from the rustls Connection. The QuicExt::next_1rtt_keys() method has been removed.
• Breaking API change: QUIC header protection keys now use a new type that directly exposes a masking/unmasking operation.
• Breaking change: internal buffers are now limited to 64 kB by default. Use Connection::set_buffer_limit to change the buffer limits to suit your application.
• Breaking API change: PEM parsing now lives in the rustls-pemfile crate. This means rustls::internals::pemfile and rustls::RootCertStore::add_pem_file no longer exist.
• Breaking API change: ServerCertVerifier::verify_server_cert and ClientCertVerifier::verify_client_cert pass the end-entity and intermediate certificates separately. This means rustls deals with the case where the certificate chain is empty, rather than leaving that to ServerCertVerifier/ClientCertVerifier implementation.
• Breaking API change: SupportedCipherSuite is now an enum with TLS 1.2 and TLS 1.3 variants. Some of its methods have moved to the inner Tls12CipherSuite and Tls13CipherSuite types. Instead of usable_for_version(), it now has a version() method. get_hash() has been renamed to hash_algorithm() and usable_for_sigalg() to usable_for_signature_algorithm().
• There are now 80% fewer unreachable unwraps in the core crate thanks to large refactoring efforts.
• Breaking API change: the WebPkiError variant of rustls::Error now includes which operation failed.
• Breaking API changes: These public API items have been renamed to meet naming guidelines:
  • rustls::TLSError to rustls::Error.
  • rustls::ResolvesServerCertUsingSNI to rustls::ResolvesServerCertUsingSni.
  • rustls::WebPKIVerifier to rustls::WebPkiVerifier.
  • rustls::ciphersuites to rustls::cipher_suites.
  • rustls::ALL_CIPHERSUITES to ALL_CIPHER_SUITES; rustls::DEFAULT_CIPHERSUITES to DEFAULT_CIPHER_SUITES.
  • rustls::ClientHello::sigschemes to rustls::ClientHello::signature_schemes.
  • rustls::RootCertStore::get_subjects to rustls::RootCertStore::subjects.
  • rustls::ServerSession to rustls::ServerConnection.
  • rustls::ClientSession to rustls::ClientConnection.
  • rustls::ServerSession::get_sni_hostname to rustls::ServerConnection::sni_hostname.
  • rustls::ClientConfig::ciphersuites to rustls::ClientConfig::cipher_suites.
  • rustls::ServerConfig::ciphersuites to rustls::ServerConfig::cipher_suites.
  • rustls::ProducesTickets::get_lifetime to rustls::ProducesTickets::lifetime.
  • rustls::Session: get_peer_certificates to peer_certificates, get_alpn_protocol to alpn_protocol, get_protocol_version to protocol_version, get_negotiated_ciphersuite to negotiated_cipher_suite.
• Breaking API change: ResolvesServerCert::resolve and ResolvesClientCert::resolve now return Option<Arc<CertifiedKey>> instead of Option<CertifiedKey>. CertifiedKey is now an immutable type.
• Breaking API change: peer_certificates returns a borrow rather than a copy on the internally stored certificate chain.
• Breaking API change: ClientConnection's DNS name parameter is now a new enum, ServerName, to allow future support for ECH and servers named by IP address.

What's Changed

• Require ring 0.16.19 and webpki 0.21.4. by @briansmith in https://github.com/rustls/rustls/pull/425
• Get Bogo test working on M1 ("Apple Silicon") macOS Big Sur. by @briansmith in https://github.com/rustls/rustls/pull/427
• Move pemfile parsing module to a separate crate by @ctz in https://github.com/rustls/rustls/pull/433
• Remove references to rustls::pemfile by @Ekleog in https://github.com/rustls/rustls/pull/434
• Update docs for process_new_packets. by @jsha in https://github.com/rustls/rustls/pull/439
• Spelling by @jsoref in https://github.com/rustls/rustls/pull/437
• Use single time for verifications (see #440) by @djc in https://github.com/rustls/rustls/pull/442
• Bump MSRV to Rust 1.47.0. by @briansmith in https://github.com/rustls/rustls/pull/463
• Avoid an instance of is_none/unwrap anti-pattern in tls12::ExpectServerKX::handle. by @briansmith in https://github.com/rustls/rustls/pull/449
• Remove is_none/unwrap in client::hs::ExpectServerHello::handle. by @briansmith in https://github.com/rustls/rustls/pull/450
• Reduce unwrap()ing in HandshakeHash. by @briansmith in https://github.com/rustls/rustls/pull/451
• Remove instance of is_none/unwrap in tls12::emit_certverify. by @briansmith in https://github.com/rustls/rustls/pull/452
• Remove unwrap()s in tls13::prepare_resumption. by @briansmith in https://github.com/rustls/rustls/pull/454
• Take extra_exts out of HandshakeDetails. by @briansmith in https://github.com/rustls/rustls/pull/460
• Change the certificate validation API to guarantee end-entity is present. by @briansmith in https://github.com/rustls/rustls/pull/462
• Clarify that only one key share is sent per client hello. by @briansmith in https://github.com/rustls/rustls/pull/471
• Simplify KeyExchange::complete(). by @briansmith in https://github.com/rustls/rustls/pull/472
• Use the find combinator on iterators by @huitseeker in https://github.com/rustls/rustls/pull/474
• Update boringssl for newer bogo tests by @ctz in https://github.com/rustls/rustls/pull/475
• Remove unwrap in deframe_one by @complexspaces in https://github.com/rustls/rustls/pull/484
• Simplify TicketSwitcher::decrypt() and remove unwrap(). by @briansmith in https://github.com/rustls/rustls/pull/481
• Remove unwrap in client find_session by @complexspaces in https://github.com/rustls/rustls/pull/482
• Remove unwrap in has_keyshare_extension_with_duplicates by @complexspaces in https://github.com/rustls/rustls/pull/483
• Remove unwraps in ExpectClientHello::handle by @complexspaces in https://github.com/rustls/rustls/pull/486
• Remove unwrap in tls13 emit_stateless_ticket by @complexspaces in https://github.com/rustls/rustls/pull/488
• Remove unwrap in emit_certverify_tls13 by @complexspaces in https://github.com/rustls/rustls/pull/490
• Remove unwrap in process_alpn_protocol by @complexspaces in https://github.com/rustls/rustls/pull/491
• Refactor client hello retrying to avoid unwrapping by @complexspaces in https://github.com/rustls/rustls/pull/493
• Remove unwraps in save_session by @complexspaces in https://github.com/rustls/rustls/pull/495
• Remove unwraps in ExpectServerDone::handle by @complexspaces in https://github.com/rustls/rustls/pull/494
• Remove unwraps in ExpectFinished::handle by @complexspaces in https://github.com/rustls/rustls/pull/496
• Codec: Simplify integer encoding functions & clarify assumptions made. by @briansmith in https://github.com/rustls/rustls/pull/501
• Codec: Add bounds checking to decode functions. by @briansmith in https://github.com/rustls/rustls/pull/500
• Remove unwraps from tls13 handle_client_hello by @complexspaces in https://github.com/rustls/rustls/pull/487
• Clarify that message header decoding doesn't panic by @djc in https://github.com/rustls/rustls/pull/498
• Prevent panic while panicking in tests/api.rs by @thomwiggers in https://github.com/rustls/rustls/pull/504
• Adjust default cipher suite order: by @ctz in https://github.com/rustls/rustls/pull/510
• Client: Thread hash_at_client_recvd_server_hello through the state machine. by @briansmith in https://github.com/rustls/rustls/pull/503
• Client: Lookup session once per connection. by @briansmith in https://github.com/rustls/rustls/pull/506
• Simplify the handling of SCT and OCSP sending in the server. by @briansmith in https://github.com/rustls/rustls/pull/505
• Remove CertifiedKey::has_sct_list() by @djc in https://github.com/rustls/rustls/pull/511
• Client: Move session ID initialization to emit_initial_client_hello. by @briansmith in https://github.com/rustls/rustls/pull/513
• Reduce usage of SessionCommon::get_suite_assert(). by @briansmith in https://github.com/rustls/rustls/pull/515
• Refactor version negotiation to avoid unwrapping by @briansmith in https://github.com/rustls/rustls/pull/516
• Client: Clarify when server cert details are filled in and fully available. by @briansmith in https://github.com/rustls/rustls/pull/518
• Client: Make some mut references non-mut where the mutability is not used. by @briansmith in https://github.com/rustls/rustls/pull/528
• derive Debug for Stream and StreamOwned by @stepancheg in https://github.com/rustls/rustls/pull/524
• Client: Always randomize session ID unless doing legacy resumption. by @briansmith in https://github.com/rustls/rustls/pull/527
• Store SupportedCipherSuite in ClientSessionValue. by @briansmith in https://github.com/rustls/rustls/pull/529
• What is the reason webpki operation failed? by @stepancheg in https://github.com/rustls/rustls/pull/517
• Client: Remove sent_tls13_fake_ccs from HandshakeDetails. by @briansmith in https://github.com/rustls/rustls/pull/530
• Deduplicate server ticket emitter code by @djc in https://github.com/rustls/rustls/pull/523
• Allow selecting supported groups in config (redux) by @ctz in https://github.com/rustls/rustls/pull/532
• Refactor into_expect_tls12_certificate_verify to avoid unwrapping by @complexspaces in https://github.com/rustls/rustls/pull/536
• Refactor hs::can_resume to avoid its callers unwrapping by @complexspaces in https://github.com/rustls/rustls/pull/535
• Refactor ExpectClientKX to inline methods to avoid unwrapping state by @complexspaces in https://github.com/rustls/rustls/pull/538
• Support stable QUIC transport parameters handshake extension by @Ralith in https://github.com/rustls/rustls/pull/544
• Install llvm 12 for coverage build by @ctz in https://github.com/rustls/rustls/pull/553
• Make randomness acquisition fallible (fixes #441) by @djc in https://github.com/rustls/rustls/pull/443
• Generate session randoms only once for clients by @djc in https://github.com/rustls/rustls/pull/556
• Check LLVM version in coverage script by @djc in https://github.com/rustls/rustls/pull/557
• Rename public API types to conform to API guidelines by @djc in https://github.com/rustls/rustls/pull/550
• Refactor server EMS state. by @sayrer in https://github.com/rustls/rustls/pull/561
• Find Homebrew OpenSSL on M1. by @sayrer in https://github.com/rustls/rustls/pull/565
• Refactor client EMS. by @sayrer in https://github.com/rustls/rustls/pull/571
• Remove duplicate code/state between client and server by @djc in https://github.com/rustls/rustls/pull/552
• Make bogo setup scripts more robust by @djc in https://github.com/rustls/rustls/pull/558
• client: thread transcript through handshake states by @djc in https://github.com/rustls/rustls/pull/547
• Set up formatting in CI by @djc in https://github.com/rustls/rustls/pull/478
• doc: add links to RFCs in README by @Delapouite in https://github.com/rustls/rustls/pull/576
• Enable conversion from integer value to enum by @djc in https://github.com/rustls/rustls/pull/583
• Refactor ClientHello data. by @sayrer in https://github.com/rustls/rustls/pull/581
• Thread SessionID through the handshake. by @sayrer in https://github.com/rustls/rustls/pull/584
• Inline ClientSessionImpl into ClientSession by @djc in https://github.com/rustls/rustls/pull/575
• server: make CertifiedKey immutable during handshake by @djc in https://github.com/rustls/rustls/pull/574
• Add fmt script to admin dir by @djc in https://github.com/rustls/rustls/pull/595
• Client: remove unwrapping in derivation of early traffic keys by @djc in https://github.com/rustls/rustls/pull/593
• Inline server state transitions by @djc in https://github.com/rustls/rustls/pull/594
• Ensure SNI extension can be round-tripped by @ctz in https://github.com/rustls/rustls/pull/602
• Miscellaneous unwrap() removals by @djc in https://github.com/rustls/rustls/pull/598
• server: inline TLS 1.3 state transitions by @djc in https://github.com/rustls/rustls/pull/600
• admin/fmt script fixes by @djc in https://github.com/rustls/rustls/pull/599
• Inline server session by @djc in https://github.com/rustls/rustls/pull/591
• Add explicit dyn keyword where needed by @djc in https://github.com/rustls/rustls/pull/613
• Fix formatting by @djc in https://github.com/rustls/rustls/pull/614
• bogo: pass on any extra arguments by @djc in https://github.com/rustls/rustls/pull/611
• Fix public APIs to conform to naming conventions by @djc in https://github.com/rustls/rustls/pull/612
• Replace SessionID::new() with SessionID::random() constructor by @djc in https://github.com/rustls/rustls/pull/610
• client: move QUIC client code into client module (see #586) by @djc in https://github.com/rustls/rustls/pull/592
• server: simplify how SigningKey arguments are passed by @djc in https://github.com/rustls/rustls/pull/597
• Thread cipher suite through handshake states by @djc in https://github.com/rustls/rustls/pull/606
• Stricter fuzz corpus test by @sayrer in https://github.com/rustls/rustls/pull/615
• Ignore DS_Store by @sayrer in https://github.com/rustls/rustls/pull/617
• Pin rustfmt and nightly revision used to build it by @djc in https://github.com/rustls/rustls/pull/609
• Remove HandshakeDetails from client code. by @sayrer in https://github.com/rustls/rustls/pull/623
• server: move QUIC implementations into server module by @djc in https://github.com/rustls/rustls/pull/616
• Prefer copy_from_slice() over io::Write by @djc in https://github.com/rustls/rustls/pull/620
• Rely on option value directly to avoid unwrapping by @djc in https://github.com/rustls/rustls/pull/625
• Refactor construction of AEAD keys for TLS 1.2 to clarify lack of panicking by @briansmith in https://github.com/rustls/rustls/pull/627
• Remove unintended webpki-roots patch from Cargo.toml. by @briansmith in https://github.com/rustls/rustls/pull/632
• Migrate Into implementations to From where possible by @djc in https://github.com/rustls/rustls/pull/631
• Rework plaintext I/O interface by @ctz in https://github.com/rustls/rustls/pull/629
• Fuzz test: Invalid SessionID in ServerHelloPayload. by @sayrer in https://github.com/rustls/rustls/pull/636
• Privatize server types and functions by @djc in https://github.com/rustls/rustls/pull/637
• Use unwrap_or(false) instead of or(Some(false)).unwrap(). by @briansmith in https://github.com/rustls/rustls/pull/648
• Implement an infallible version of Payload::read() to reduce unwraps. by @briansmith in https://github.com/rustls/rustls/pull/647
• kx: deduplicate ECDH params decoding by @djc in https://github.com/rustls/rustls/pull/644
• Stop panicking during key agreement on system RNG failure. by @briansmith in https://github.com/rustls/rustls/pull/650
• server: simplify SNI handling and make it more robust by @djc in https://github.com/rustls/rustls/pull/638
• Replace Random::from_slice with From<[u8; 32]>. by @briansmith in https://github.com/rustls/rustls/pull/651
• Avoid panicking when System PRNG fails during ticket encryption. by @briansmith in https://github.com/rustls/rustls/pull/653
• Ticketer: Avoid panicking. by @briansmith in https://github.com/rustls/rustls/pull/654
• Avoid panicking in the unlikely case that the time is set very wrong. by @briansmith in https://github.com/rustls/rustls/pull/658
• Deduplicate code between client and server by @djc in https://github.com/rustls/rustls/pull/622
• Ticketer: Use non-panicking alternatives; eliminate redundant tag length check by @briansmith in https://github.com/rustls/rustls/pull/664
• Use type system to ensure TLS 1.3 cipher suites aren't used for TLS 1.2 by @briansmith in https://github.com/rustls/rustls/pull/662
• Eliminate one allocation and one copy in handshake message deframing. by @briansmith in https://github.com/rustls/rustls/pull/669
• Further deduplicate client/server session handling by @djc in https://github.com/rustls/rustls/pull/660
• Remove a few unwraps by @ctz in https://github.com/rustls/rustls/pull/672
• CI/CD: Do the bare minimum to reduce GitHub token credential misuse potential by @briansmith in https://github.com/rustls/rustls/pull/676
• Upgrade to GitHub-native Dependabot by @dependabot-preview in https://github.com/rustls/rustls/pull/682
• Increase MSRV to 1.51.0. by @briansmith in https://github.com/rustls/rustls/pull/679
• client: move more ClientHello handling into version-specific modules by @djc in https://github.com/rustls/rustls/pull/674
• Improved builder-type API for making ServerConfigs by @ctz in https://github.com/rustls/rustls/pull/564
• Thread config through handshake states by @djc in https://github.com/rustls/rustls/pull/681
• Follow clippy::clone_on_ref_ptr guidance. by @briansmith in https://github.com/rustls/rustls/pull/696
• Include LICENSE files with published crates by @decathorpe in https://github.com/rustls/rustls/pull/686
• Leave allocation to caller for Session::peer_certificates() by @djc in https://github.com/rustls/rustls/pull/699
• Cleanups in state machine left over from config threading PR by @djc in https://github.com/rustls/rustls/pull/700
• Make sure set_mtu doesn't underflow. by @sayrer in https://github.com/rustls/rustls/pull/697
• Fix up formatting on main. by @sayrer in https://github.com/rustls/rustls/pull/703
• Touch up doc links. by @jsha in https://github.com/rustls/rustls/pull/706
• Set buffer limits by default by @djc in https://github.com/rustls/rustls/pull/714
• Fix a typo in comment by @zhihan in https://github.com/rustls/rustls/pull/715
• Represent server names with a dedicated type by @ctz in https://github.com/rustls/rustls/pull/718
• Use different types for TLS 1.2/1.3 cipher suites by @djc in https://github.com/rustls/rustls/pull/724
• Conceptually split PlainMessage out of OpaqueMessage by @djc in https://github.com/rustls/rustls/pull/722
• Incrase MSRV to 1.52.1. by @briansmith in https://github.com/rustls/rustls/pull/728
• Use type state to avoid unwrapping in key schedules by @djc in https://github.com/rustls/rustls/pull/730
• Clarify state of transcript hash through different types by @djc in https://github.com/rustls/rustls/pull/725
• Require more precise visibility by denying unreachable_pub by @djc in https://github.com/rustls/rustls/pull/739
• Improve documentation and semantics around internal buffer handling by @djc in https://github.com/rustls/rustls/pull/737
• Better represent random state in types by @djc in https://github.com/rustls/rustls/pull/741
• quic: deduplicate Iv type by @djc in https://github.com/rustls/rustls/pull/745
• Improve accuracy of panic reductions in core library crate by @djc in https://github.com/rustls/rustls/pull/747
• Make ClientConfigBuilder public by @djc in https://github.com/rustls/rustls/pull/749
• Enforce clippy's use_self lint by @djc in https://github.com/rustls/rustls/pull/761
• CI: stop installing LLVM 7 by @djc in https://github.com/rustls/rustls/pull/764
• client: simplify key exchange handling to avoid unwrapping by @djc in https://github.com/rustls/rustls/pull/744
• Extract TLS 1.3 AAD length into constant by @complexspaces in https://github.com/rustls/rustls/pull/769
• Add UnsupportedNameType error for certificate validation routines by @complexspaces in https://github.com/rustls/rustls/pull/768
• Some remaining API naming fixes by @djc in https://github.com/rustls/rustls/pull/773
• builder: use type state to improve config builders by @djc in https://github.com/rustls/rustls/pull/771
• Export IoState by @eloff in https://github.com/rustls/rustls/pull/774
• Tweak builder and rename cipher suite constants by @djc in https://github.com/rustls/rustls/pull/776
• Remove webpki::TrustAnchor from the public API. by @briansmith in https://github.com/rustls/rustls/pull/780
• Update env_logger requirement from 0.8.2 to 0.9.0 by @dependabot in https://github.com/rustls/rustls/pull/783
• Adapt to changed rustc unstable option handling by @djc in https://github.com/rustls/rustls/pull/788
• Clarify Message invariants by @djc in https://github.com/rustls/rustls/pull/785
• Return error at end of plaintext stream if we saw an EOF on the TLS stream by @ctz in https://github.com/rustls/rustls/pull/790
• Deny warnings in CI by @djc in https://github.com/rustls/rustls/pull/791
• Flatten PKI error variants by @djc in https://github.com/rustls/rustls/pull/792
• Make TLS 1.2 optional via a Cargo feature by @djc in https://github.com/rustls/rustls/pull/740
• Move most client/server-specific API into public client/server modules by @djc in https://github.com/rustls/rustls/pull/781
• quic: internalize PacketKey API from Quinn by @djc in https://github.com/rustls/rustls/pull/750
• Simplify state machine & split ConnectionCommon in two parts by @djc in https://github.com/rustls/rustls/pull/721
• Fix error message when the client disabled the server's TLS version by @blyxxyz in https://github.com/rustls/rustls/pull/795
• Improve doctests in the documentation homepage by @rukai in https://github.com/rustls/rustls/pull/802
• Track nightly's move to LLVM13 by @ctz in https://github.com/rustls/rustls/pull/804
• Also tone-down the same langauge in src/lib.rs by @ctz in https://github.com/rustls/rustls/pull/805
• Fix clippy: unwrap_or(T::default) -> unwrap_or_default() by @ctz in https://github.com/rustls/rustls/pull/806
• Derive Hash and Ord for Certificate by @djc in https://github.com/rustls/rustls/pull/809
• bogo: deduplicate bogo configuration items by @djc in https://github.com/rustls/rustls/pull/814
• Fixes for TLS 1.2 session resumption by @djc in https://github.com/rustls/rustls/pull/799
• Change Connection to be an enum instead of a trait by @djc in https://github.com/rustls/rustls/pull/789
• Use stable rustfmt for formatting by @djc in https://github.com/rustls/rustls/pull/811
• Add Acceptor API for resolving server configuration based on ClientHello by @djc in https://github.com/rustls/rustls/pull/787
• Pull request exposing strictly what is needed to provide the ability to statically decrypt TLS 1.3 messages from external users of the library by @p1-mmr in https://github.com/rustls/rustls/pull/815
• Bump Golang to 1.17 in GHA by @gliptak in https://github.com/rustls/rustls/pull/820
• client: version-specific session resumption values by @djc in https://github.com/rustls/rustls/pull/812
• Fix go 1.17 by @ctz in https://github.com/rustls/rustls/pull/821
• Implement Certificate Transparency policy by @djc in https://github.com/rustls/rustls/pull/819
• Minor refactors related to session resumption by @djc in https://github.com/rustls/rustls/pull/798
• Include bogo go.sum by @ctz in https://github.com/rustls/rustls/pull/824
• Update GHA badge pointing to build/main by @gliptak in https://github.com/rustls/rustls/pull/825
• Add some more notes to 0.20.0 changelog by @djc in https://github.com/rustls/rustls/pull/827
• Keep Certificate Transparency support implicitly off by default by @djc in https://github.com/rustls/rustls/pull/826
• docs: Be explicit about how to not pass a list of DNs for client auth by @horazont in https://github.com/rustls/rustls/pull/829

New Contributors

• @Ekleog made their first contribution in https://github.com/rustls/rustls/pull/434
• @jsoref made their first contribution in https://github.com/rustls/rustls/pull/437
• @huitseeker made their first contribution in https://github.com/rustls/rustls/pull/474
• @sayrer made their first contribution in https://github.com/rustls/rustls/pull/561
• @Delapouite made their first contribution in https://github.com/rustls/rustls/pull/576
• @decathorpe made their first contribution in https://github.com/rustls/rustls/pull/686
• @zhihan made their first contribution in https://github.com/rustls/rustls/pull/715
• @eloff made their first contribution in https://github.com/rustls/rustls/pull/774
• @blyxxyz made their first contribution in https://github.com/rustls/rustls/pull/795
• @rukai made their first contribution in https://github.com/rustls/rustls/pull/802
• @p1-mmr made their first contribution in https://github.com/rustls/rustls/pull/815
• @gliptak made their first contribution in https://github.com/rustls/rustls/pull/820

Full Changelog: https://github.com/rustls/rustls/compare/v/0.19.1...v/0.20.0