downgrade nss requirement to 3.120.1

[jesup]

No description provided.

[jesup]

This PR is part of a stack of 2 bookmarks:

1. trunk()
2. temp_downgrade_nss ← this PR
3. users/jesup/draining

---

Created with jj-stack

[Copilot]

Pull request overview

Lowers Neqo’s minimum required NSS version so the crypto crate (and thus the overall workspace) can build/run against NSS 3.120.1 instead of 3.121.

Changes:

• Update the minimum NSS version string from 3.121 to 3.120.1.

[github-actions]

This PR downgrades the minimum NSS version from 3.121 to 3.120.1 in neqo-crypto/min_version.txt. The version is consumed at build time (build.rs via pkg-config --modversion check), at runtime (NSS_VersionCheck), and across ~12 CI workflow files (via version-file:).

The change itself is mechanically correct — all consumers read from this single file, so a one-line change propagates everywhere.

Concerns:

1. Missing context. The PR has no description explaining why the downgrade is needed or what the timeline is for restoring it. The temp_ branch name signals intent to revert, but without a tracking issue or TODO, this risks becoming permanent. Please add a brief rationale and link to a follow-up issue.

2. Security surface. Lowering the minimum NSS version widens the set of NSS builds the code will accept at runtime. If 3.121 introduced security fixes that neqo relies on (even implicitly through hardened defaults), this PR silently weakens that floor. Worth a sentence in the description confirming that no security-relevant NSS changes between 3.120.1 and 3.121 affect neqo.

3. Stale CI comment. Noted inline — the NetBSD exclusion comment references >= 3.121 and should be updated.

4. Merge conflict. The PR is currently in a dirty mergeable state and needs a rebase.

[github-actions]

Warning

The TODO in .github/workflows/check.yml:211 says:

# TODO: Re-enable NetBSD once NetBSD > 10.1 ships with NSS >= 3.121.

With the minimum lowered to 3.120.1, that comment becomes stale — NetBSD 10.1's packaged NSS might now satisfy the requirement, so both the comment and the NetBSD exclusion should be revisited as part of this change.