fix(deps): take the patched h2 for RUSTSEC-2026-0258

[copyleftdev]

Restores a green dependency-audit job on main.

What broke

CI run 32167544185 failed the dependency-audit job on RUSTSEC-2026-0258 — h2 accepts and queues empty DATA frames without limit, so a stream nobody drains grows memory unboundedly, and the length can overflow into a panic. Low severity. It reaches us transitively: reqwest 0.13.4 -> hyper 1.11.0 -> h2 0.4.15.

What did not break it

That run was the merge of #45, but #45 is not the cause. It touched only Cargo.lock, and it never touched h2 — it moved blake3, clap, rustix, rusqlite and thiserror. h2 0.4.15 was already pinned before it.

The advisory was published after the last push to main (the v0.3.1 release on 2026-08-13). #45 was simply the first commit to reach main afterwards, so it was the first run to see the advisory. Any commit would have failed the same way.

The fix

cargo update -p h2, taking the patched 0.4.16. Lockfile only — version and checksum, five lines.

Validation

Run locally against this branch:

• scripts/gates.sh — passed (fmt, clippy -D warnings, cargo test --workspace, release build, distribution/site/docs validation, binary-size ceiling, deterministic plan and conformance replay, WebSocket oracle smoke, dynamic conformance including the fault-injection negative case)
• cargo audit --deny warnings — clean over 276 crates against 1217 advisories
• cargo deny check advisories — advisories ok
• cargo deny check bans licenses sources — bans ok, licenses ok, sources ok

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c26114fc-ee97-4518-99c1-bdea3add71aa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}