From b68a57e6188521ef629cdf74a03efde459918505 Mon Sep 17 00:00:00 2001
From: Don Johnson <don@codetestcode.io>
Date: Tue, 18 Aug 2026 11:03:48 -0700
Subject: [PATCH] fix(deps): take the patched h2 for RUSTSEC-2026-0258

h2 0.4.15 accepts and queues empty DATA frames without limit, which
grows memory unboundedly on a stream nobody drains and panics when the
length overflows. It reaches us transitively: reqwest -> hyper -> h2.

The advisory landed after the last push to main, so the first CI run to
see it was the dependabot lockfile bump that happened to follow it. That
bump did not introduce this; any commit would have failed the audit.

0.4.16 is the patched release, and nothing but the lockfile moves.
---
 Cargo.lock | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 7a8f26b..f3306b2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -633,9 +633,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.15"
+version = "0.4.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155"
+checksum = "a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -1427,7 +1427,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -1648,7 +1648,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -2428,7 +2428,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]