chore(deps): bump h2 to 0.4.17 for RUSTSEC-2026-0258

[tjdammann]

cargo audit fails on main with RUSTSEC-2026-0258 — h2 accepts and queues empty DATA frames without limit, so a stream that isn't actively drained can grow memory unboundedly or panic on length overflow. Low severity, denial-of-service category, advisory published 2026-08-17.

Produced with the standard command:

cargo update -p h2      # 0.4.15 -> 0.4.17  (advisory requires >= 0.4.16)

Why this is a lockfile-only change

h2 is not a direct dependency — it arrives four levels down, via reqwest → hyper → hyper-rustls, and again through axoupdater → axoasset → reqwest. There is no manifest entry to bump.

Bumping reqwest would not help either: hyper 1.11.0 declares h2 = "0.4.14", i.e. ^0.4.14, so every 0.4.x at or above 0.4.14 already satisfies it. Nothing in any manifest was pinning 0.4.15 — only the lockfile was. That makes Cargo.lock both the cause and the correct place to fix it, which is also literally what cargo audit reads.

This is a binary distributed as prebuilt artifacts built from this repo, so the committed lockfile is what ships.

About the windows-sys lines in the diff

The diff also moves six windows-sys dependency edges from 0.61.2 to 0.52.0. This is expected re-resolution, not collateral damage:

• rustix and tempfile declare windows-sys = ">=0.52, <0.62" — a range satisfied by both versions, so cargo is free to pick either and consolidates them onto 0.52.0, which was already in the lockfile.
• mio (0.61) and socket2 (>=0.60, <0.62) cannot use 0.52, so they stay on 0.61.2. Both versions remain in the tree, as they did before.
• windows-sys is a cfg(windows) target dependency, so this affects only the x86_64-pc-windows-msvc artifact.

It reproduces exactly from a clean git clone of main plus cargo update -p h2, so the diff is anyone's to verify.

Testing

• cargo build, cargo test (315 lib + 18 integration), cargo clippy -- -D warnings, and cargo check --locked all clean.

[aviator-app]

Current Aviator status

Aviator will automatically update this comment as the status of the PR changes.
Comment /aviator refresh to force Aviator to re-examine your PR (or learn about other /aviator commands).

This PR is currently in state closed (PR closed manually).

---

See the real-time status of this PR on the Aviator webapp.

Use the Aviator Chrome Extension to see the status of your PR within GitHub.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}

[tjdammann]

Folded into #331.

main is currently failing two required checks at once — Security Audit (this advisory) and Vendored Artifacts (its vendored openapi.json went stale when the priority endpoints deployed). The spec refresh can't be split from the client code that consumes it: dropping the regenerated openapi.json onto a branch without the updated call sites fails to compile, since list_public_bugs goes from five arguments to seven. So a PR fixing only one of the two can't go green, and this one was unmergeable standing alone.

The commit is carried unchanged in #331 (chore(deps): bump h2 to 0.4.17 for RUSTSEC-2026-0258), and the rationale from this description is preserved there.

[indent]

Issues

Review closed.

CI Checks

1 CI check failed on 4bc67f9.

Vendored Artifacts

• Vendored Artifacts finished with failure.