fix(deps): bump h2 to 0.4.17 for RUSTSEC-2026-0258 - #72
Merged
Conversation
`cargo audit` fails on every branch as of 2026-08-17, when the advisory
for h2's unbounded empty DATA frames was published. The fix is a lockfile
bump — h2 is transitive (lancedb → lance → reqwest → hyper → h2), so no
manifest change is needed.
Crate: h2
Version: 0.4.15
ID: RUSTSEC-2026-0258
Solution: Upgrade to >=0.4.16
Resolved to 0.4.17. `cargo audit` and `cargo deny check` both pass; the
five remaining audit warnings are the pre-existing allowed `unmaintained`
advisories, unchanged.
Re-resolution also moved `windows-sys` down in four transitive entries
(0.61.2 → 0.60.2 / 0.59.0 / 0.52.0), cargo picking versions compatible
with the toolchain now pinned in rust-toolchain.toml. Windows-only crates,
and the dist targets are aarch64-apple-darwin and x86_64-unknown-linux-gnu,
so no shipped binary is affected.
Verified on 1.97.1: 983 tests pass, the 12 ignored real-model tests pass,
clippy clean with -D warnings, fmt clean, ast-grep clean.
Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unblocks CI on every open branch. One line of
Cargo.lock.The advisory
RUSTSEC-2026-0258 — h2 unbounded empty DATA frames — was published 2026-08-17, so
cargo auditstarted failing on all branches at once. Nothing to do with the code in any of them.h2is transitive —lancedb → lance → lance-namespace → reqwest → hyper → h2— so a lockfile bump is the whole fix, no manifest change. Resolved to 0.4.17.Incidental change
Re-resolution also moved
windows-sysdown in four transitive entries (0.61.2 → 0.60.2 / 0.59.0 / 0.52.0). That's cargo selecting versions compatible with the toolchain now pinned inrust-toolchain.toml. Windows-only crates, and[package.metadata.dist]targetsaarch64-apple-darwinandx86_64-unknown-linux-gnu(windows-msvc is commented out), so no shipped binary is affected.Verified locally on 1.97.1
cargo auditunmaintainedwarnings unchangedcargo deny checkcargo test --features testing-mockscargo test --features testing-mocks -- --ignoredcargo clippy --all-targets --features testing-mocks -- -D warningscargo fmt --checkast-grep scanmdvs check example_kbMerge order
This should go in first. PRs #70, #71, and
fix/duplicate-field-namesare all red on the same advisory and will go green once they pick this up.