Dependency advisory RUSTSEC-2026-0258

[github-actions]

The scheduled audit found RUSTSEC-2026-0258: https://rustsec.org/advisories/RUSTSEC-2026-0258.html. Run: https://github.com/256foundation/mujina/actions/runs/32226242296

[rkuester]

The advisory is a low-severity denial of service in h2, hyper's HTTP/2 implementation. Affected versions queue empty DATA frames without limit, so a peer can grow memory without bound or panic the process. Patched in h2 0.4.16; our lockfile holds 0.4.15, pulled in transitively through hyper.

Exposure is small. hyper backs two features: the REST API server, which speaks HTTP/1 only, and the CLI's client for that API, which negotiates HTTP/2 only when pointed at an HTTPS URL. Neither reaches the flawed code in a default setup. Pool connections use Stratum over raw TCP and carry no HTTP.

The patched release was published 2026-08-17, inside the seven-day dependency cooldown (see CONTRIBUTING.md), and this low exposure is no reason to skip the cooldown. Apply the update when the cooldown expires on 2026-08-24.

[j-kon]

I'd like to take a look at this.

Based on the analysis above and with the dependency cooldown now expired, my plan is to update h2 through the project's dependency tooling, verify that the lockfile change stays scoped to the expected dependency update, then run the RustSec audit and the full project checks.

I'll open a focused PR referencing this issue once everything passes. Happy to adjust if there's anything specific you'd like included in the verification.

[rkuester]

Sure @j-kon, go for it!