From 516b34b0a3dd6fe6adc364c9a6b59886b4a018ec Mon Sep 17 00:00:00 2001
From: user <user@localhost>
Date: Mon, 24 Aug 2026 18:52:06 +0800
Subject: [PATCH] chore(deps): upgrade h2 to 0.4.16 (RUSTSEC-2026-0258)

Bump the transitive h2 dependency from 0.4.15 to 0.4.16 to close
RUSTSEC-2026-0258 (h2 arbitrary-length HTTP/2 sequence-header DoS).
Only the locked version and its checksum change; the dependency graph and
all source files are untouched, so this is independent of any feature
work.

Test: cargo check --jobs 4 --workspace && cargo tree -i h2 (expected 0.4.16)
AI: lightly tested
---
 Cargo.lock | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 1f0f7b84c2..427de99674 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4350,9 +4350,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.15"
+version = "0.4.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155"
+checksum = "a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27"
 dependencies = [
  "atomic-waker",
  "bytes",