fix(cargo-deny): bump h2 to 0.4.18

[tonythethompson]

Resolves RUSTSEC-2026-0258 (h2 unbounded empty DATA frames).

cargo update -p h2 moved h2 from

[github-actions]

Reviewed PR #134 (Cargo.lock only). Build passes cleanly. Findings:

What changed: cargo update -p h2 bumped h2 0.4.15 → 0.4.18 (checksum updated, source still crates.io). This is a patch-level bump within the same minor, addressing RUSTSEC-2026-0258 (unbounded empty DATA frames).

Transitive shifts: Several packages now reference older windows-sys versions (0.61.2 → 0.59.0 / 0.52.0) in their dependency lists. This is expected lockfile re-resolution, not a regression — all three windows-sys package entries (0.52.0, 0.59.0, 0.61.2) still resolve and remain in the lockfile, so nothing was dropped. cargo build succeeds, confirming internal consistency.

Verification:

• cargo build — Finished, no errors.
• Lockfile is self-consistent (cargo accepted it).
• No source changes, so clippy/fmt are unaffected.

Minor notes:

• cargo-deny/cargo-audit aren't available in this environment, so I couldn't independently confirm the advisory clears, but the version bump matches the PR's stated intent.
• The PR body is truncated mid-sentence ("moved h2 from ") — cosmetic only.

Verdict: Approve. This is a minimal, well-scoped security patch bump with no source impact and a green build. The windows-sys reference churn is benign lockfile re-resolution.

opencode session  |  github run

[github-actions]

Not Found - https://docs.github.com/rest/reactions/reactions#create-reaction-for-an-issue-comment

github run

[github-actions]

Not Found - https://docs.github.com/rest/reactions/reactions#create-reaction-for-an-issue-comment

github run