fix(cargo-audit): update h2, anyhow, event-listener and drop actix http2 feature

[louise-poole]

Clears all cargo audit vulnerabilities. Audit goes from 2 vulnerabilities + 13 warnings to 0 vulnerabilities + 9 warnings.

Vulnerabilities

Both were RUSTSEC-2026-0258 (h2 unbounded empty DATA frames):

• h2 0.4.15 → 0.4.16
• h2 0.3.27 — no 0.3.x patch exists, and actix-http 3.13.3 still requires h2 ^0.3.27. Removed at the source by dropping actix-web's http2 default feature, the only thing pulling it in. h2 0.3 is no longer in the lockfile.

Unsound / yanked

• anyhow 1.0.102 → 1.0.104 (RUSTSEC-2026-0190)
• event-listener 5.4.1 → 5.4.2 (RUSTSEC-2026-0221)
• bitcoin-io 0.1.100 → 0.1.101 (yanked)
• bitcoin_hashes 0.14.100 → 0.14.101 (yanked)

Config

Removed the RUSTSEC-2026-0104 ignore from .cargo/audit.toml. It was pinned for rustls-webpki 0.101.7; the tree is on 0.103.13, so the entry had no effect. RUSTSEC-2025-0055 stays ignored.

Behaviour change

The RPC server no longer speaks HTTP/2. fynd-rpc/src/builder.rs:299 binds plain TCP with no TLS, so there is no ALPN negotiation and the only HTTP/2 path was h2c prior knowledge.

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​anyhow@​1.0.102 ⏵ 1.0.104

View full report