fix(deps): bump h2 to 0.4.19 for RUSTSEC-2026-0258

[haasonsaas]

What broke

Two jobs in .github/workflows/ci.yml are red on main and on every open PR, including Dependabot #112:

• security — runs cargo audit
• cargo-deny (advisories + licenses) — runs cargo deny check advisories licenses

Both fail on one advisory:

Crate:    h2
Version:  0.4.10
Title:    h2 unbounded empty DATA frames
ID:       RUSTSEC-2026-0258
URL:      https://rustsec.org/advisories/RUSTSEC-2026-0258

h2 accepted and queued empty DATA frames without limit. On streams that are not actively drained that grows memory without bound, or panics when the length overflows. Patched in 0.4.16.

The change

cargo update -p h2 moves h2 from 0.4.10 to 0.4.19 inside the existing semver requirement. h2 is transitive here — it arrives through hyper-util, hyper-rustls, axum, reqwest and mockito — so this is a Cargo.lock-only change with no manifest and no source edits.

The advisory is fixed, not silenced: deny.toml gets no new exception, and cargo audit gets no --ignore.

How I verified

Locally with cargo-audit and cargo-deny against this Cargo.lock:

Command	Before	After
cargo audit	error: 1 vulnerability found! (RUSTSEC-2026-0258)	exit 0
cargo deny check advisories licenses	advisories FAILED, licenses ok	advisories ok, licenses ok

After the bump cargo audit still reports the three warnings that were already tolerated on main and do not fail the build: RUSTSEC-2026-0221 (event-listener), RUSTSEC-2026-0097 (rand), and yanked spin 0.9.8. This PR does not change their status.

cargo check was not run locally (denied by a local disk and thermal guard on this machine). The lint, test and coverage jobs on this PR cover compilation.

Unblocks

#112 (ws 8.19.0 -> 8.21.3 in /web), whose only failing checks are these two jobs. Note that the review job the sweep flagged for a missing merge base already passes — .github/workflows/ci.yml line 18 and .github/workflows/diffscope.yml line 21 both already set fetch-depth: 0.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XpuXXVrWCZk3Tq5NRXejNP