[Security]: h2 0.4.15 affected by RUSTSEC-2026-0258

[1688mengdie]

Summary

The h2 dependency version 0.4.15 in the lockfile is affected by RUSTSEC-2026-0258. Proposed: upgrade h2 to 0.4.16 (patched, same 0.4.x line) to close the advisory with a low-risk, lockfile-only change.

Area

Agent runtime / core (Rust dependency)

Reproduction or evidence

Affected: Cargo.lock pins h2 0.4.15, which is flagged by RUSTSEC-2026-0258. The fix is a lockfile-only bump to h2 0.4.16; no application source change.

Environment, if relevant

BitFun version/commit: upstream main 41f4af303