fix(deps): patch h2 advisory and document tonic 0.3 chain ignore

[d-oit]

Problem

main is currently failing Dependency Audit, Rust Security Suite, and Security Scan Summary: RUSTSEC-2026-0258 / GHSA-q83h-524g-xf6h — h2 accepts unbounded empty DATA frames (low-severity memory-exhaustion DoS), patched in h2 >= 0.4.16.

cli/Cargo.lock contains two affected versions:

• h2 0.4.14 — direct path via reqwest 0.12.28 / hyper 1.9.0
• h2 0.3.27 — transitive via tonic 0.11 ← libsql 0.9.30; the 0.3 line has no patched release

This is the same advisory PRs #591/#592 tried to suppress without analysis; per repo policy the fix lands first and any remaining ignore is documented.

Fix

1. cargo update -p h2@0.4.14 --precise 0.4.18 → eliminates the patched finding entirely.
2. Scope-ignore RUSTSEC-2026-0258 in deny.toml + the cargo audit CI step for the only remaining occurrence: the unpatched tonic 0.11/libsql chain.

Why the ignore is justified

• Advisory severity: Low (DoS class).
• No fixed version exists on the affected 0.3 line; removal requires a tonic ≥0.12 + libsql major upgrade, which is a separate tracked change with real regression risk.
• Exposure: do-wdr uses libsql client-side for semantic-cache sync; it does not run a tonic-web/h2 server exposed to untrusted clients, which is the attack surface this advisory describes.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
do-web-doc-resolover	Ready	Preview	Aug 21, 2026 2:32pm

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}