Fix cargo-audit: upgrade h2 and git2 - #162
Conversation
Bump the transitive h2 crate to 0.4.19 to close RUSTSEC-2026-0258 (unbounded empty DATA frames). Upgrade git2 to 0.21 so the unsound Remote::list and BlameHunk Signature APIs are patched, and adapt callers to the 0.21 string-accessor Result types. Co-authored-by: Ibrahim Rahhal <ibrahim.rahhal3636@gmail.com>
git2 0.21 changed StatusEntry::path from Option to Result. Exercise the untracked-file listing path so that API change stays covered. Co-authored-by: Ibrahim Rahhal <ibrahim.rahhal3636@gmail.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
No actionable findings.
Verified that all three git2 0.21 accessor adaptations preserve the prior behavior for non-UTF-8 values, while default-features = false keeps the transport feature set unchanged. The lockfile contains a single h2 0.4.19 through Hyper and git2 0.21.0 with libgit2 1.9.7; cargo audit scanned all 316 dependencies with no advisories. Clippy, formatting, and all 748 local tests pass, including the new untracked-path test, and the PR’s full native-binary/CI platform matrix is green.
Sent by Cursor Automation: pr-flow
corgea-security
left a comment
corgea-security
left a comment
There was a problem hiding this comment.
Automated review risk: 1/5.
Low-risk git2 dependency upgrade with correct API adaptations that preserve prior handling of non-UTF-8 values. The added test covers untracked worktree path discovery. No actionable findings.
No critical or high-priority changes were found.
corgea-security
left a comment
corgea-security
left a comment
There was a problem hiding this comment.
Approved by Dennis: high policy risk and automated risk 1/5.
Resolves Cargo.lock in main's favour: #162 upgraded h2 and git2 together, superseding the h2-only bump on this branch. git2 0.21 changed Reference::symbolic_target to Result<Option<&str>, Error>, so default_branch unwraps both layers. #161 removed RepoInfo::status_dirty and made .dirty mean what git status reports; the incremental gate already read .dirty only, so it now refuses exactly the trees a user can see are dirty. Co-authored-by: ibrahim <ibrahim@corgea.com>
3 participants
Summary
CI
./harness ciwas failing on Dep audit becauseh2 0.4.12is vulnerable to RUSTSEC-2026-0258 (unbounded empty HTTP/2 DATA frames). The same scan also reported two allowed unsound warnings ongit2 0.20.4.This change:
h2crate from0.4.12to0.4.19(patched>= 0.4.16) viaCargo.lock.git2dependency from0.20.4to0.21.0, which patches RUSTSEC-2026-0183 and RUSTSEC-2026-0184.shorthand,url,StatusEntry::path) that now returnResultinstead ofOption.StatusEntry::path.default-features = falseis unchanged; this crate does not use git2 SSH/HTTPS transports.Test plan
cargo auditreports no vulnerabilities and no remaining git2 unsound warningscargo test— 747 passed, 0 failed (git2-backedget_repo_info*,git:untracked, scan include-image, HTTP/e2e paths that pull inh2via hyper/reqwest)cargo clippy --all-targets -- -D warningsandcargo fmt --check