fix: bump h2 for RUSTSEC-2026-0258 - #6222
Merged
Merged
Conversation
Signed-off-by: loganj <loganj@squareup.com>
salman1993
approved these changes
Aug 18, 2026
salman1993
marked this pull request as ready for review
August 18, 2026 14:56
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2d6e06cb0c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| [[package]] | ||
| name = "h2" | ||
| version = "0.4.14" | ||
| version = "0.4.16" |
There was a problem hiding this comment.
This commit has no Signed-off-by trailer, so the repository's required DCO check will reject it regardless of the valid lockfile update. Recreate or rebase the commit with --signoff before submitting it.
AGENTS.md reference: AGENTS.md:L132-L132
Useful? React with 👍 / 👎.
wesbillman
approved these changes
Aug 18, 2026
bhargavms
pushed a commit
to EWA-Services/buzz
that referenced
this pull request
Aug 18, 2026
🤖 ## Summary - Bump the locked `h2` version from `0.4.14` to `0.4.16` to clear RUSTSEC-2026-0258, which affects h2 versions through `0.4.15`. - Keep the change lockfile-only; no manifest or product-code changes are included. ## Details - `h2` is now `0.4.16` with checksum `a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27`. - The lockfile was regenerated by `cargo update -p h2 --precise 0.4.16` using Cargo 1.95.0 / rustc 1.95.0, matching `rust-toolchain.toml` and the CI pin. - Cargo's canonical resolver output also rewrites 16 dependency references to existing `windows-sys` package entries: - `anstyle-query 1.1.5`, `anstyle-wincon 3.0.11`, `socket2 0.6.3`, `termina 0.3.3`, and `uds_windows 1.2.1`: `0.61.2` → `0.60.2`. - `dirs-sys 0.5.0` and `nu-ansi-term 0.50.3`: `0.59.0` → `0.60.2`. - `colored 3.1.1`, `errno 0.3.14`, `quinn-udp 0.5.14`, `rustix 0.38.44`, `rustix 1.1.4`, `rustls-platform-verifier 0.7.0`, `seize 0.5.1`, `tempfile 3.27.0`, and `winapi-util 0.1.11`: `0.59.0` → `0.52.0`. - All four referenced `windows-sys` versions (`0.52.0`, `0.59.0`, `0.60.2`, and `0.61.2`) were already present in the baseline lockfile. There are zero new package entries or checksums, and the only package record replacement is `h2 0.4.14` → `0.4.16`. There is no `wasmtime` edge change. ## Validation - `cargo-deny check` passed. - `cargo build --workspace` passed. - `just test-unit` passed: 455 passed, 0 failed, 1 ignored; all nine package suites passed. Signed-off-by: loganj <loganj@squareup.com> Signed-off-by: bhargavms <bhargav.m@ewa-services.com>
sandro-sq
added a commit
that referenced
this pull request
Aug 18, 2026
* origin/main: (78 commits) Polish mobile timeline navigation (#5874) chore(release): release Buzz Desktop version 0.5.17 (#6234) fix(prompt): simplify pickup follow-through (#6186) fix(mcp): scope todo usage (#6216) fix(desktop): bound remote agent mention authorization (#6224) fix: bump h2 for RUSTSEC-2026-0258 (#6222) fix(desktop): bind presence retry timers (#6213) ci: make file-size policy a first-class gate (#6187) fix(desktop): eliminate mounted-view CPU burn — compositor-safe shimmer, observer append fast path, poll-tick disk reads (#6198) chore(release): release Buzz Desktop version 0.5.16 (#6191) fix(desktop): restore release agent mentions (#6182) test(desktop): cover exact workflow batch limit (#6168) chore(release): release Buzz Desktop version 0.5.15 (#6173) Preserve managed agent mentions during relay errors (#6167) fix(workflows): preserve multi-channel listing semantics (#6009) Remove Startup Recovery section in base prompt (#6161) fix(desktop): align preview sidebar row styling (#6163) fix(desktop): repair dropped team membership links at boot and on edit (#5904) fix(cli): keep project replacement timestamps at or after wall clock (#5666) Remove GitHub security advisory commitment (#6144) ... Signed-off-by: Alessandro Joabar <sandro@squareup.com>
tlongwell-block
pushed a commit
that referenced
this pull request
Aug 18, 2026
Co-authored-by: Eva <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz> Signed-off-by: Eva <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz> * origin/main: Polish mobile timeline navigation (#5874) chore(release): release Buzz Desktop version 0.5.17 (#6234) fix(prompt): simplify pickup follow-through (#6186) fix(mcp): scope todo usage (#6216) fix(desktop): bound remote agent mention authorization (#6224) fix: bump h2 for RUSTSEC-2026-0258 (#6222) Signed-off-by: Eva <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>
wpfleger96
pushed a commit
that referenced
this pull request
Aug 18, 2026
…c-agent-commit-identity * origin/main: Polish mobile timeline navigation (#5874) chore(release): release Buzz Desktop version 0.5.17 (#6234) fix(prompt): simplify pickup follow-through (#6186) fix(mcp): scope todo usage (#6216) fix(desktop): bound remote agent mention authorization (#6224) fix: bump h2 for RUSTSEC-2026-0258 (#6222) fix(desktop): bind presence retry timers (#6213) ci: make file-size policy a first-class gate (#6187) fix(desktop): eliminate mounted-view CPU burn — compositor-safe shimmer, observer append fast path, poll-tick disk reads (#6198) chore(release): release Buzz Desktop version 0.5.16 (#6191) fix(desktop): restore release agent mentions (#6182) test(desktop): cover exact workflow batch limit (#6168) chore(release): release Buzz Desktop version 0.5.15 (#6173) Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
jedwards27
pushed a commit
to jedwards27/buzz
that referenced
this pull request
Aug 18, 2026
* origin/main: (43 commits) perf(desktop): parallelize relay agent directory rebuild (block#6258) Refine the mobile emoji picker (block#5853) fix(desktop): exclude archived agents from nest, order regeneration (block#5905) Add font size and conversation density preferences (block#5644) fix(desktop): emit camelCase config-write payload fields (block#6062) fix(desktop): downscale large avatars for agent-share PNG body (block#6260) fix(desktop): preserve early relay auth challenges (block#3320) Polish mobile message actions (block#5873) Refine mobile pairing confirmation (block#6018) chore(scripts): add buzz-adopt-prod-agents.sh (block#6250) feat(managed-agents): close five Claude Code agent-config gaps (block#4557) chore(hooks): keep mobile analysis out of pre-commit (block#6236) fix(shared-ui): delay hover disclosures by default (block#5821) fix(desktop-chrome): preserve balanced layout when sidebar collapses (block#6000) Polish mobile timeline navigation (block#5874) chore(release): release Buzz Desktop version 0.5.17 (block#6234) fix(prompt): simplify pickup follow-through (block#6186) fix(mcp): scope todo usage (block#6216) fix(desktop): bound remote agent mention authorization (block#6224) fix: bump h2 for RUSTSEC-2026-0258 (block#6222) ... Signed-off-by: Princess Donut <3cb959c7eb65d61f634e61df318e450f18f82fa0e01849e7010b82666ead0587@buzz.block.builderlab.xyz> # Conflicts: # desktop/src/main.tsx # mobile/ios/Podfile.lock
idk-its-unknown
added a commit
to idk-its-unknown/buzz
that referenced
this pull request
Aug 19, 2026
…esktop lock Four issues the merge-review swarm caught in the merge commit, none surfaced as textual conflicts: - agent_settings.rs: set_managed_agent_avatar still called the old inline build_managed_agent_summary (upstream dropped its import AND added a 6th `teams` arg, moving every peer to summarize_from_disk). Switched to super::agents::summarize_from_disk — matches upstream + the 3 other sites. - personas/inbound.rs: our phantom-twin guard returned Ok(()); upstream changed the fn to Result<Option<InboundRuntimeRefresh>>. Now Ok(None). - desktop Cargo.lock: h2 0.4.15 -> 0.4.16 (RUSTSEC-2026-0258). Upstream block#6222 bumped only the root lock; the desktop binary builds from this one. - unifiedAgentGroups.ts: reverted the Remote-agents group to unconditional visibility. A fleet mirror reflects the remote harness, not local archive state, and has no persona-group fallback — archive-filtering it would drop it from every bucket. Preserves the pre-merge fork contract; docstring now accurate again. Committed HEAD 5abce86 did not compile; this is the compile fix. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
klopez4212
added a commit
that referenced
this pull request
Aug 19, 2026
Pull in h2 0.4.16 (RUSTSEC-2026-0258 fix, #6222) to clear the Security advisory. No feature-code changes. Co-authored-by: Mongo <9cfd347903944d5b85aa6c93d2ab67381b978a92a31914bca69998968752a1d7@buzz.block.builderlab.xyz> Signed-off-by: kenny lopez <klopez4212@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖
Summary
h2version from0.4.14to0.4.16to clear RUSTSEC-2026-0258, which affects h2 versions through0.4.15.Details
h2is now0.4.16with checksuma9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27.cargo update -p h2 --precise 0.4.16using Cargo 1.95.0 / rustc 1.95.0, matchingrust-toolchain.tomland the CI pin.windows-syspackage entries:anstyle-query 1.1.5,anstyle-wincon 3.0.11,socket2 0.6.3,termina 0.3.3, anduds_windows 1.2.1:0.61.2→0.60.2.dirs-sys 0.5.0andnu-ansi-term 0.50.3:0.59.0→0.60.2.colored 3.1.1,errno 0.3.14,quinn-udp 0.5.14,rustix 0.38.44,rustix 1.1.4,rustls-platform-verifier 0.7.0,seize 0.5.1,tempfile 3.27.0, andwinapi-util 0.1.11:0.59.0→0.52.0.windows-sysversions (0.52.0,0.59.0,0.60.2, and0.61.2) were already present in the baseline lockfile. There are zero new package entries or checksums, and the only package record replacement ish2 0.4.14→0.4.16. There is nowasmtimeedge change.Validation
cargo-deny checkpassed.cargo build --workspacepassed.just test-unitpassed: 455 passed, 0 failed, 1 ignored; all nine package suites passed.