Vouch request: aeonframework

[aeonframework]

What do you want to work on?

Small one, not an issue-linked feature. Want to bump the h2 crate to the patched release that fixes RUSTSEC-2026-0258 (GHSA-q83h-524g-xf6h) - the unbounded empty-DATA-frame issue where a peer can stream endless empty DATA frames and pin CPU/memory on the h2 server side. It's a dependency bump plus the lockfile, no code logic change. I saw h2 in the tree via your gRPC/HTTP listener path and osv flags the pulled-in version.

Why this change?

It's a live advisory sitting in a dep you ship, and it's a cheap, low-risk fix - patch release, same minor line, no API changes. Figured it's a clean first contribution and keeps the DoS surface off your HTTP/2 stack. I understand it end to end: it's a version pin, the fix is upstream in h2 itself, and the only thing to watch is that nothing else pins the old range.

Checklist

• I wrote this request myself (not AI-generated)
• I have read CONTRIBUTING.md