actix-http: Bump h2 to fix a resource exhaustion vulnerability

[brunojppb]

PR Type

Bump h2 to fix a resource exhaustion vulnerability.

PR Checklist

• Tests for the changes have been added / updated.
• Documentation comments have been added / updated.
• A changelog entry has been made for the appropriate packages.
• Format code with the latest stable rustfmt.
• (Team) Label with affected crates and semver status.

Overview

This has been reported by Github on one of my projects, so I thought I could just raise this upstream.

You can check the Github Advisory database entry here:
GHSA-8r5v-vm4m-4g25

[robjtede]

This is usually a no-op for library crates (solved downstream with a cargo update -p=h2) but it will clear the warning on https://deps.rs/crate/actix-http/3.5.1 so happy to accept.

[brunojppb]

This is usually a no-op for library crates (solved downstream with a cargo update -p=h2) but it will clear the warning on https://deps.rs/crate/actix-http/3.5.1 so happy to accept.

Thanks @robjtede! 🙌
Appreciate that!