Remove RUSTSEC-2026-0258 suppression once actix-http drops h2 0.3
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 55/100
Research direction
Check the actix-http dependency version and its h2 requirement in the dev-server closure. When h2 0.4 or a patched h2 0.3 release is available, update the affected dependency, remove RUSTSEC-2026-0258 from deny.toml, and run cargo xtask deny to confirm the suppression is no longer needed.
Written by the indexing model from the issue text.
Description
deny.toml currently suppresses RUSTSEC-2026-0258 (h2 0.3 empty DATA frame DoS), which reaches the workspace transitively through actix-http/awc in the dev-server.
# h2 0.3 (transitive dep of actix-http/awc) — low-severity empty DATA frame DoS;
# actix-http 3.13.3 still pins h2 0.3 and that series has no patched release
"RUSTSEC-2026-0258",
At the time it was added, actix-http 3.13.3 still pinned h2 0.3 and that series had no patched release, so there was no upgrade path.
This issue exists so the suppression is re-evaluated rather than left in place indefinitely.
Action
Once actix-http ships a release that depends on h2 >= 0.4 (or the 0.3 series receives a patched release):
- Bump the affected dependency.
- Remove the
RUSTSEC-2026-0258entry fromdeny.toml. - Confirm
cargo xtask denypasses without it.
Notes
- Only the dev-server dependency closure is affected. The published renderer packages (Rust crates, Node addon, Python wheels, FFI) do not depend on
h2oractix.
- Dominant language
- Rust
- Stars
- 90
- Forks
- 23
- Avg merge
- 13h 3m
- Merged PRs (30d)
- 64
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microsoft/webui
-
Difficulty 4/5 3-5 days Newbie friendliness 58/100
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 35/100
-
enhancement
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
-
enhancement
Difficulty 4/5 3-5 days Newbie friendliness 64/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Eynzof/Hermes-CN-Desktop#610 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
bug team:backend track:services-maintenance
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
cowprotocol/services#4950 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
gitbutlerapp/gitbutler#15998 · 1 comment ·