fix(deps): bump h2 to 0.4.18 to fix RUSTSEC-2026-0258

[lym953]

Overview

The Audit check (cargo-audit) is failing on main: RUSTSEC-2026-0258 — h2 accepts and queues empty DATA frames without limit, which can lead to unbounded memory usage or a panic on length overflow. Low severity, patched in h2 0.4.16.

This bumps h2 0.4.13 → 0.4.18 in bottlecap/Cargo.lock. Lockfile-only; no source changes.

Notes on the diff:

• LICENSE-3rdparty.csv is unchanged. h2 is already listed there (the CSV carries no versions) and no crates were added or removed, so dd-rust-license-tool write produces no change for this bump.
• The diff is restricted to the two h2 lines. Running cargo update -p h2 locally also re-resolved six unrelated windows-sys entries downward (0.61.2 → 0.52.0/0.60.2); that churn was reverted, and cargo metadata --locked confirms the lockfile is still self-consistent.

Testing

• cargo audit locally on the updated lockfile: 0 vulnerabilities. The 9 remaining unmaintained/unsound warnings are pre-existing on main and are not what fails the check (the job failed on "Critical vulnerabilities were found").
• cargo metadata --locked succeeds, i.e. the hand-edited lockfile needs no further resolution.
• No Rust source changed, so cargo clippy / cargo fmt were not re-run; CI covers the build.

🤖 Generated with Claude Code

[datadog-official]

⚠️ Warnings

🚦 1 Pipeline job failed

DataDog/datadog-lambda-extension | bottlecap (arm64) — 🔄 Retry may pass, looks flaky

View in Datadog · View in GitLab

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 157302a | Docs | View more details | Give us feedback!}