Skip to content

fix(deps): bump h2 for RUSTSEC-2026-0258, fix new clippy unused_async_trait_impl lint - #235

Merged
StefanSteiner merged 1 commit into
tableau:mainfrom
StefanSteiner:fix/h2-rustsec-and-clippy-lint
Aug 25, 2026
Merged

fix(deps): bump h2 for RUSTSEC-2026-0258, fix new clippy unused_async_trait_impl lint#235
StefanSteiner merged 1 commit into
tableau:mainfrom
StefanSteiner:fix/h2-rustsec-and-clippy-lint

Conversation

@StefanSteiner

Copy link
Copy Markdown
Contributor

Summary

Fixes CI failures on main after the recent batch of Dependabot merges (#221-#233):

  1. cargo-audit / cargo-deny failuresh2 v0.4.14 has an unbounded-empty-DATA-frames vulnerability, RUSTSEC-2026-0258 (fix: upgrade to >=0.4.16). Bumped to v0.4.19 via a targeted Cargo.lock edit (version + checksum only — the dependency list is identical between versions) rather than cargo update -p h2. That command triggers an unrelated resolver re-shuffle of several other crates' windows-sys pointer (0.61.2 → 0.60.2/0.52.0) with zero security benefit — verified in an isolated clone that this happens with cargo update -p h2 alone on pristine main, before any other change.

  2. clippy failure — CI's stable toolchain pin moved to 1.98.0, which introduced clippy::unused_async_trait_impl (a new lint distinct from the existing clippy::unused_async). This flagged:

    • GrpcClient::close and AuthenticatedGrpcClient::close (hyperdb-api-core/src/client/grpc/{client,authenticated_client}.rs) — both already had #[expect(clippy::unused_async, ...)] for the same "async fn retained for API symmetry" reason; extended both to also list clippy::unused_async_trait_impl.
    • The ServerHandler impl in hyperdb-mcp/src/server.rs — several trait methods with no .await points, plus the #[tool_handler]/#[prompt_handler] macro expansions. Added one #[expect(clippy::unused_async_trait_impl, ...)] on the impl block, which covers all of them.

    Note: the original CI failure only reported the hyperdb-api-core clippy error, because hyperdb-mcp never got compiled once its upstream dependency failed. Fixing just that one revealed the hyperdb-mcp findings too — this PR fixes all of them.

No public API surface changed, so no CHANGELOG.md entry.

Test plan

All run locally with CI's exact toolchain (rustc/clippy 1.98.0, matching CI's stable pin) and exact flags:

  • cargo audit --deny warnings — clean
  • cargo deny checkadvisories ok, bans ok, licenses ok, sources ok
  • HYPERD_PATH=... cargo clippy --workspace --all-targets --all-features -- -D warnings — clean
  • cargo fmt --all -- --check — clean
  • HYPERD_PATH=... cargo build --workspace --locked — clean (confirms the hand-edited Cargo.lock is fully consistent, no silent resolver rewrite)
  • HYPERD_PATH=... cargo test --workspace — 114 passed, 0 failed, 8 ignored

…_trait_impl lint

h2 0.4.14 had an unbounded empty DATA frames vulnerability
(RUSTSEC-2026-0258); bumped to 0.4.19 (>=0.4.16 required) via a
targeted Cargo.lock edit rather than `cargo update -p h2`, which
triggers an unrelated resolver re-shuffle of several other crates'
windows-sys pointer with no security benefit.

CI's clippy job also started failing after the toolchain's `stable`
pin moved to 1.98.0, which introduced clippy::unused_async_trait_impl.
Extended the existing unused_async suppressions on GrpcClient::close
and AuthenticatedGrpcClient::close, and added one on the
ServerHandler impl in hyperdb-mcp (covering the tool_handler/
prompt_handler macro expansions too) — all deliberately async for API
symmetry despite having no await points.
@StefanSteiner
StefanSteiner merged commit 753d1f5 into tableau:main Aug 25, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant