Remove RUSTSEC-2026-0258 suppression once actix-http drops h2 0.3

[mohamedmansour]

deny.toml currently suppresses RUSTSEC-2026-0258 (h2 0.3 empty DATA frame DoS), which reaches the workspace transitively through actix-http/awc in the dev-server.

# h2 0.3 (transitive dep of actix-http/awc) — low-severity empty DATA frame DoS;
# actix-http 3.13.3 still pins h2 0.3 and that series has no patched release
"RUSTSEC-2026-0258",

At the time it was added, actix-http 3.13.3 still pinned h2 0.3 and that series had no patched release, so there was no upgrade path.

This issue exists so the suppression is re-evaluated rather than left in place indefinitely.

Action

Once actix-http ships a release that depends on h2 >= 0.4 (or the 0.3 series receives a patched release):

1. Bump the affected dependency.
2. Remove the RUSTSEC-2026-0258 entry from deny.toml.
3. Confirm cargo xtask deny passes without it.

Notes

• Only the dev-server dependency closure is affected. The published renderer packages (Rust crates, Node addon, Python wheels, FFI) do not depend on h2 or actix.