chore(deps): update h2 dependency#9038
Conversation
Adds h2 as an explicit workspace dependency with a minimum version of 0.4.13 to ensure the router picks up the latest patch release. Without an explicit declaration, h2 is only a transitive dependency and Renovate will not manage it, leaving the version pinned in Cargo.lock indefinitely unless someone manually runs cargo update. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds h2.workspace = true to apollo-router/Cargo.toml so the minimum version floor declared in [workspace.dependencies] is actually enforced by the cargo resolver, and Renovate can manage future bumps via the workspace entry. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replaces the previous Cargo.lock update (which contained 7 unintended resolver re-selections of socket2 and windows-sys versions) with a targeted cargo update -p h2 --precise 0.4.13. Only h2 and its entry in the apollo-router dependency list change. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…deps The [workspace.dependencies] table is for deps used in more than one workspace member. h2 is a transitive-only dep being pinned, so it belongs directly in apollo-router/Cargo.toml following the same pattern as the existing socket2 declaration. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…aroline/router-1659-h2-update
✅ Docs preview has no changesThe preview was not built because there were no changes. Build ID: 91738fd4bd5e35fa4569b7f0 ✅ AI Style Review — No Changes DetectedNo MDX files were changed in this pull request. Review Log: View detailed log
|
| @@ -0,0 +1,11 @@ | |||
| ### Pin transitive `h2` dependency at minimum v0.4.13 to pick up critical flow-control, deadlock, and tracing fixes ([PR #9033](https://github.com/apollographql/router/pull/9033)) | |||
|
|
|||
| `h2` 0.4.13 (released January 5, 2026) contains three fixes directly relevant to the router, which uses h2 exclusively as a client when connecting to subgraphs: | |||
There was a problem hiding this comment.
I missed correcting this in my original PR... h2 is often used, but not exclusively used
|
@Mergifyio backport 2.10.3 |
✅ Backports have been createdDetails
Cherry-pick of 5999837 has failed: To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally |
This is a hidden dependency of hyper and tonic. There are a few changes in the latest release that we want to adopt (see the changeset).
Closes #9033.
Checklist
Complete the checklist (and note appropriate exceptions) before the PR is marked ready-for-review.
Exceptions
Note any exceptions here
Notes
Footnotes
It may be appropriate to bring upcoming changes to the attention of other (impacted) groups. Please endeavour to do this before seeking PR approval. The mechanism for doing this will vary considerably, so use your judgement as to how and when to do this. ↩
Configuration is an important part of many changes. Where applicable please try to document configuration examples. ↩
A lot of (if not most) features benefit from built-in observability and
debug-level logs. Please read this guidance on metrics best-practices. ↩Tick whichever testing boxes are applicable. If you are adding Manual Tests, please document the manual testing (extensively) in the Exceptions. ↩