misc/codewhale - patch for a 'cargo audit' failure u2 crate bump. Already in upstream, so next release won't need that patch.

[ci4ic4 (via pkgsrc-wip) <commit-notify%pkgsrc.org@localhost>]

Module Name:	pkgsrc-wip
Committed By:	ci4ic4 <ci4ic4%gmail.com@localhost>
Pushed By:	ci4ic4
Date:		Tue Aug 18 16:42:59 2026 +0100
Changeset:	a4b47f2f27835f06aa2d91250362afad3c87e82a

Modified Files:
	CodeWhale/cargo-depends.mk
	CodeWhale/distinfo
Added Files:
	CodeWhale/patches/patch-Cargo.lock

Log Message:
misc/codewhale - patch for a 'cargo audit' failure u2 crate bump.
Already in upstream, so next release won't need that patch.

To see a diff of this commit:
https://wip.pkgsrc.org/cgi-bin/gitweb.cgi?p=pkgsrc-wip.git;a=commitdiff;h=a4b47f2f27835f06aa2d91250362afad3c87e82a

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

diffstat:
 CodeWhale/cargo-depends.mk         |  2 +-
 CodeWhale/distinfo                 |  7 ++++---
 CodeWhale/patches/patch-Cargo.lock | 19 +++++++++++++++++++
 3 files changed, 24 insertions(+), 4 deletions(-)

diffs:
diff --git a/CodeWhale/cargo-depends.mk b/CodeWhale/cargo-depends.mk
index 03d1fe1783..603b69b39a 100644
--- a/CodeWhale/cargo-depends.mk
+++ b/CodeWhale/cargo-depends.mk
@@ -188,7 +188,7 @@ CARGO_CRATE_DEPENDS+=	globset-0.4.20
 CARGO_CRATE_DEPENDS+=	globwalk-0.8.1
 CARGO_CRATE_DEPENDS+=	globwalk-0.9.1
 CARGO_CRATE_DEPENDS+=	granit-parser-0.0.7
-CARGO_CRATE_DEPENDS+=	h2-0.4.15
+CARGO_CRATE_DEPENDS+=	h2-0.4.16
 CARGO_CRATE_DEPENDS+=	half-2.7.1
 CARGO_CRATE_DEPENDS+=	hashbrown-0.15.5
 CARGO_CRATE_DEPENDS+=	hashbrown-0.16.1
diff --git a/CodeWhale/distinfo b/CodeWhale/distinfo
index aedd13172a..b82b54c0d6 100644
--- a/CodeWhale/distinfo
+++ b/CodeWhale/distinfo
@@ -567,9 +567,9 @@ Size (globwalk-0.9.1.crate) = 12572 bytes
 BLAKE2s (granit-parser-0.0.7.crate) = 5968655843256c4afe7c147cb2e1cfb9f4c88776613a74f0fa72c18c6d0ecf56
 SHA512 (granit-parser-0.0.7.crate) = dd9cb1e6768540b670b3201c029a0df6eb3a67cf7a497f44da0e452615982a974488d948c709033437f3aced4d247c560518c556e1df30ccac3d6d4d7611ae60
 Size (granit-parser-0.0.7.crate) = 160073 bytes
-BLAKE2s (h2-0.4.15.crate) = 669748aa4d28647cdd8ee7eaff686c01ff4765db641c393a1d314a93f51ec285
-SHA512 (h2-0.4.15.crate) = 29abdb66d3956b4fc0739b7245e7ab5cab1f019fbee6f4687f9efaca1c077a4484ff9b53139d9110544654dd47e09d7599bc55f1b1af3bbd1d5263ae2b2880a6
-Size (h2-0.4.15.crate) = 180875 bytes
+BLAKE2s (h2-0.4.16.crate) = 512cee5c682ab8dc61cd958566f8227bb6fb52c5d6e08f4be421109956b5573e
+SHA512 (h2-0.4.16.crate) = 83ffd31da83b88588d42b7c41ab54282006d248372f8e672b7f327404888e841e6a6b033fc1046b5592a3dafa83597768f6ac2d88a21d6b5cfbc8d31a0a3c004
+Size (h2-0.4.16.crate) = 173331 bytes
 BLAKE2s (half-2.7.1.crate) = 6dc03241ebe563191babc40781e79b04c3c79285330b7668158f50df4a4a562e
 SHA512 (half-2.7.1.crate) = f47cc8bfb4c754a8585d4e8eca1a35039dc0879e87e59acb72e91bf2d33eca8c4f8dd17b3a56e8953bcba62cb08122120866e9d4b3ab9f008847d86a5f81716d
 Size (half-2.7.1.crate) = 61040 bytes
@@ -1998,3 +1998,4 @@ Size (zvariant_derive-4.2.0.crate) = 11057 bytes
 BLAKE2s (zvariant_utils-2.1.0.crate) = b142d63425365aedf109bafac551bf52a32897836b938d4835a415a0444db92c
 SHA512 (zvariant_utils-2.1.0.crate) = 345b70d1106b37df41426efdb1ba49bf270e00898381c2a8021b5761c59efdea55def45cb2e2598b130b6cba8733503f3997a55578bca90867ab3e8f2346f80e
 Size (zvariant_utils-2.1.0.crate) = 7043 bytes
+SHA1 (patch-Cargo.lock) = 0b4ba6b9618879abaa27e5b075dce86c2772a845
diff --git a/CodeWhale/patches/patch-Cargo.lock b/CodeWhale/patches/patch-Cargo.lock
new file mode 100644
index 0000000000..e28bc1d563
--- /dev/null
+++ b/CodeWhale/patches/patch-Cargo.lock
@@ -0,0 +1,19 @@
+$NetBSD$
+
+Bump vendored h2 crate to 0.4.16 to fix RUSTSEC-2026-0258 (unbounded
+memory growth from empty DATA frames queued without limit).
+
+--- Cargo.lock.orig
++++ Cargo.lock
+@@ -2215,9 +2215,9 @@
+ 
+ [[package]]
+ name = "h2"
+-version = "0.4.15"
++version = "0.4.16"
+ source = "registry+https://github.com/rust-lang/crates.io-index";
+-checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155"
++checksum = "a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27"
+ dependencies = [
+  "atomic-waker",
+  "bytes",