[solderzzc]

Summary

Bumps three transitive pins in Package.resolved to their first patched versions, clearing five open Dependabot alerts (2 high, 3 medium). Package.swift is unchanged.

Package	From	To	Advisories
swift-nio	2.99.0	2.100.0	GHSA-rj37-6j9x-74q6 (high), GHSA-r3rc-9hpw-54v9 (high), GHSA-cq87-8r7h-962v (medium)
swift-nio-http2	1.43.0	1.44.0	GHSA-4px2-pw77-vc85 (medium)
swift-nio-extras	1.34.0	1.34.1	GHSA-6ph5-fww6-vfwv (medium)

Reachability in SwiftLM

• GHSA-rj37-6j9x-74q6 (swift-nio, unbounded HTTP/1 header count): reachable. The default listener is HTTP/1. The fix is the reason this PR exists. Behavior change: swift-nio 2.100.0 applies default limits to header count and total header size, so requests above them are rejected.
• GHSA-r3rc-9hpw-54v9 (ByteBuffer UInt32 truncation): likely not reachable. Request bodies are capped well below the 4 GiB limit.
• GHSA-cq87-8r7h-962v (outbound CRLF): not reachable. SwiftLM does not use NIO for outbound HTTP; outbound traffic goes through URLSession.
• GHSA-4px2-pw77-vc85 (swift-nio-http2) and GHSA-6ph5-fww6-vfwv (swift-nio-extras): not linked. Bumped for lockfile hygiene only.

Verification

• swift package resolve accepts the pinned revisions and changes no other entries in Package.resolved.
• SwiftLM's direct NIOCore use is limited to ByteBuffer(string:), ByteBuffer(data:) and IOError.
• Not built locally. CI is the compile check.

Test plan

• CI build_and_unit_test passes
• Integration matrix passes
• Manual check with a client that sends many headers, to confirm the new default limits are acceptable

🤖 Generated with Claude Code