From 0029e9f728d4ef17de80dae66b8b44fc3181de87 Mon Sep 17 00:00:00 2001
From: Justin Purnell <jpurnell@users.noreply.github.com>
Date: Fri, 2 Oct 2026 11:28:34 -0400
Subject: [PATCH] chore(deps): move swift-nio past its 2026 advisories

swift-nio 2.103.0 fixes GHSA-rj37-6j9x-74q6 (unbounded HTTP/1 header blocks, HIGH),
GHSA-r3rc-9hpw-54v9 (ByteBuffer out-of-bounds write, HIGH) and GHSA-cq87-8r7h-962v
(CRLF in outbound request URI). Where pinned, swift-nio-http2 1.46.0 fixes
GHSA-4px2-pw77-vc85 and GHSA-q3g2-m552-3r9c, and swift-nio-extras 1.35.1 fixes
GHSA-6ph5-fww6-vfwv. Lockfile only unless a library declared the old floor.
Build and tests pass on the new pins.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0114bFC1osyZq6nFD4QrXDD2
---
 Package.resolved | 14 +++++++-------
 Package.swift    |  2 +-
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/Package.resolved b/Package.resolved
index bc4ab3f..69616db 100644
--- a/Package.resolved
+++ b/Package.resolved
@@ -1,5 +1,5 @@
 {
-  "originHash" : "558274c4daf2df87310e61e2907656358382c7c81648015d85f6ec205e275320",
+  "originHash" : "9b200c4bb58354a1395bedae996bffb7cc7f7f25f53c9d40c9f09d299a25cba4",
   "pins" : [
     {
       "identity" : "async-http-client",
@@ -159,8 +159,8 @@
       "kind" : "remoteSourceControl",
       "location" : "https://github.com/apple/swift-nio.git",
       "state" : {
-        "revision" : "bdf004b44f77c56fca752cd1cf243c802f8469c9",
-        "version" : "2.97.0"
+        "revision" : "21de5f08c1a166a6dd293d0e587ad977bf8dac5d",
+        "version" : "2.103.0"
       }
     },
     {
@@ -168,8 +168,8 @@
       "kind" : "remoteSourceControl",
       "location" : "https://github.com/apple/swift-nio-extras.git",
       "state" : {
-        "revision" : "abcf5312eb8ed2fb11916078aef7c46b06f20813",
-        "version" : "1.33.0"
+        "revision" : "41449336c8ecfadac6b4b5be75f9c3c306e61ced",
+        "version" : "1.35.1"
       }
     },
     {
@@ -177,8 +177,8 @@
       "kind" : "remoteSourceControl",
       "location" : "https://github.com/apple/swift-nio-http2.git",
       "state" : {
-        "revision" : "6d8d596f0a9bfebb925733003731fe2d749b7e02",
-        "version" : "1.42.0"
+        "revision" : "0f3e54e29c944c2e835ad52159da7d9e1c94ac69",
+        "version" : "1.46.0"
       }
     },
     {
diff --git a/Package.swift b/Package.swift
index 630615a..964b86e 100644
--- a/Package.swift
+++ b/Package.swift
@@ -116,7 +116,7 @@ let package = Package(
         .package(url: "https://github.com/swift-server/async-http-client.git", from: "1.24.0"),
         // Already present transitively via websocket-kit; declared because the OAuth loopback
         // listener uses it directly.
-        .package(url: "https://github.com/apple/swift-nio.git", from: "2.65.0"),
+        .package(url: "https://github.com/apple/swift-nio.git", from: "2.100.0"),
         .package(url: "https://github.com/apple/swift-crypto.git", from: "3.0.0"),
         .package(url: "https://github.com/vapor/websocket-kit.git", from: "2.15.0"),
         .package(url: "https://github.com/swiftlang/swift-docc-plugin", from: "1.4.3"),