Security: swift-nio-http2 advisory has no patched release yet — bump when 1.44.1 ships

[testtest126]

chess-server/Package.resolved pins swift-nio-http2 1.44.0, and GitHub security advisories flag all versions < 1.44.1. Dependabot's security-update job for it is failing on main (run 29064383475) because swift-nio-http2 is a transitive dependency (via Vapor) — SwiftPM Dependabot can't bump it directly.

Fix is a one-liner in /chess-server:

swift package update swift-nio-http2

then commit the regenerated Package.resolved (1.44.1 satisfies Vapor's version ranges). Worth doing promptly since this is the HTTP/2 stack of the public-facing server.

Note: coordinate with #21 (JWT 5 migration), which also touches Package.resolved — whichever lands second just re-resolves.

[testtest126]

Correction after investigating: the premise above is wrong. 1.44.0 is the newest swift-nio-http2 release (git ls-remote --tags shows nothing after 1.44.0), and the advisory's patched-versions list is empty — the fixed 1.44.1 has not shipped. That's also the real reason the Dependabot security job fails: there is nothing to update to yet. Verified by running swift package update swift-nio-http2 on a clean checkout: the resolver correctly keeps 1.44.0.

Action for this issue: watch for the swift-nio-http2 1.44.1 release and re-run swift package update swift-nio-http2 in /chess-server then. Until it ships, no code change is possible here.

[testtest126]

Checked 2026-07-11: still no patched release upstream — apple/swift-nio-http2 newest release remains 1.44.0 (2026-05-21), and the advisory's patched-versions list is still empty. Nothing to bump yet; re-check on the next sweep.

[testtest126]

Claimed — swift-nio-http2 bump session, 2026-07-11