From e619648c82e7c3cb7391e06fdff93d13f313d72c Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Tue, 18 Aug 2026 14:28:04 +0000
Subject: [PATCH 1/2] fix: fix Axum header string literal panic

Axum's IntoHeaderName trait panics at runtime if a string literal contains uppercase letters. Updated "X-Total-Count" to "x-total-count" in api/repos.rs to prevent this Denial of Service vulnerability.
---
 .jules/sentinel.md                   | 5 +++++
 crates/gitlawb-node/src/api/repos.rs | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 .jules/sentinel.md

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 00000000..d8c0bf14
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,5 @@
+
+## 2026-08-18 - Axum Header String Literal Panic
+**Vulnerability:** Application crashes (Denial of Service) when inserting custom headers into Axum HTTP responses using uppercase string literals (e.g., `"X-Total-Count"`).
+**Learning:** Axum uses `HeaderName` which implicitly converts string literals via `IntoHeaderName`. The conversion expects all string literals to be entirely lowercase. If any uppercase letters are present, the conversion panics at runtime. This can lead to unhandled crashes if an endpoint receives requests triggering this path.
+**Prevention:** Always use lowercase string literals (e.g., `"x-total-count"`) when inserting headers manually, or preferably use `axum::http::header::*` constants.
diff --git a/crates/gitlawb-node/src/api/repos.rs b/crates/gitlawb-node/src/api/repos.rs
index b09cb6da..2bf40162 100644
--- a/crates/gitlawb-node/src/api/repos.rs
+++ b/crates/gitlawb-node/src/api/repos.rs
@@ -369,7 +369,7 @@ pub async fn list_repos(
         .collect();
     let mut response = Json(body).into_response();
     response.headers_mut().insert(
-        "X-Total-Count",
+        "x-total-count",
         HeaderValue::from_str(&total.to_string()).unwrap_or(HeaderValue::from_static("0")),
     );
     Ok(response)

From b50143172afce145695fe85d2758792dcb571c2d Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Tue, 18 Aug 2026 14:58:56 +0000
Subject: [PATCH 2/2] fix: fix Axum header string literal panic & update
 vulnerable deps

Axum's IntoHeaderName trait panics at runtime if a string literal contains uppercase letters. Updated "X-Total-Count" to "x-total-count" in api/repos.rs to prevent this Denial of Service vulnerability.
Also updated h2 to >=0.4.16 and hyper to 1.11.0 to address RUSTSEC-2026-0258 (h2 unbounded empty DATA frames vulnerability).
---
 Cargo.lock | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index b7050bc6..581ed63a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2630,7 +2630,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7ab67060fc6b8ef687992d439ca0fa36e7ed17e9a0b16b25b601e8757df720de"
 dependencies = [
  "data-encoding",
- "syn 2.0.117",
+ "syn 1.0.109",
 ]
 
 [[package]]
@@ -3002,7 +3002,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -3542,9 +3542,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.13"
+version = "0.4.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
+checksum = "a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -3807,9 +3807,9 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "hyper"
-version = "1.8.1"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11"
+checksum = "d22053281f852e11534f5198498373cbb59295120a20771d90f7ed1897490a72"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -3822,7 +3822,6 @@ dependencies = [
  "httpdate",
  "itoa",
  "pin-project-lite",
- "pin-utils",
  "smallvec",
  "tokio",
  "want",
@@ -3863,7 +3862,7 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.6.3",
+ "socket2 0.5.10",
  "tokio",
  "tower-service",
  "tracing",
@@ -5431,7 +5430,7 @@ dependencies = [
  "quinn-udp",
  "rustc-hash",
  "rustls",
- "socket2 0.6.3",
+ "socket2 0.5.10",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -5468,7 +5467,7 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.6.3",
+ "socket2 0.5.10",
  "tracing",
  "windows-sys 0.52.0",
 ]
@@ -5900,7 +5899,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -6794,7 +6793,7 @@ dependencies = [
  "getrandom 0.4.2",
  "once_cell",
  "rustix",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]