h2 0.4.14 implements HTTP/2 (RFC 9113) as an async client and server library. One unsafe block with a documented and sound invariant. Active mitigations for HPACK bomb, CONTINUATION flooding, and Rapid Reset (CVE-2023-44487) are present by default. Flow-control arithmetic uses checked operations. No findings.