Merge remote-tracking branch 'upstream'

[0x676e67]

No description provided.

[gemini-code-assist]

Code Review

This pull request introduces several security and stability improvements to the HTTP/2 implementation. Key changes include enforcing a strict abuse limit on decoded header list sizes (4x the configured limit) to prevent resource exhaustion, refactoring HPACK decoding to support early termination via ControlFlow, fixing a potential overflow when calculating padding length for maximum-sized padding on DATA frames, and ensuring remotely initiated stream resets are not echoed back. Additionally, comprehensive integration and unit tests have been added to verify these behaviors. There are no review comments, so no further feedback is provided.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.