Skip to content

Bump h2 from 4.3.0 to 4.4.1 in /packages/python-sdk in the pip group across 1 directory - #242

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/packages/python-sdk/pip-a661626dcb
Open

Bump h2 from 4.3.0 to 4.4.1 in /packages/python-sdk in the pip group across 1 directory#242
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/packages/python-sdk/pip-a661626dcb

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 8, 2026

Copy link
Copy Markdown
Contributor

Bumps the pip group with 1 update in the /packages/python-sdk directory: h2.

Updates h2 from 4.3.0 to 4.4.1

Changelog

Sourced from h2's changelog.

4.4.1 (2026-08-03)

Bugfixes

  • Performance improvement: remove consumed frames in-place from data buffer.
  • Reject duplicate Host headers in request headers. Thanks to Sunand Mohan for the report.

4.4.0 (2026-07-23)

API Changes (Backward Incompatible)

  • Support for Python 3.9 has been removed.
  • Support for PyPy 3.9 has been removed.
  • Stream.end_stream() now raises NoSuchStreamError or StreamClosedError exceptions, instead of a generic KeyError.
  • Duplicate content-length headers with different values now raise ProtocolError. Previously, the first content-length header was accepted and later conflicting values were ignored. Thanks to Harshal Parekh for the report.
  • Parse content-length headers according to RFC9110 grammar for numbers (1*DIGIT). Thanks to Arkadiusz Marta for the report.
  • backfill from v4.3.0 Convert emitted events into Python dataclass, which introduces new constructors with required arguments. Instantiating these events without arguments, as previously commonly used API pattern, will no longer work.

API Changes (Backward Compatible)

  • Support for Python 3.14 has been added.
  • H2Connection.receive_data now accepts any byte-like object that implements the buffer protocol, such as bytes, bytearray, and memoryview. Existing bytes callers are unaffected.
  • Align CONNECT pseudo-header validation with RFC 9113 s8.3 and RFC 8441 s4. Ordinary CONNECT now requires :method=CONNECT and :authority, and forbids :scheme/:path. Extended CONNECT (e.g., WebSocket) requires :scheme, :path, :authority plus :protocol. (PR #1309)
  • Fix incorrect substring matching of secure header in cookie and :method.

Bugfixes

  • Fix to allow sending 0 bytes on a stream even if the flow control window is negative.
  • Reject non-zero SETTINGS_ENABLE_PUSH values received from servers.
Commits
  • bc239af v4.4.1
  • 92b925e add test for duplicate host headers
  • 292a408 reject duplicate Host headers in request headers
  • 04d3b87 update changelog
  • 439b970 prepare for next release cycle
  • 9a7ff74 performance: remove consumed frames in place from data buffer (#1321)
  • 6cce763 v4.4.0
  • dfafda3 Bump pytest from 8.4.2 to 9.0.3 (#1320)
  • b45207c dependencies and packaging++
  • c40145f parse content-length headers according to RFC9110 grammar for numbers (1*DI...
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 8, 2026
@dependabot
dependabot Bot requested a review from mishushakov as a code owner August 8, 2026 12:26
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 8, 2026
@cla-bot cla-bot Bot added the cla-signed label Aug 8, 2026
@dependabot
dependabot Bot force-pushed the dependabot/pip/packages/python-sdk/pip-a661626dcb branch from df2a90b to 35df709 Compare August 17, 2026 07:12
Bumps the pip group with 1 update in the /packages/python-sdk directory: [h2](https://github.com/python-hyper/h2).


Updates `h2` from 4.3.0 to 4.4.1
- [Changelog](https://github.com/python-hyper/h2/blob/master/CHANGELOG.rst)
- [Commits](python-hyper/h2@v4.3.0...v4.4.1)

---
updated-dependencies:
- dependency-name: h2
  dependency-version: 4.4.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/packages/python-sdk/pip-a661626dcb branch from 35df709 to 5b915b2 Compare August 17, 2026 13:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cla-signed dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants