chore(deps): bump h2 from 4.3.0 to 4.4.1

[dependabot]

Bumps h2 from 4.3.0 to 4.4.1.

Changelog

Sourced from h2's changelog.

4.4.1 (2026-08-03)

Bugfixes

• Performance improvement: remove consumed frames in-place from data buffer.
• Reject duplicate Host headers in request headers. Thanks to Sunand Mohan for the report.

4.4.0 (2026-07-23)

API Changes (Backward Incompatible)

• Support for Python 3.9 has been removed.
• Support for PyPy 3.9 has been removed.
• Stream.end_stream() now raises NoSuchStreamError or StreamClosedError exceptions, instead of a generic KeyError.
• Duplicate content-length headers with different values now raise ProtocolError. Previously, the first content-length header was accepted and later conflicting values were ignored. Thanks to Harshal Parekh for the report.
• Parse content-length headers according to RFC9110 grammar for numbers (1*DIGIT). Thanks to Arkadiusz Marta for the report.
• backfill from v4.3.0 Convert emitted events into Python dataclass, which introduces new constructors with required arguments. Instantiating these events without arguments, as previously commonly used API pattern, will no longer work.

API Changes (Backward Compatible)

• Support for Python 3.14 has been added.
• H2Connection.receive_data now accepts any byte-like object that implements the buffer protocol, such as bytes, bytearray, and memoryview. Existing bytes callers are unaffected.
• Align CONNECT pseudo-header validation with RFC 9113 s8.3 and RFC 8441 s4. Ordinary CONNECT now requires :method=CONNECT and :authority, and forbids :scheme/:path. Extended CONNECT (e.g., WebSocket) requires :scheme, :path, :authority plus :protocol. (PR #1309)
• Fix incorrect substring matching of secure header in cookie and :method.

Bugfixes

• Fix to allow sending 0 bytes on a stream even if the flow control window is negative.
• Reject non-zero SETTINGS_ENABLE_PUSH values received from servers.

Commits

• bc239af v4.4.1
• 92b925e add test for duplicate host headers
• 292a408 reject duplicate Host headers in request headers
• 04d3b87 update changelog
• 439b970 prepare for next release cycle
• 9a7ff74 performance: remove consumed frames in place from data buffer (#1321)
• 6cce763 v4.4.0
• dfafda3 Bump pytest from 8.4.2 to 9.0.3 (#1320)
• b45207c dependencies and packaging++
• c40145f parse content-length headers according to RFC9110 grammar for numbers (1*DI...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Summary by cubic

Upgrade h2 from 4.3.0 to 4.4.1 for better performance and stricter HTTP/2 compliance. Lockfile also updates hpack to 4.2.0.

• Dependencies

  • h2 4.3.0 → 4.4.1 (perf improvements, duplicate Host rejection, stricter content-length, updated CONNECT validation)
  • hpack 4.1.0 → 4.2.0 (transitive)

• Migration

  • Python 3.9 is no longer supported. Use 3.10+.
  • Stream.end_stream() now raises NoSuchStreamError/StreamClosedError. Update exception handling.
  • Emitted events are dataclasses with required args. Update any no-arg event construction.
  • Ensure requests do not send duplicate Host or conflicting content-length headers.

^{Written for commit b06573e. Summary will update on new commits.}

[cloudflare-workers-and-pages]

Deploying infrahub-sdk-python with    Cloudflare Pages

Latest commit:	b06573e
Status:	✅  Deploy successful!
Preview URL:	https://fe559169.infrahub-sdk-python.pages.dev
Branch Preview URL:	https://dependabot-uv-h2-4-4-1.infrahub-sdk-python.pages.dev

View logs

[polmichel]

Tested /analyzing-dependencies-bump skill on that one

Verdict: ✅ safe to merge — no code changes needed.

Both bumps are dev/test-only transitive deps. The SDK never imports h2/hpack/hyperframe and never enables
HTTP/2 (grep http2=True → none; every httpx.AsyncClient/httpx.Client uses the httpx default http2=False).

Dependency chain (both):
h2 ← httpx[http2] ← prefect-client ← infrahub-testcontainers ← [dependency-groups] tests/dev
— terminates in the tests group, never in runtime deps or the ctl/all extras. The SDK pins bare httpx>=0.20 (no
[http2] extra). h2 is reachable only when prefect-client talks HTTP/2 to a Prefect server during testcontainers
runs, where h2 is the client stack.

h2 4.4.0/4.4.1 breaking changes, cross-checked against usage:

Change	Impact here
Drop Python 3.9 / PyPy 3.9	not-used (transitive-only; SDK targets 3.10+)
Stream.end_stream() now raises NoSuchStreamError/StreamClosedError	not-used (internal h2 surface, driven by httpcore)
Duplicate content-length → ProtocolError; RFC9110 grammar; duplicate Host rejection	role-mismatch (validates received request headers server-side; SDK is client)
Emitted events → dataclass w/ required args	not-used (only affects code that constructs h2 events directly)
CONNECT pseudo-header validation (RFC 9113/8441)	role-mismatch / not-used

Security/bug fixes (in-place buffer frame removal, reject non-zero SETTINGS_ENABLE_PUSH, allow 0-byte send on negative flow window) are internal to h2 — free improvements, no action.

hpack 4.2.0: transitive under h2, internal HPACK codec, no public API the SDK touches.

The remaining uv.lock hunks (ipython, ipython-pygments-lexers, pendulum) are marker normalizations from the lockfile regen, not version changes.

Bottom line: dev/test-only transitive bump on a code path the SDK doesn't enable. Safe to merge. ✅