Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-h2 for openSUSE:Factory checked in at 2026-08-15 22:39:56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-h2 (Old) and /work/SRC/openSUSE:Factory/.python-h2.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-h2" Sat Aug 15 22:39:56 2026 rev:19 rq:1370827 version:4.4.1 Changes: -------- --- /work/SRC/openSUSE:Factory/python-h2/python-h2.changes 2025-08-27 21:34:50.439086804 +0200 +++ /work/SRC/openSUSE:Factory/.python-h2.new.1258/python-h2.changes 2026-08-15 22:40:00.073266544 +0200 @@ -1,0 +2,35 @@ +Tue Aug 11 08:31:58 UTC 2026 - Nico Krapp <[email protected]> + +- Update to 4.4.1 (fixes CVE-2026-71554, bsc#1274386) + * Performance improvement: remove consumed frames in-place from data buffer. + * Reject duplicate Host headers in request headers. Thanks to Sunand Mohan + for the report. +- Update to 4.4.0 + * Support for Python 3.9 has been removed. + * Support for PyPy 3.9 has been removed. + * Stream.end_stream() now raises NoSuchStreamError or StreamClosedError + exceptions, instead of a generic KeyError. + * Duplicate content-length headers with different values now raise + ProtocolError. Previously, the first content-length header was accepted + and later conflicting values were ignored. Thanks to Harshal Parekh for + the report. + * Parse content-length headers according to RFC9110 grammar for numbers + (1*DIGIT). Thanks to Arkadiusz Marta for the report. + * backfill from v4.3.0 Convert emitted events into Python dataclass, which + introduces new constructors with required arguments. Instantiating these + events without arguments, as previously commonly used API pattern, will no + longer work. + * Support for Python 3.14 has been added. + * H2Connection.receive_data now accepts any byte-like object that implements + the buffer protocol, such as bytes, bytearray, and memoryview. Existing + bytes callers are unaffected. + * Align CONNECT pseudo-header validation with RFC 9113 s8.3 and RFC 8441 s4. + Ordinary CONNECT now requires :method=CONNECT and :authority, and forbids + :scheme/:path. Extended CONNECT (e.g., WebSocket) requires :scheme, :path, + :authority plus :protocol. + * Fix incorrect substring matching of secure header in cookie and :method. + * Fix to allow sending 0 bytes on a stream even if the flow control window is + negative. + * Reject non-zero SETTINGS_ENABLE_PUSH values received from servers. + +------------------------------------------------------------------- Old: ---- h2-4.3.0.tar.gz New: ---- h2-4.4.1.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-h2.spec ++++++ --- /var/tmp/diff_new_pack.QUpyb6/_old 2026-08-15 22:40:01.316310299 +0200 +++ /var/tmp/diff_new_pack.QUpyb6/_new 2026-08-15 22:40:01.317310334 +0200 @@ -1,7 +1,7 @@ # # spec file for package python-h2 # -# Copyright (c) 2025 SUSE LLC and contributors +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -18,7 +18,7 @@ %{?sle15_python_module_pythons} Name: python-h2 -Version: 4.3.0 +Version: 4.4.1 Release: 0 Summary: HTTP/2 State-Machine based protocol implementation License: MIT ++++++ h2-4.3.0.tar.gz -> h2-4.4.1.tar.gz ++++++ ++++ 1714 lines of diff (skipped)
