dependabot[bot] opened a new pull request, #39676: URL: https://github.com/apache/beam/pull/39676
Bumps [h2](https://github.com/python-hyper/h2) from 4.3.0 to 4.4.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/python-hyper/h2/blob/master/CHANGELOG.rst";>h2's changelog</a>.</em></p> <blockquote> <h2>4.4.1 (2026-08-03)</h2> <p><strong>Bugfixes</strong></p> <ul> <li>Performance improvement: remove consumed frames in-place from data buffer.</li> <li>Reject duplicate Host headers in request headers. Thanks to Sunand Mohan for the report.</li> </ul> <h2>4.4.0 (2026-07-23)</h2> <p><strong>API Changes (Backward Incompatible)</strong></p> <ul> <li>Support for Python 3.9 has been removed.</li> <li>Support for PyPy 3.9 has been removed.</li> <li><code>Stream.end_stream()</code> now raises <code>NoSuchStreamError</code> or <code>StreamClosedError</code> exceptions, instead of a generic <code>KeyError</code>.</li> <li>Duplicate <code>content-length</code> headers with different values now raise <code>ProtocolError</code>. Previously, the first <code>content-length</code> header was accepted and later conflicting values were ignored. Thanks to Harshal Parekh for the report.</li> <li>Parse <code>content-length</code> headers according to RFC9110 grammar for numbers (1*DIGIT). Thanks to Arkadiusz Marta for the report.</li> <li><strong>backfill from v4.3.0</strong> Convert emitted events into Python <code>dataclass</code>, which introduces new constructors with required arguments. Instantiating these events without arguments, as previously commonly used API pattern, will no longer work.</li> </ul> <p><strong>API Changes (Backward Compatible)</strong></p> <ul> <li>Support for Python 3.14 has been added.</li> <li><code>H2Connection.receive_data</code> now accepts any byte-like object that implements the buffer protocol, such as <code>bytes</code>, <code>bytearray</code>, and <code>memoryview</code>. Existing <code>bytes</code> callers are unaffected.</li> <li>Align CONNECT pseudo-header validation with RFC 9113 s8.3 and RFC 8441 s4. Ordinary CONNECT now requires <code>:method=CONNECT</code> and <code>:authority</code>, and forbids <code>:scheme</code>/<code>:path</code>. Extended CONNECT (e.g., WebSocket) requires <code>:scheme</code>, <code>:path</code>, <code>:authority</code> plus <code>:protocol</code>. (PR <a href="https://redirect.github.com/python-hyper/h2/issues/1309";>#1309</a>)</li> <li>Fix incorrect substring matching of secure header in <code>cookie</code> and <code>:method</code>.</li> </ul> <p><strong>Bugfixes</strong></p> <ul> <li>Fix to allow sending 0 bytes on a stream even if the flow control window is negative.</li> <li>Reject non-zero <code>SETTINGS_ENABLE_PUSH</code> values received from servers.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python-hyper/h2/commit/bc239af1d1b85bc70482804f30a0e0e587d90a08";><code>bc239af</code></a> v4.4.1</li> <li><a href="https://github.com/python-hyper/h2/commit/92b925ed1b1817c82db32893503f74f47fcf4452";><code>92b925e</code></a> add test for duplicate host headers</li> <li><a href="https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6";><code>292a408</code></a> reject duplicate Host headers in request headers</li> <li><a href="https://github.com/python-hyper/h2/commit/04d3b87cbc1db020d28c7cfb44fe194558efbdde";><code>04d3b87</code></a> update changelog</li> <li><a href="https://github.com/python-hyper/h2/commit/439b970d0fa19891fa81068907de97dfa3a07c3a";><code>439b970</code></a> prepare for next release cycle</li> <li><a href="https://github.com/python-hyper/h2/commit/9a7ff7430df669fa8e90b6121f3cc1ed64d1115a";><code>9a7ff74</code></a> performance: remove consumed frames in place from data buffer (<a href="https://redirect.github.com/python-hyper/h2/issues/1321";>#1321</a>)</li> <li><a href="https://github.com/python-hyper/h2/commit/6cce763997eca5b826f3e435a611b7a7fc73f633";><code>6cce763</code></a> v4.4.0</li> <li><a href="https://github.com/python-hyper/h2/commit/dfafda3b0cd96455b45d1785ef1ebc6968bba5cf";><code>dfafda3</code></a> Bump pytest from 8.4.2 to 9.0.3 (<a href="https://redirect.github.com/python-hyper/h2/issues/1320";>#1320</a>)</li> <li><a href="https://github.com/python-hyper/h2/commit/b45207cedf9fabe2c77bb3c1c10f403a610599a0";><code>b45207c</code></a> dependencies and packaging++</li> <li><a href="https://github.com/python-hyper/h2/commit/c40145f69c5473850849fe96301ac0416b1afea6";><code>c40145f</code></a> parse <code>content-length</code> headers according to RFC9110 grammar for numbers (1*DI...</li> <li>Additional commits viewable in <a href="https://github.com/python-hyper/h2/compare/v4.3.0...v4.4.1";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/beam/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
