Title: Update dependency h2 to v4.3.0 [SECURITY] by renovate[bot] · Pull Request #40 · protoconf/client-python · GitHub
Open Graph Title: Update dependency h2 to v4.3.0 [SECURITY] by renovate[bot] · Pull Request #40 · protoconf/client-python
X Title: Update dependency h2 to v4.3.0 [SECURITY] by renovate[bot] · Pull Request #40 · protoconf/client-python
Description: This PR contains the following updates: Package Change Age Confidence h2 ==4.1.0 → ==4.3.0 GitHub Vulnerability Alerts CVE-2025-57804 Summary HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Release Notes python-hyper/h2 (h2) v4.3.0 Compare Source API Changes (Backward Incompatible) Reject header names and values containing illegal characters, based on RFC 9113, section 8.2.1. The main Python API is compatible, but some previously valid requests/response headers might now be blocked. Use the validate_inbound_headers config option if needed. Thanks to Sebastiano Sartor (sebsrt) for the report. Convert emitted events into Python dataclass, which introduces new constructors with required arguments. Instantiating these events without arguments, as previously commonly used API pattern, will no longer work. API Changes (Backward Compatible) h2 events now have tighter type bounds, e.g. stream_id is guaranteed to not be None for most events now. This simplifies downstream type checking. Various typing-related improvements. Bugfixes Fix error value when opening a new stream on too many open streams. v4.2.0 Compare Source API Changes (Backward Incompatible) Support for Python 3.6 has been removed. Support for Python 3.7 has been removed. Support for Python 3.8 has been removed. Remove mistakenly set max_inbound_frame_size attribute on H2Stream. API Changes (Backward Compatible) Support for Python 3.11 has been added. Support for Python 3.12 has been added. Support for Python 3.13 has been added. Add an ability to send outbound cookies separately to improve headers compression. Updated packaging and testing infrastructure. Bugfixes Fix repr() checks for Python 3.11 Fix asyncio / wsgi examples. Clarify docs on using curl with http2. Configuration 📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. If you want to rebase/retry this PR, check this box This PR was generated by Mend Renovate. View the repository job log.
Open Graph Description: This PR contains the following updates: Package Change Age Confidence h2 ==4.1.0 → ==4.3.0 GitHub Vulnerability Alerts CVE-2025-57804 Summary HTTP/2 request splitting vulnerability allo...
X Description: This PR contains the following updates: Package Change Age Confidence h2 ==4.1.0 → ==4.3.0 GitHub Vulnerability Alerts CVE-2025-57804 Summary HTTP/2 request splitting vulnerability allo...
Opengraph URL: https://github.com/protoconf/client-python/pull/40
X: @github
Domain: patch-diff.githubusercontent.com
| route-pattern | /:user_id/:repository/pull/:id/checks(.:format) |
| route-controller | pull_requests |
| route-action | checks |
| fetch-nonce | v2:5dcc1b2c-8473-2f46-9920-362438ef88a6 |
| current-catalog-service-hash | 87dc3bc62d9b466312751bfd5f889726f4f1337bdff4e8be7da7c93d6c00a25a |
| request-id | 9ABA:115CAF:10E7F63:16A99A1:6981345A |
| html-safe-nonce | 9620b599809041da45d43bd0f30d94fc975397446d0f60ac0a317a75a554869b |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiI5QUJBOjExNUNBRjoxMEU3RjYzOjE2QTk5QTE6Njk4MTM0NUEiLCJ2aXNpdG9yX2lkIjoiMzM0MDE4NTExMTQwNzcwMzEzMCIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9 |
| visitor-hmac | f804bbe76fe6ba1c5a639bb17c155dfcc37b7be47fb22b2de5135bedd8c8d14f |
| hovercard-subject-tag | pull_request:2773157933 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,checks,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/protoconf/client-python/pull/40/checks |
| twitter:image | https://avatars.githubusercontent.com/in/2740?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/in/2740?s=400&v=4 |
| og:image:alt | This PR contains the following updates: Package Change Age Confidence h2 ==4.1.0 → ==4.3.0 GitHub Vulnerability Alerts CVE-2025-57804 Summary HTTP/2 request splitting vulnerability allo... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 39fe8101494cbb823c09b619b68c80cd4d05ab7279997038dbe06bb91608abe1 |
| turbo-cache-control | no-preview |
| go-import | github.com/protoconf/client-python git https://github.com/protoconf/client-python.git |
| octolytics-dimension-user_id | 51154987 |
| octolytics-dimension-user_login | protoconf |
| octolytics-dimension-repository_id | 820059494 |
| octolytics-dimension-repository_nwo | protoconf/client-python |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 820059494 |
| octolytics-dimension-repository_network_root_nwo | protoconf/client-python |
| turbo-body-classes | logged-out env-production page-responsive full-width full-width-p-0 |
| disable-turbo | false |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | d5b34a4e4898b066c629879feb4b184bc471d6a7 |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width