Update dependency h2 to v4.3.0 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
h2	==4.1.0 -> ==4.3.0

GitHub Vulnerability Alerts

CVE-2025-57804

Summary

HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.

---

Release Notes

python-hyper/h2 (h2)

v4.3.0

Compare Source

API Changes (Backward Incompatible)

• Reject header names and values containing illegal characters, based on RFC 9113, section 8.2.1.
  The main Python API is compatible, but some previously valid requests/response headers might now be blocked.
  Use the validate_inbound_headers config option if needed.
  Thanks to Sebastiano Sartor (sebsrt) for the report.

API Changes (Backward Compatible)

• h2 events now have tighter type bounds, e.g. stream_id is guaranteed to not be None for most events now.
  This simplifies downstream type checking.
• Various typing-related improvements.

Bugfixes

• Fix error value when opening a new stream on too many open streams.

v4.2.0

Compare Source

API Changes (Backward Incompatible)

• Support for Python 3.6 has been removed.
• Support for Python 3.7 has been removed.
• Support for Python 3.8 has been removed.
• Remove mistakenly set max_inbound_frame_size attribute on H2Stream.

API Changes (Backward Compatible)

• Support for Python 3.11 has been added.
• Support for Python 3.12 has been added.
• Support for Python 3.13 has been added.
• Add an ability to send outbound cookies separately to improve headers compression.
• Updated packaging and testing infrastructure.

Bugfixes

• Fix repr() checks for Python 3.11
• Fix asyncio / wsgi examples.
• Clarify docs on using curl with http2.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.