chore(deps): bump h2 from 4.3.0 to 4.4.1 in /lockfiles/py39

[dependabot]

Bumps h2 from 4.3.0 to 4.4.1.

Changelog

Sourced from h2's changelog.

4.4.1 (2026-08-03)

Bugfixes

• Performance improvement: remove consumed frames in-place from data buffer.
• Reject duplicate Host headers in request headers. Thanks to Sunand Mohan for the report.

4.4.0 (2026-07-23)

API Changes (Backward Incompatible)

• Support for Python 3.9 has been removed.
• Support for PyPy 3.9 has been removed.
• Stream.end_stream() now raises NoSuchStreamError or StreamClosedError exceptions, instead of a generic KeyError.
• Duplicate content-length headers with different values now raise ProtocolError. Previously, the first content-length header was accepted and later conflicting values were ignored. Thanks to Harshal Parekh for the report.
• Parse content-length headers according to RFC9110 grammar for numbers (1*DIGIT). Thanks to Arkadiusz Marta for the report.
• backfill from v4.3.0 Convert emitted events into Python dataclass, which introduces new constructors with required arguments. Instantiating these events without arguments, as previously commonly used API pattern, will no longer work.

API Changes (Backward Compatible)

• Support for Python 3.14 has been added.
• H2Connection.receive_data now accepts any byte-like object that implements the buffer protocol, such as bytes, bytearray, and memoryview. Existing bytes callers are unaffected.
• Align CONNECT pseudo-header validation with RFC 9113 s8.3 and RFC 8441 s4. Ordinary CONNECT now requires :method=CONNECT and :authority, and forbids :scheme/:path. Extended CONNECT (e.g., WebSocket) requires :scheme, :path, :authority plus :protocol. (PR #1309)
• Fix incorrect substring matching of secure header in cookie and :method.

Bugfixes

• Fix to allow sending 0 bytes on a stream even if the flow control window is negative.
• Reject non-zero SETTINGS_ENABLE_PUSH values received from servers.

Commits

• bc239af v4.4.1
• 92b925e add test for duplicate host headers
• 292a408 reject duplicate Host headers in request headers
• 04d3b87 update changelog
• 439b970 prepare for next release cycle
• 9a7ff74 performance: remove consumed frames in place from data buffer (#1321)
• 6cce763 v4.4.0
• dfafda3 Bump pytest from 8.4.2 to 9.0.3 (#1320)
• b45207c dependencies and packaging++
• c40145f parse content-length headers according to RFC9110 grammar for numbers (1*DI...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Not auto-merged: /lockfiles/py39 is frozen because Dependabot does not honour Requires-Python. Check whether h2 still supports that lockfile's interpreter. If it does, regenerate the lockfile with pip-compile on a matching Python host. Either way, close this PR afterwards.

[markuslf]

Closing: the fix is not reachable on this lockfile.

h2 4.4.1 declares Requires-Python >= 3.10, and 4.4.0 already does. There is no py39-compatible release that carries the fix for GHSA-6hr6-w5qg-qmwg, so lockfiles/py39 stays on 4.3.0. That lockfile is what RHEL 8, RHEL 9 and Debian 11 install from, and pip install --require-hashes would fail there with this bump.

The advisory is not reachable here either. It describes a consumer that accepts an HTTP/2 header block carrying more than one Host header and then downgrades the request to HTTP/1.1, which is a request smuggling primitive. h2 is pulled in transitively as h2 <- httpx <- linuxfabrik-lib and is only ever used as a client; nothing terminates HTTP/2 and nothing proxies. The corresponding Dependabot alert is dismissed with the same reasoning.

py311 through py314 are already on 4.4.1.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.