Skip to content

Upgrading h2 3 to 4

Breaking3.2.0 → 4.4.1Breaking10Security3Platform14New3Changed4Fixed8Other4

Full comparisonBack to h2
BreakingUpgrade verdict

10 breaking changes and 14 platform requirement changes and 3 security fixes.

In plain terms
  • The package no longer runs on Python 3.9.
  • The package no longer runs on PyPy 3.9.
  • Code that read this attribute on a stream will no longer find it.
  • Calling end_stream() on a missing or closed stream now raises specific stream errors rather than a generic KeyError.
Must act Top 5 of 27 that need code or config changes

Requires Python >=3.10 from 4.4.0 (none stated before).

What you must change

Breaking10
Removes support for Python 3.9.
4.4.0CHANGELOG.rstSummarizedView source
Removes support for PyPy 3.9.
4.4.0CHANGELOG.rstSummarizedView source
Removes the mistakenly set max_inbound_frame_size attribute on H2Stream.
H2Streammax_inbound_frame_size
4.2.0CHANGELOG.rstSummarizedView source
Stream.end_stream() now raises NoSuchStreamError or StreamClosedError instead of KeyError.
Stream.end_stream()NoSuchStreamErrorStreamClosedErrorKeyError
4.4.0CHANGELOG.rstSummarizedView source
Duplicate content-length headers with different values now raise ProtocolError instead of being ignored.
ProtocolErrorcontent-length
4.4.0CHANGELOG.rstSummarizedView source
Parses content-length headers per RFC9110 grammar for numbers (1*DIGIT).
content-length
4.4.0CHANGELOG.rstSummarizedView source
Converts emitted events into Python dataclasses, adding constructors with required arguments.
4.4.0CHANGELOG.rstSummarizedView source
Rejects header names and values containing illegal characters per RFC 9113 section 8.2.1.
validate_inbound_headers
4.3.0CHANGELOG.rstSummarizedView source
Converts emitted events into Python dataclasses, adding constructors with required arguments.
4.3.0CHANGELOG.rstSummarizedView source
Receiving DATA before HEADERS now raises a ProtocolError.
ProtocolError
4.0.0CHANGELOG.rstSummarizedView source
Security3
Rejects duplicate Host headers in request headers.
Host
4.4.1CHANGELOG.rstSummarizedView source
h2: Duplicate Host header could facilitate request smuggling
Medium · CVSS 5.3
4.4.1GitHub AdvisoryOriginalView source
h2 allows HTTP Request Smuggling due to illegal characters in headers
4.3.0GitHub AdvisoryOriginalView source
Platform14
Adds support for Python 3.14.
4.4.0CHANGELOG.rstSummarizedView source
Removes support for Python 3.6.
4.2.0CHANGELOG.rstSummarizedView source
Removes support for Python 3.7.
4.2.0CHANGELOG.rstSummarizedView source
Removes support for Python 3.8.
4.2.0CHANGELOG.rstSummarizedView source
Adds support for Python 3.11.
4.2.0CHANGELOG.rstSummarizedView source
Adds support for Python 3.12.
4.2.0CHANGELOG.rstSummarizedView source
Adds support for Python 3.13.
4.2.0CHANGELOG.rstSummarizedView source
Adds support for Python 3.9.
4.1.0CHANGELOG.rstSummarizedView source
Adds support for Python 3.10.
4.1.0CHANGELOG.rstSummarizedView source
Removes support for Python 2.7.
4.0.0CHANGELOG.rstSummarizedView source
Removes support for Python 3.4.
4.0.0CHANGELOG.rstSummarizedView source
Removes support for Python 3.5.
4.0.0CHANGELOG.rstSummarizedView source
Removes support for PyPy (Python 2.7 compatible).
4.0.0CHANGELOG.rstSummarizedView source
Adds support for Python 3.8.
4.0.0CHANGELOG.rstSummarizedView source