fix(deps): update h2 (medium)

[claude]

Summary

• Updates h2 to >= 4.3.0 to resolve GHSA-847f-9342-265h (CVE-2025-57804, medium severity: HTTP Request Smuggling due to illegal characters in headers)

Dependency chain and placement rationale

h2 is a transitive dependency via grpclib, which is a production dependency in [project] dependencies. Per policy, transitive dependencies of production deps are added directly to [project] dependencies with the minimum secure version so downstream users get the fix.

Since h2 4.3.0 requires Python >= 3.9 and this project supports Python >= 3.8.1, the constraint uses a python_version >= '3.9' marker. Python < 3.9 users will remain on h2 4.1.0 as no patched version is available for older Python.

Advisories resolved

Advisory	CVE	Severity	Patched version
GHSA-847f-9342-265h	CVE-2025-57804	medium	4.3.0

Lockfiles modified

• uv.lock

Notes

• The fix applies only to Python >= 3.9. For Python < 3.9, h2 4.3.0 is not available (it requires Python >= 3.9), so the vulnerable version (4.1.0) remains in the lockfile for that Python range. This is a limitation of the upstream package.

Resolves #1142

[claude]

Code Review: fix(deps): update h2 >= 4.3.0 to resolve CVE-2025-57804

This is a dependency-only change (no source code modified). Review findings below.

Checklist

• src/viam/gen/ not modified
• Only pyproject.toml and uv.lock changed
• No logic, API surface, or test changes — appropriate for a pure security patch

Correctness

Marker semantics: python_version >= '3.9' uses PEP 508's MAJOR.MINOR comparison. Python 3.8.1 evaluates to python_version == '3.8', correctly excluded. Python 3.9.0+ evaluates as >= '3.9', correctly included. The marker is semantically sound.

Lockfile consistency: The uv.lock correctly splits grpclib's h2 dependency into two version-gated entries, brings in updated hpack 4.1.0 and hyperframe 6.1.0 for Python >= 3.9, and registers h2 4.3.0 as a direct dependency of viam-sdk with the matching marker. No orphaned or conflicting entries.

Python < 3.9 gap: Acknowledged in PR description — h2 4.3.0 requires Python >= 3.9, so Python 3.8 users remain on h2 4.1.0. Python 3.8 is EOL (October 2024), making this an acceptable residual risk.

Minor observation (no action required)

The new marker (python_version >= '3.9') uses spaces around the operator, while the existing dev-dependency markers use no spaces (python_version>='3.9'). Both are valid PEP 508 and ruff does not normalize environment markers, so this is cosmetic only.

Verdict

The change is minimal, technically correct, and appropriately scoped. No fixes needed.