fix(deps): bump h2 to 4.4.1

[dizhaky]

Summary

• bump transitive h2 4.3.0 → 4.4.1
• exempt h2 security patches from the project 14-day release-age gate

The website js-yaml and nanoid fixes landed independently in #157 while this work was being prepared.

Risk disposition

• image-size 2.0.2 has two high alerts and no patched npm release
• dependency is build-time-only through Docusaurus MDX and processes repository-controlled docs assets, not untrusted runtime input
• alerts fix: repair the Python suite so the aggregate gate can go live #187 and feat(cron): auto-pause after consecutive failures + orchestration playbook #188 were dismissed as not_used with this rationale

Verification

• uv lock --check
• full multilingual Docusaurus production build passed on the combined dependency state
• git diff --check

Resolves Dependabot alert #183 after GitHub rescans the merged lock.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bac1c258da

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Bound the h2 exemption to this security release

When a later h2 version is published, any resolution that upgrades or re-resolves this transitive can select it immediately because false disables the cutoff for the package rather than exempting only security patches. The checked uv lock --help defines --exclude-newer as limiting candidates to versions uploaded before the cutoff, so this permanently bypasses the repository's 14-day quarantine beyond 4.4.1. Use a package-specific cutoff date that admits 4.4.1 but excludes later uploads, or remove the exemption once 4.4.1 reaches the normal age threshold.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Propagate the h2 floor through the Modal lazy-install path

For users who previously activated terminal.modal, this lockfile bump does not install the patched version: hermes update calls refresh_active_features(), but LAZY_DEPS["terminal.modal"] contains only modal==1.3.4 and cbor2==6.1.2, so both remain satisfied while an existing h2==4.3.0 is reported as current and left vulnerable. Add the patched h2 constraint to both the Modal extra and its matching lazy-dependency specs so existing Modal environments are refreshed as well as lockfile-based installs.

AGENTS.md reference: AGENTS.md:L54-L57

Useful? React with 👍 / 👎.