2.3.0 — async prepared requests and exact H2 controls

Changes

• Add AsyncSession.prepare_request(), AsyncPreparedRequest.with_headers() and
  AsyncSession.send() for buffered requests that can be inspected or signed
  before sending. Prepared requests preserve Session/loop ownership, snapshots,
  hooks, Cookies, retries and redirects.
• Expose exact ordered H2 SETTINGS, request pseudo-header order and initial
  PRIORITY signals across synchronous and native async clients. These controls
  partition connection pools; priority scheduling remains deferred.
• Validate H2 response fields before exposure, prevent CRLF/Cookie injection,
  reset malformed streams and retain shared HPACK state. Apply repeated peer
  SETTINGS sequentially, including intermediate table reductions and invalid
  values, and retain local decoded-header budgets for exact custom SETTINGS.
• Enforce offered and implemented ALPN in actual TLS 1.2/1.3 negotiation and
  dispatch. Restore extension-free legacy TLS 1.2 handshakes. The client uses
  the project-owned TLS handshake and record engine.
• Preserve byte-valued headers and signing-compatible URL targets, isolate proxy
  credentials, and complete fragmented synchronous CONNECT responses with
  deterministic failure cleanup.

Validation

The exact release commit passes 3,544 installed tests plus 118 subtests at
92.09% statement coverage, installed public typing and all 74 negative type
cases, strict documentation and real loopback examples. Independent TLS peers
exercise TLS 1.2/1.3, exact H2 bytes, connection reuse, failure isolation and
resource cleanup. GitHub CI verifies Python 3.7–3.13 and the package/docs/type/
lint/coverage gates for the same commit.

Python >=3.7. Buffered prepared requests are new in 2.3.0; prepared streaming
bodies remain deferred. Full release details are in
CHANGELOG.md.

Install: python -m pip install ja3requests==2.3.0