Skip to content

Update dependency h3 to v2.0.1-rc.26 - #931

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/h3-2.x
Open

Update dependency h3 to v2.0.1-rc.26#931
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/h3-2.x

Conversation

@renovate

@renovate renovate Bot commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
h3 (source) 2.0.1-rc.23 → 2.0.1-rc.26 age confidence

Release Notes

h3js/h3 (h3)

v2.0.1-rc.26

Compare Source

compare changes

🚀 Enhancements
  • resolveDotSegments: Add mergeSlashes option (9581407)
  • session: Default session cookie to SameSite=Lax (acf8d77)
  • ⚠️ Escape interpolated values in html tagged template (#​1459)
  • readValidatedBody: Support readBody options (#​1476)
  • Add onDispose hook (#​1488)
  • defineValidatedHandler: Support async validation (#​1491)
  • sse: Allow returning EventStream directly from handlers (#​1508)
🔥 Performance
  • Single-scan fast-path guard for resolveDotSegments (#​1458)
  • cookie: Avoid quadratic chunked cookie parsing and header rebuilds (#​1472)
  • middleware: Precompose middleware chains (#​1475)
  • body-limit: Stream enforcement instead of pre-buffering (#​1500)
🩹 Fixes
  • resolveDotSegments: Preserve trailing slash on trailing dot segments (ca7de07)
  • cookie: Dedup cookies with leading-dot / mixed-case domains (#​1462)
  • cors: Warn on credentials with null origin (#​1464)
  • Decode Basic-auth credentials as UTF-8 (#​1463)
  • proxy: ForwardHeaders must not override framing headers (#​1467)
  • cookie: Cap chunk count in setChunkedCookie (#​1469)
  • cors: Set single-valued CORS headers instead of appending (#​1466)
  • auth: Harden basic-auth realm handling and credential timing (#​1468)
  • validate: Convert malformed JSON to 400 in validated-handler path (#​1465)
  • base: Collapse leading-slash run in all base-stripping sites (#​1471)
  • html: Make raw() trust marker unforgeable and hoist escape map (#​1473)
  • json-rpc: Use -32600 for valid-JSON non-object bodies (#​1483)
  • Only discard prepared headers for error responses (#​1486)
  • event-stream: Correct stream teardown on close and client disconnect (#​1484)
  • deprecated: Correct v1 signatures in the compat shim (#​1492)
  • response: Do not render non-Error throws as successful responses (#​1485)
  • event: Keep event.context and req.context as one reference (#​1499)
  • response: Absorb errors thrown in onResponse hook (4a32c1b)
  • response: Route synchronous prepareResponse throws through the error pipeline (#​1503)
  • response: Keep content-length header for Uint8Array responses (#​1504)
  • response: Strip HEAD body when merging prepared headers into a mutable Response (#​1490)
  • response: Allow status and headers staged during the first stream chunk (#​1512)
💅 Refactors
  • request: ⚠️ Make x-forwarded-proto trust opt-in (#​1461)
  • event-stream: ⚠️ Drop autoclose option (#​1495)
  • sse: Promote EventStream to public API, deprecate createEventStream (#​1509)
📖 Documentation
  • Security caveats for cors, proxy, redirect, host and static utils (#​1470)
  • Explain event.url.pathname decoding (3f8b5bc)
🌊 Types
  • Canonical RouteRules interface (#​1474)
  • Remove unused StaticAssetMeta.path (0b34e24)
🏡 Chore
⚠️ Breaking Changes
  • ⚠️ Escape interpolated values in html tagged template (#​1459)
  • request: ⚠️ Make x-forwarded-proto trust opt-in (#​1461)
  • event-stream: ⚠️ Drop autoclose option (#​1495)
❤️ Contributors

v2.0.1-rc.25

Compare Source

compare changes

🚀 Enhancements
🩹 Fixes
  • cors: Correct vary handling and credentialed wildcard behavior (#​1456)
  • session: Raise default seal PBKDF2 iterations to 8192 (#​1457)
🏡 Chore
❤️ Contributors

v2.0.1-rc.24

Compare Source

compare changes

🚀 Enhancements
  • proxy: Support client aborts (#​1417)
  • ws: Allow optional HTTP handling in defineWebSocketHandler (#​1425)
  • Export resolveDotSegments as a public path utility (#​1428)
  • readBody: Support formdata type (#​1164)
  • Add QUERY method support (#​1445)
  • Add requireContentType and appendAcceptQuery utils (#​1446)
  • Automatically match GET routes for HEAD requests (#​1452)
🩹 Fixes
  • sanitizeStatusCode: Return default for non-numeric input instead of NaN (#​1420)
  • auth: Reject Basic credentials with no colon separator (#​1393)
  • sse: Ignore pushes after stream close (#​1411)
  • proxy: Ignore incoming accept-encoding header (#​1423)
  • cache: HandleCacheHeaders ignores multi-value If-None-Match header (#​1395)
  • serve-static: Compare if-modified-since at whole-second precision (#​1394)
  • request: Parse first entry of comma-list x-forwarded-proto header (#​1413)
  • serve-static: Check the response (not request) for an existing content-length (#​1391)
  • cors: Merge Vary headers when both origin and allow-headers emit vary (#​1396)
  • writeEarlyHints: Normalize Link key to prevent hanging with Node.js (#​1385)
  • event: Return 400 for malformed percent-encoded request URLs (#​1424)
  • mount: Restore pathname on error with try/finally (#​1319)
  • serve-static: Decode the resolved id before lookup (#​1431)
  • request: Shadow parsed _url in requestWithURL proxy (d21d93c)
  • event: Clone URL for pathname normalization instead of mutating shared _url (a1cf066)
  • adapters: Sync raw node req.url with event.url in fromNodeHandler (#​1433)
  • json-rpc: Do not leak internal exception messages to clients (ea2f2a3)
  • request: Prevent decode:true from reintroducing path separators (cd03d41)
  • handleCacheHeaders: Correct conditional-request precedence and Cache-Control default (#​1454)
💅 Refactors
📖 Documentation
  • proxy: Add note about reading body (7eb018e)
  • Fix decode function name in router param helpers (#​1419)
  • session: Note secure cookie limitation over local HTTP (#​1409)
  • Document the session name option for multiple sessions (#​1405)
  • Add arkstack framework to community section (#​1382)
  • ws: Use zero-config crossws server plugin (#​1427)
  • Fix typos in response and handler guides (#​1444)
  • Add QUERY method docs (#​1447)
  • Remove non-existent sendEventStream from createEventStream example (#​1450)
🌊 Types
  • Expose .crossws on defineWebSocketHandler return type (#​1435)
🏡 Chore
✅ Tests
  • Cover zod schema query validation types (#​1404)
  • Cover cloned pipeable node responses (#​1414)
  • iron-crypto: Accept getRandomValues length error for invalid salt bits (dae12fe)
  • event: Cover shared _url normalization semantics (4a218a8)
  • event: Assert req.url reflects normalization per runtime (8410ec9)
❤️ Contributors

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Aug 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants