Skip to content

chore(deps): bump h3 from 1.11.1 to 1.15.8#4375

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/h3-1.15.8
Open

chore(deps): bump h3 from 1.11.1 to 1.15.8#4375
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/h3-1.15.8

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 18, 2026 •
edited by cursor bot
Loading

Bumps h3 from 1.11.1 to 1.15.8.

Release notes

Sourced from h3's releases.

v1.15.8

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)

v1.15.7

compare changes

🩹 Fixes

  • static: Narrow path traversal check to match .. as a path segment only (c049dc0)
  • app: Decode percent-encoded path segments to prevent auth bypass (313ea52)

💅 Refactors

  • Remove implicit event handler conversion warning (#1340)

❤️ Contributors

v1.15.6

compare changes

🩹 Fixes

  • sse: Sanitize newlines in event stream fields to prevent SSE injection (840ac5c)
  • static: Prevent path traversal via percent-encoded dot segments (6465e1b)

v1.15.5

compare changes

[!IMPORTANT] Security: Fixed a bug in readBody(event) and readRawBody(event) utils where certain Transfer-Encoding header formats could cause the request body to be ignored.

In some deployments (for example, behind TCP load balancers or non-normalizing proxies), this could allow request smuggling. The handling is now safe and fully compliant. (read more)

🩹 Fixes

  • readRawBody: Fix case-sensitive Transfer-Encoding check causing request smuggling risk (618ccf4)

v1.15.4

compare changes

🩹 Fixes

  • getRequestHost: Return first host from x-forwarded-host (#1175)

... (truncated)

Changelog

Sourced from h3's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

v2.0.1-rc.16

compare changes

🏡 Chore

❤️ Contributors

v2.0.1-rc.15

compare changes

🚀 Enhancements

  • handler: New defineJsonRpcHandler and defineJsonRpcWebSocketHandler (#1180)

🔥 Performance

  • resolveLazyHandler: Replace with inline expression (#1296)

🩹 Fixes

  • sse: Sanitize newlines in event stream fields to prevent SSE injection (7791538)
  • static: Prevent path traversal via percent-encoded dot segments (0e751b4)

📖 Documentation

  • community: Add clear router (#1303)
  • Add unjwt community library entry (#1309)

📦 Build

  • Bundle docs as skill + h3 docs (#1311)

🏡 Chore

... (truncated)

Commits
  • 35d8a14 lint
  • 3693651 fix: preserve %25
  • fd4c800 test: fix security test
  • 6f6dc09 fix(event): normalize percent-encoded URL pathname to prevent middleware bypass
  • 9947d51 fix(static): prevent backslash-based path traversal in resolveDotSegments
  • 99ec3a2 types: mark all createError overloads as @​deprecated (#1343)
  • 8a4ac16 fmt
  • 0136851 refactor: improve requestWithURL
  • d1da262 feat: add requestWith*URL utils and use for faster mounts (#1342)
  • 60a2e91 fix(utils/redirect): escape HTML special characters in body (#1317)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note

Medium Risk
Dependency update to h3 and its transitive packages may change HTTP request/URL parsing and middleware/static handling behavior at runtime. While lockfile-only, it touches server-layer behavior and includes security-related fixes, so regression risk is moderate.

Overview
Updates the locked h3 dependency from 1.11.1/1.9.0 to 1.15.8, consolidating older h3 ranges into a single resolved version.

This refreshes several h3 transitive deps (notably cookie-es, crossws, destr, iron-webcrypto, ufo) and introduces node-mock-http in the lockfile.

Written by Cursor Bugbot for commit 70e4a93. This will update automatically on new commits. Configure here.

@dependabot
chore(deps): bump h3 from 1.11.1 to 1.15.8
70e4a93 
Bumps [h3](https://github.com/h3js/h3) from 1.11.1 to 1.15.8.
- [Release notes](https://github.com/h3js/h3/releases)
- [Changelog](https://github.com/h3js/h3/blob/main/CHANGELOG.md)
- [Commits](h3js/h3@v1.11.1...v1.15.8)

---
updated-dependencies:
- dependency-name: h3
  dependency-version: 1.15.8
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 18, 2026
@nx-cloud
Copy link

nx-cloud bot commented Mar 18, 2026 •
edited
Loading

🤖 Nx Cloud AI Fix Eligible

An automatically generated fix could have helped fix failing tasks for this run, but Self-healing CI is disabled for this workspace. Visit workspace settings to enable it and get automatic fixes in future runs.

To disable these notifications, a workspace admin can disable them in workspace settings.

View your CI Pipeline Execution ↗ for commit 70e4a93

Command Status Duration Result
nx test @snippet/react ❌ Failed 4m 48s View ↗
nx test @e2e/nextjs-sdk-next-app ✅ Succeeded 7m 34s View ↗
nx test @e2e/svelte ✅ Succeeded 13m 1s View ↗
nx test @e2e/gen1-next14-pages ✅ Succeeded 12m 7s View ↗
nx test @e2e/react-native-76-fabric ✅ Succeeded 4m 35s View ↗
nx test @e2e/vue ✅ Succeeded 11m 51s View ↗
nx test @snippet/vue ✅ Succeeded 1m 2s View ↗
nx test @e2e/qwik-city ✅ Succeeded 8m 55s View ↗
Additional runs (38) ✅ Succeeded ... View ↗

☁️ Nx Cloud last updated this comment at 2026-03-18 17:34:59 UTC

@changeset-bot
Copy link

changeset-bot bot commented Mar 18, 2026

⚠️ No Changeset found

Latest commit: 70e4a93

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants