Skip to content

build(deps): bump h3 from 1.15.6 to 1.15.10 - #454

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/h3-1.15.10
Open

build(deps): bump h3 from 1.15.6 to 1.15.10#454
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/h3-1.15.10

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 23, 2026

Copy link
Copy Markdown
Contributor

Bumps h3 from 1.15.6 to 1.15.10.

Release notes

Sourced from h3's releases.

v1.15.10

compare changes

🩹 Fixes

  • Preserve percent-encoded req.url in app event handler (#1355)

❤️ Contributors

v1.15.9

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)
  • static: Prevent path traversal via double-encoded dot segments (%252e%252e) (c56683d)
  • sse: Sanitize carriage returns in event stream data and comments (ba3c3fe)

v1.15.8

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)

v1.15.7

compare changes

🩹 Fixes

  • static: Narrow path traversal check to match .. as a path segment only (c049dc0)
  • app: Decode percent-encoded path segments to prevent auth bypass (313ea52)

💅 Refactors

  • Remove implicit event handler conversion warning (#1340)

❤️ Contributors

Changelog

Sourced from h3's changelog.

v1.15.10

compare changes

🩹 Fixes

  • Preserve percent-encoded req.url in app event handler (#1355)

🏡 Chore

❤️ Contributors

v1.15.9

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)
  • static: Prevent path traversal via double-encoded dot segments (%252e%252e) (c56683d)
  • sse: Sanitize carriage returns in event stream data and comments (ba3c3fe)

🏡 Chore

❤️ Contributors

v1.15.8

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)

❤️ Contributors

v1.15.7

... (truncated)

Commits
  • b72bb57 chore(release): v1.15.10
  • d8ef318 remove resolutions for h3
  • 26fec6f chore: update deps
  • 51ca9b3 fix: preserve percent-encoded req.url in app event handler (#1355)
  • 4e8d43a chore(release): v1.15.9
  • 23045df chore: update deps
  • ba3c3fe fix(sse): sanitize carriage returns in event stream data and comments
  • c56683d fix(static): prevent path traversal via double-encoded dot segments (`%252e%2...
  • e3b9c9e chore(release): v1.15.8
  • 1103df6 fix: preserve %25 in pathname
  • Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 23, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Mar 23, 2026

Copy link
Copy Markdown

Deploying portfolio with  Cloudflare Pages  Cloudflare Pages

Latest commit: 7d2995d
Status:🚫  Build failed.

View logs

@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Mar 23, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/h3-1.15.10 branch 4 times, most recently from cbd436f to 4118244 Compare April 2, 2026 21:21
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/h3-1.15.10 branch from 4118244 to 34352c6 Compare April 8, 2026 01:09
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/h3-1.15.10 branch 2 times, most recently from 43e4188 to 6bf1442 Compare April 20, 2026 22:49
Bumps [h3](https://github.com/h3js/h3) from 1.15.6 to 1.15.10.
- [Release notes](https://github.com/h3js/h3/releases)
- [Changelog](https://github.com/h3js/h3/blob/v1.15.10/CHANGELOG.md)
- [Commits](h3js/h3@v1.15.6...v1.15.10)

---
updated-dependencies:
- dependency-name: h3
  dependency-version: 1.15.10
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/h3-1.15.10 branch from 6bf1442 to 7d2995d Compare April 21, 2026 15:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants