Skip to content

Bump h3 from 1.15.5 to 1.15.11#305

Merged
VD39 merged 1 commit intomainfrom
dependabot/npm_and_yarn/h3-1.15.11
Apr 7, 2026
Merged

Bump h3 from 1.15.5 to 1.15.11#305
VD39 merged 1 commit intomainfrom
dependabot/npm_and_yarn/h3-1.15.11

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 4, 2026

Bumps h3 from 1.15.5 to 1.15.11.

Release notes

Sourced from h3's releases.

v1.15.11

compare changes

🏡 Chore

v1.15.10

compare changes

🩹 Fixes

  • Preserve percent-encoded req.url in app event handler (#1355)

❤️ Contributors

v1.15.9

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)
  • static: Prevent path traversal via double-encoded dot segments (%252e%252e) (c56683d)
  • sse: Sanitize carriage returns in event stream data and comments (ba3c3fe)

v1.15.8

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)

v1.15.7

compare changes

🩹 Fixes

  • static: Narrow path traversal check to match .. as a path segment only (c049dc0)
  • app: Decode percent-encoded path segments to prevent auth bypass (313ea52)

💅 Refactors

  • Remove implicit event handler conversion warning (#1340)

❤️ Contributors

... (truncated)

Changelog

Sourced from h3's changelog.

v1.15.11

compare changes

🏡 Chore

❤️ Contributors

v1.15.10

compare changes

🩹 Fixes

  • Preserve percent-encoded req.url in app event handler (#1355)

🏡 Chore

❤️ Contributors

v1.15.9

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)
  • static: Prevent path traversal via double-encoded dot segments (%252e%252e) (c56683d)
  • sse: Sanitize carriage returns in event stream data and comments (ba3c3fe)

🏡 Chore

❤️ Contributors

... (truncated)

Commits

@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 4, 2026
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/h3-1.15.11 branch 3 times, most recently from d610975 to 66efcfa Compare April 6, 2026 17:29
Bumps [h3](https://github.com/h3js/h3) from 1.15.5 to 1.15.11.
- [Release notes](https://github.com/h3js/h3/releases)
- [Changelog](https://github.com/h3js/h3/blob/v1.15.11/CHANGELOG.md)
- [Commits](h3js/h3@v1.15.5...v1.15.11)

---
updated-dependencies:
- dependency-name: h3
  dependency-version: 1.15.11
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/h3-1.15.11 branch from 66efcfa to 5629397 Compare April 7, 2026 06:18
@VD39 VD39 merged commit 575ba86 into main Apr 7, 2026
1 check passed
@VD39 VD39 deleted the dependabot/npm_and_yarn/h3-1.15.11 branch April 7, 2026 06:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant