Skip to content

chore(deps): bump h3 from 1.15.5 to 1.15.9#80

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/h3-1.15.9
Closed

chore(deps): bump h3 from 1.15.5 to 1.15.9#80
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/h3-1.15.9

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Mar 20, 2026

Bumps h3 from 1.15.5 to 1.15.9.

Release notes

Sourced from h3's releases.

v1.15.9

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)
  • static: Prevent path traversal via double-encoded dot segments (%252e%252e) (c56683d)
  • sse: Sanitize carriage returns in event stream data and comments (ba3c3fe)

v1.15.8

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)

v1.15.7

compare changes

🩹 Fixes

  • static: Narrow path traversal check to match .. as a path segment only (c049dc0)
  • app: Decode percent-encoded path segments to prevent auth bypass (313ea52)

💅 Refactors

  • Remove implicit event handler conversion warning (#1340)

❤️ Contributors

v1.15.6

compare changes

🩹 Fixes

  • sse: Sanitize newlines in event stream fields to prevent SSE injection (840ac5c)
  • static: Prevent path traversal via percent-encoded dot segments (6465e1b)
Changelog

Sourced from h3's changelog.

v1.15.9

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)
  • static: Prevent path traversal via double-encoded dot segments (%252e%252e) (c56683d)
  • sse: Sanitize carriage returns in event stream data and comments (ba3c3fe)

🏡 Chore

❤️ Contributors

v1.15.8

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)

❤️ Contributors

v1.15.7

compare changes

🩹 Fixes

  • static: Narrow path traversal check to match .. as a path segment only (c049dc0)
  • app: Decode percent-encoded path segments to prevent auth bypass (313ea52)

💅 Refactors

  • Remove implicit event handler conversion warning (#1340)

❤️ Contributors

v1.15.6

... (truncated)

Commits
  • 4e8d43a chore(release): v1.15.9
  • 23045df chore: update deps
  • ba3c3fe fix(sse): sanitize carriage returns in event stream data and comments
  • c56683d fix(static): prevent path traversal via double-encoded dot segments (`%252e%2...
  • e3b9c9e chore(release): v1.15.8
  • 1103df6 fix: preserve %25 in pathname
  • 47684a3 chore(release): v1.15.7
  • 313ea52 fix(app): decode percent-encoded path segments to prevent auth bypass
  • c049dc0 fix(static): narrow path traversal check to match .. as a path segment only
  • 3faaea0 refactor: remove implicit event handler conversion warning (#1340)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 20, 2026
@cloudflare-workers-and-pages
Copy link
Copy Markdown

cloudflare-workers-and-pages Bot commented Mar 20, 2026

Deploying launchpad with  Cloudflare Pages  Cloudflare Pages

Latest commit: 07f1d0a
Status: ✅  Deploy successful!
Preview URL: https://2228fc19.launchpad-2u8.pages.dev
Branch Preview URL: https://dependabot-npm-and-yarn-h3-1-r5am.launchpad-2u8.pages.dev

View logs

@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/h3-1.15.9 branch from 5f785e8 to 627f047 Compare April 12, 2026 12:04
Bumps [h3](https://github.com/h3js/h3) from 1.15.5 to 1.15.9.
- [Release notes](https://github.com/h3js/h3/releases)
- [Changelog](https://github.com/h3js/h3/blob/v1.15.9/CHANGELOG.md)
- [Commits](h3js/h3@v1.15.5...v1.15.9)

---
updated-dependencies:
- dependency-name: h3
  dependency-version: 1.15.9
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/h3-1.15.9 branch from 627f047 to 07f1d0a Compare April 12, 2026 12:25
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 12, 2026

Looks like h3 is up-to-date now, so this is no longer needed.

@dependabot dependabot Bot closed this Apr 12, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/h3-1.15.9 branch April 12, 2026 12:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants