Skip to content

Bump h3 and @netlify/plugin-nextjs#28

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-502b308b54
Closed

Bump h3 and @netlify/plugin-nextjs#28
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-502b308b54

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 18, 2026

Copy link
Copy Markdown

Bumps h3 to 1.15.8 and updates ancestor dependency @netlify/plugin-nextjs. These dependencies need to be updated together.

Updates h3 from 0.2.12 to 1.15.8

Release notes

Sourced from h3's releases.

v1.15.8

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)

v1.15.7

compare changes

🩹 Fixes

  • static: Narrow path traversal check to match .. as a path segment only (c049dc0)
  • app: Decode percent-encoded path segments to prevent auth bypass (313ea52)

💅 Refactors

  • Remove implicit event handler conversion warning (#1340)

❤️ Contributors

v1.15.6

compare changes

🩹 Fixes

  • sse: Sanitize newlines in event stream fields to prevent SSE injection (840ac5c)
  • static: Prevent path traversal via percent-encoded dot segments (6465e1b)

v1.15.5

compare changes

[!IMPORTANT] Security: Fixed a bug in readBody(event) and readRawBody(event) utils where certain Transfer-Encoding header formats could cause the request body to be ignored.

In some deployments (for example, behind TCP load balancers or non-normalizing proxies), this could allow request smuggling. The handling is now safe and fully compliant. (read more)

🩹 Fixes

  • readRawBody: Fix case-sensitive Transfer-Encoding check causing request smuggling risk (618ccf4)

v1.15.4

compare changes

🩹 Fixes

  • getRequestHost: Return first host from x-forwarded-host (#1175)

... (truncated)

Changelog

Sourced from h3's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

v2.0.1-rc.16

compare changes

🏡 Chore

❤️ Contributors

v2.0.1-rc.15

compare changes

🚀 Enhancements

  • handler: New defineJsonRpcHandler and defineJsonRpcWebSocketHandler (#1180)

🔥 Performance

  • resolveLazyHandler: Replace with inline expression (#1296)

🩹 Fixes

  • sse: Sanitize newlines in event stream fields to prevent SSE injection (7791538)
  • static: Prevent path traversal via percent-encoded dot segments (0e751b4)

📖 Documentation

  • community: Add clear router (#1303)
  • Add unjwt community library entry (#1309)

📦 Build

  • Bundle docs as skill + h3 docs (#1311)

🏡 Chore

... (truncated)

Commits
  • 35d8a14 lint
  • 3693651 fix: preserve %25
  • fd4c800 test: fix security test
  • 6f6dc09 fix(event): normalize percent-encoded URL pathname to prevent middleware bypass
  • 9947d51 fix(static): prevent backslash-based path traversal in resolveDotSegments
  • 99ec3a2 types: mark all createError overloads as @​deprecated (#1343)
  • 8a4ac16 fmt
  • 0136851 refactor: improve requestWithURL
  • d1da262 feat: add requestWith*URL utils and use for faster mounts (#1342)
  • 60a2e91 fix(utils/redirect): escape HTML special characters in body (#1317)
  • Additional commits viewable in compare view

Updates @netlify/plugin-nextjs from 4.2.7 to 4.41.6

Release notes

Sourced from @​netlify/plugin-nextjs's releases.

plugin-nextjs: v4.41.6

4.41.6 (2026-01-28)

Bug Fixes

  • lazy-load HTMLRewriter WASM only when needed (#3390) (f1d2f1a)

plugin-nextjs: v4.41.5

4.41.5 (2026-01-08)

Bug Fixes

  • v4: make fetch and self both be reassignable instead of const (#3360) (b4f2906)

plugin-nextjs: v4.41.3

4.41.3 (2023-12-08)

Bug Fixes

  • check type before using string-only method (#2393) (06f0e0c)

plugin-nextjs: v4.41.2

4.41.2 (2023-11-15)

Bug Fixes

  • deps: update dependency @​netlify/ipx to ^1.4.6 (#2368) (f73cbc0)

plugin-nextjs: v4.41.1

4.41.1 (2023-10-19)

Bug Fixes

plugin-nextjs: v4.41.0

4.41.0 (2023-10-17)

Features

Bug Fixes

... (truncated)

Changelog

Sourced from @​netlify/plugin-nextjs's changelog.

Changelog

5.15.9 (2026-03-09)

Bug Fixes

  • handle extractExportedConstValue returning null or wrapped object in next@canary (#3444) (c8808a5)
  • workaround tarball bundling issues with virtual CJS modules for Node.js middleware/proxy (#3448) (056f1c7)

5.15.8 (2026-02-05)

Bug Fixes

  • handle case of resolving commonjs with nested package.json in Node Middlleware/proxy (#3408) (df57270)

5.15.7 (2026-01-26)

Bug Fixes

  • encode cache tags provided by Next.js for App Router (#3384) (f3c9b64)

5.15.6 (2026-01-26)

Bug Fixes

  • lazy-load HTMLRewriter WASM only when needed (#3373) (23af38d)

5.15.5 (2026-01-13)

Bug Fixes

  • handle Next.js using cdn-cache-control for cacheable responses (#3364) (55fcb3c)

5.15.4 (2026-01-05)

Bug Fixes

  • handle PPR shells for fully dynamic segments on Next.js 16.1.0+ (#3349) (be30cf5)

5.15.3 (2025-12-18)

Bug Fixes

... (truncated)

Commits
  • 5de4ef0 chore: release release-v4 (#3391)
  • ab1ff72 chore: don't publish with --provenance, as setup is not adjusted for it
  • f1d2f1a fix: lazy-load HTMLRewriter WASM only when needed (#3390)
  • afc2eb2 chore: release release-v4 (#3361)
  • b4f2906 fix(v4): make fetch and self both be reassignable instead of const (#3360)
  • 593e4e0 ci: allow manual publish
  • ddfc2d5 chore: release v4 (#2462)
  • 7d9b9df ci: setup v4 publishing
  • 672cdcd fix: use modern import attributes syntax for JSON imports (#3352)
  • 526cd4e chore(deps): update dependency @​netlify/edge-functions to ^2.8.1 (#2457)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by seanroberts, a new releaser for @​netlify/plugin-nextjs since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [h3](https://github.com/h3js/h3) to 1.15.8 and updates ancestor dependency [@netlify/plugin-nextjs](https://github.com/opennextjs/opennextjs-netlify). These dependencies need to be updated together.


Updates `h3` from 0.2.12 to 1.15.8
- [Release notes](https://github.com/h3js/h3/releases)
- [Changelog](https://github.com/h3js/h3/blob/main/CHANGELOG.md)
- [Commits](h3js/h3@v0.2.12...v1.15.8)

Updates `@netlify/plugin-nextjs` from 4.2.7 to 4.41.6
- [Release notes](https://github.com/opennextjs/opennextjs-netlify/releases)
- [Changelog](https://github.com/opennextjs/opennextjs-netlify/blob/main/CHANGELOG.md)
- [Commits](opennextjs/opennextjs-netlify@v4.2.7...plugin-nextjs-v4.41.6)

---
updated-dependencies:
- dependency-name: h3
  dependency-version: 1.15.8
  dependency-type: indirect
- dependency-name: "@netlify/plugin-nextjs"
  dependency-version: 4.41.6
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 18, 2026
@vercel

vercel Bot commented Mar 18, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
andersuarez-com Error Error Mar 18, 2026 9:58pm

@dependabot @github

dependabot Bot commented on behalf of github Mar 20, 2026

Copy link
Copy Markdown
Author

Superseded by #29.

@dependabot dependabot Bot closed this Mar 20, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/multi-502b308b54 branch March 20, 2026 22:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants