Skip to content

Bump h3 and @netlify/plugin-nextjs#29

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-a1c0fe13a4
Open

Bump h3 and @netlify/plugin-nextjs#29
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-a1c0fe13a4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 20, 2026

Copy link
Copy Markdown

Bumps h3 to 1.15.9 and updates ancestor dependency @netlify/plugin-nextjs. These dependencies need to be updated together.

Updates h3 from 0.2.12 to 1.15.9

Release notes

Sourced from h3's releases.

v1.15.9

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)
  • static: Prevent path traversal via double-encoded dot segments (%252e%252e) (c56683d)
  • sse: Sanitize carriage returns in event stream data and comments (ba3c3fe)

v1.15.8

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)

v1.15.7

compare changes

🩹 Fixes

  • static: Narrow path traversal check to match .. as a path segment only (c049dc0)
  • app: Decode percent-encoded path segments to prevent auth bypass (313ea52)

💅 Refactors

  • Remove implicit event handler conversion warning (#1340)

❤️ Contributors

v1.15.6

compare changes

🩹 Fixes

  • sse: Sanitize newlines in event stream fields to prevent SSE injection (840ac5c)
  • static: Prevent path traversal via percent-encoded dot segments (6465e1b)

v1.15.5

compare changes

[!IMPORTANT] Security: Fixed a bug in readBody(event) and readRawBody(event) utils where certain Transfer-Encoding header formats could cause the request body to be ignored.

In some deployments (for example, behind TCP load balancers or non-normalizing proxies), this could allow request smuggling. The handling is now safe and fully compliant. (read more)

🩹 Fixes

... (truncated)

Changelog

Sourced from h3's changelog.

v1.15.9

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)
  • static: Prevent path traversal via double-encoded dot segments (%252e%252e) (c56683d)
  • sse: Sanitize carriage returns in event stream data and comments (ba3c3fe)

🏡 Chore

❤️ Contributors

v1.15.8

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)

❤️ Contributors

v1.15.7

compare changes

🩹 Fixes

  • static: Narrow path traversal check to match .. as a path segment only (c049dc0)
  • app: Decode percent-encoded path segments to prevent auth bypass (313ea52)

💅 Refactors

  • Remove implicit event handler conversion warning (#1340)

❤️ Contributors

v1.15.6

... (truncated)

Commits
  • 4e8d43a chore(release): v1.15.9
  • 23045df chore: update deps
  • ba3c3fe fix(sse): sanitize carriage returns in event stream data and comments
  • c56683d fix(static): prevent path traversal via double-encoded dot segments (`%252e%2...
  • e3b9c9e chore(release): v1.15.8
  • 1103df6 fix: preserve %25 in pathname
  • 47684a3 chore(release): v1.15.7
  • 313ea52 fix(app): decode percent-encoded path segments to prevent auth bypass
  • c049dc0 fix(static): narrow path traversal check to match .. as a path segment only
  • 3faaea0 refactor: remove implicit event handler conversion warning (#1340)
  • Additional commits viewable in compare view

Updates @netlify/plugin-nextjs from 4.2.7 to 4.41.6

Release notes

Sourced from @​netlify/plugin-nextjs's releases.

plugin-nextjs: v4.41.6

4.41.6 (2026-01-28)

Bug Fixes

  • lazy-load HTMLRewriter WASM only when needed (#3390) (f1d2f1a)

plugin-nextjs: v4.41.5

4.41.5 (2026-01-08)

Bug Fixes

  • v4: make fetch and self both be reassignable instead of const (#3360) (b4f2906)

plugin-nextjs: v4.41.3

4.41.3 (2023-12-08)

Bug Fixes

  • check type before using string-only method (#2393) (06f0e0c)

plugin-nextjs: v4.41.2

4.41.2 (2023-11-15)

Bug Fixes

  • deps: update dependency @​netlify/ipx to ^1.4.6 (#2368) (f73cbc0)

plugin-nextjs: v4.41.1

4.41.1 (2023-10-19)

Bug Fixes

plugin-nextjs: v4.41.0

4.41.0 (2023-10-17)

Features

Bug Fixes

... (truncated)

Changelog

Sourced from @​netlify/plugin-nextjs's changelog.

Changelog

5.15.9 (2026-03-09)

Bug Fixes

  • handle extractExportedConstValue returning null or wrapped object in next@canary (#3444) (c8808a5)
  • workaround tarball bundling issues with virtual CJS modules for Node.js middleware/proxy (#3448) (056f1c7)

5.15.8 (2026-02-05)

Bug Fixes

  • handle case of resolving commonjs with nested package.json in Node Middlleware/proxy (#3408) (df57270)

5.15.7 (2026-01-26)

Bug Fixes

  • encode cache tags provided by Next.js for App Router (#3384) (f3c9b64)

5.15.6 (2026-01-26)

Bug Fixes

  • lazy-load HTMLRewriter WASM only when needed (#3373) (23af38d)

5.15.5 (2026-01-13)

Bug Fixes

  • handle Next.js using cdn-cache-control for cacheable responses (#3364) (55fcb3c)

5.15.4 (2026-01-05)

Bug Fixes

  • handle PPR shells for fully dynamic segments on Next.js 16.1.0+ (#3349) (be30cf5)

5.15.3 (2025-12-18)

Bug Fixes

... (truncated)

Commits
  • 5de4ef0 chore: release release-v4 (#3391)
  • ab1ff72 chore: don't publish with --provenance, as setup is not adjusted for it
  • f1d2f1a fix: lazy-load HTMLRewriter WASM only when needed (#3390)
  • afc2eb2 chore: release release-v4 (#3361)
  • b4f2906 fix(v4): make fetch and self both be reassignable instead of const (#3360)
  • 593e4e0 ci: allow manual publish
  • ddfc2d5 chore: release v4 (#2462)
  • 7d9b9df ci: setup v4 publishing
  • 672cdcd fix: use modern import attributes syntax for JSON imports (#3352)
  • 526cd4e chore(deps): update dependency @​netlify/edge-functions to ^2.8.1 (#2457)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by seanroberts, a new releaser for @​netlify/plugin-nextjs since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [h3](https://github.com/h3js/h3) to 1.15.9 and updates ancestor dependency [@netlify/plugin-nextjs](https://github.com/opennextjs/opennextjs-netlify). These dependencies need to be updated together.


Updates `h3` from 0.2.12 to 1.15.9
- [Release notes](https://github.com/h3js/h3/releases)
- [Changelog](https://github.com/h3js/h3/blob/v1.15.9/CHANGELOG.md)
- [Commits](h3js/h3@v0.2.12...v1.15.9)

Updates `@netlify/plugin-nextjs` from 4.2.7 to 4.41.6
- [Release notes](https://github.com/opennextjs/opennextjs-netlify/releases)
- [Changelog](https://github.com/opennextjs/opennextjs-netlify/blob/main/CHANGELOG.md)
- [Commits](opennextjs/opennextjs-netlify@v4.2.7...plugin-nextjs-v4.41.6)

---
updated-dependencies:
- dependency-name: h3
  dependency-version: 1.15.9
  dependency-type: indirect
- dependency-name: "@netlify/plugin-nextjs"
  dependency-version: 4.41.6
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 20, 2026
@vercel

vercel Bot commented Mar 20, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
andersuarez-com Error Error Mar 20, 2026 10:12pm

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants