Skip to content

chore(deps-dev): bump h3 from 1.15.5 to 1.15.9 - #371

Closed
dependabot[bot] wants to merge 696 commits into
developfrom
dependabot/npm_and_yarn/h3-1.15.9
Closed

chore(deps-dev): bump h3 from 1.15.5 to 1.15.9#371
dependabot[bot] wants to merge 696 commits into
developfrom
dependabot/npm_and_yarn/h3-1.15.9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 21, 2026

Copy link
Copy Markdown
Contributor

Bumps h3 from 1.15.5 to 1.15.9.

Release notes

Sourced from h3's releases.

v1.15.9

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)
  • static: Prevent path traversal via double-encoded dot segments (%252e%252e) (c56683d)
  • sse: Sanitize carriage returns in event stream data and comments (ba3c3fe)

v1.15.8

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)

v1.15.7

compare changes

🩹 Fixes

  • static: Narrow path traversal check to match .. as a path segment only (c049dc0)
  • app: Decode percent-encoded path segments to prevent auth bypass (313ea52)

💅 Refactors

  • Remove implicit event handler conversion warning (#1340)

❤️ Contributors

v1.15.6

compare changes

🩹 Fixes

  • sse: Sanitize newlines in event stream fields to prevent SSE injection (840ac5c)
  • static: Prevent path traversal via percent-encoded dot segments (6465e1b)
Changelog

Sourced from h3's changelog.

v1.15.9

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)
  • static: Prevent path traversal via double-encoded dot segments (%252e%252e) (c56683d)
  • sse: Sanitize carriage returns in event stream data and comments (ba3c3fe)

🏡 Chore

❤️ Contributors

v1.15.8

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)

❤️ Contributors

v1.15.7

compare changes

🩹 Fixes

  • static: Narrow path traversal check to match .. as a path segment only (c049dc0)
  • app: Decode percent-encoded path segments to prevent auth bypass (313ea52)

💅 Refactors

  • Remove implicit event handler conversion warning (#1340)

❤️ Contributors

v1.15.6

... (truncated)

Commits
  • 4e8d43a chore(release): v1.15.9
  • 23045df chore: update deps
  • ba3c3fe fix(sse): sanitize carriage returns in event stream data and comments
  • c56683d fix(static): prevent path traversal via double-encoded dot segments (`%252e%2...
  • e3b9c9e chore(release): v1.15.8
  • 1103df6 fix: preserve %25 in pathname
  • 47684a3 chore(release): v1.15.7
  • 313ea52 fix(app): decode percent-encoded path segments to prevent auth bypass
  • c049dc0 fix(static): narrow path traversal check to match .. as a path segment only
  • 3faaea0 refactor: remove implicit event handler conversion warning (#1340)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Huskydog9988 and others added 30 commits May 8, 2025 21:22
when a metadata provider fails to import a game's developer / publisher, the import is no longer blocked. the imports usally fail because there isn't a page for these compaines
still need to migrate users from old developer and publisher tables
DecDuck and others added 23 commits February 6, 2026 09:55
* feat: use platform-specific runners

* feat: replace with template

* fix: image name

* fix: registry image name

* fix: checkout repo

* fix: add drop version

* fix: add sha env

* fix: permissions
* Adds settings for server name and logo

* Implements ApplicationLogo and replaces site name based on settings

* Refactors component for changing the company logo

* Removes unused variable

* Uses message instead of statusMessage

* Replaces favicon with logo if set
* feat: api optimisation

* feat: emulator rename
Bumps [lodash-es](https://github.com/lodash/lodash) from 4.17.21 to 4.17.23.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

---
updated-dependencies:
- dependency-name: lodash-es
  dependency-version: 4.17.23
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.21 to 4.17.23.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [seroval](https://github.com/lxsmnsyc/seroval) from 1.4.0 to 1.5.0.
- [Release notes](https://github.com/lxsmnsyc/seroval/releases)
- [Commits](https://github.com/lxsmnsyc/seroval/commits/1.5.0)

---
updated-dependencies:
- dependency-name: seroval
  dependency-version: 1.5.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* migrate bufbuild config to v2

* fix localdir lookup

* fix old oidc redirect path

* rework twemoji path stuff

* fix torrential cmd

* fix broken lock file

* align dev server port with nginx

* bump pnpm

* bump nuxt

* make translations lazy loaded

* format numbers via i18n

* fix prisma breaking if extension already exists
* migrate to prisma v7

* fix prisma type imports

* update prisma version in docker

* fix prisma cli breaking things
* fix: droplet interface not waiting for torrential

* fix: lint
* feat: new page layout + endpoint

* feat: non-parallel mass import

* feat: paginated admin library

* feat: lint and performance improvement

* feat: library filter util

* feat: link frontend features to backend

* fix: lint

* fix: small fixes

* feat: bump torrential

* fix: lint
Adds a plugin to automatically add/update the torrential depot record
* fix: error message on import

* fix: 2fa input size
* fix: typos

* fix: platform filtering

* feat: fix tags and create option
* fix: tag connect/disconnect

* fix: lint

* fix: oidc typo fix
* fix: validation and issuer checks

* feat: query param util

* fix: lint
Bumps [shescape](https://github.com/ericcornelissen/shescape) from 2.1.8 to 2.1.10.
- [Release notes](https://github.com/ericcornelissen/shescape/releases)
- [Changelog](https://github.com/ericcornelissen/shescape/blob/main/CHANGELOG.md)
- [Commits](ericcornelissen/shescape@v2.1.8...v2.1.10)

---
updated-dependencies:
- dependency-name: shescape
  dependency-version: 2.1.10
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [h3](https://github.com/h3js/h3) from 1.15.5 to 1.15.9.
- [Release notes](https://github.com/h3js/h3/releases)
- [Changelog](https://github.com/h3js/h3/blob/v1.15.9/CHANGELOG.md)
- [Commits](h3js/h3@v1.15.5...v1.15.9)

---
updated-dependencies:
- dependency-name: h3
  dependency-version: 1.15.9
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 21, 2026
@DecDuck DecDuck closed this Apr 3, 2026
@dependabot @github

dependabot Bot commented on behalf of github Apr 3, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/h3-1.15.9 branch April 3, 2026 01:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.