Bump h3 from 2.0.1-rc.25 to 2.0.1-rc.26

[dependabot]

Bumps h3 from 2.0.1-rc.25 to 2.0.1-rc.26.

Release notes

Sourced from h3's releases.

v2.0.1-rc.26

compare changes

🚀 Enhancements

• resolveDotSegments: Add mergeSlashes option (9581407)
• session: Default session cookie to SameSite=Lax (acf8d77)
• ⚠️ Escape interpolated values in html tagged template (#1459)
• readValidatedBody: Support readBody options (#1476)
• Add onDispose hook (#1488)
• defineValidatedHandler: Support async validation (#1491)
• sse: Allow returning EventStream directly from handlers (#1508)

🔥 Performance

• Single-scan fast-path guard for resolveDotSegments (#1458)
• cookie: Avoid quadratic chunked cookie parsing and header rebuilds (#1472)
• middleware: Precompose middleware chains (#1475)
• body-limit: Stream enforcement instead of pre-buffering (#1500)

🩹 Fixes

• resolveDotSegments: Preserve trailing slash on trailing dot segments (ca7de07)
• cookie: Dedup cookies with leading-dot / mixed-case domains (#1462)
• cors: Warn on credentials with null origin (#1464)
• Decode Basic-auth credentials as UTF-8 (#1463)
• proxy: forwardHeaders must not override framing headers (#1467)
• cookie: Cap chunk count in setChunkedCookie (#1469)
• cors: Set single-valued CORS headers instead of appending (#1466)
• auth: Harden basic-auth realm handling and credential timing (#1468)
• validate: Convert malformed JSON to 400 in validated-handler path (#1465)
• base: Collapse leading-slash run in all base-stripping sites (#1471)
• html: Make raw() trust marker unforgeable and hoist escape map (#1473)
• json-rpc: Use -32600 for valid-JSON non-object bodies (#1483)
• Only discard prepared headers for error responses (#1486)
• event-stream: Correct stream teardown on close and client disconnect (#1484)
• deprecated: Correct v1 signatures in the compat shim (#1492)
• response: Do not render non-Error throws as successful responses (#1485)
• event: Keep event.context and req.context as one reference (#1499)
• response: Absorb errors thrown in onResponse hook (4a32c1b)
• response: Route synchronous prepareResponse throws through the error pipeline (#1503)
• response: Keep content-length header for Uint8Array responses (#1504)
• response: Strip HEAD body when merging prepared headers into a mutable Response (#1490)
• response: Allow status and headers staged during the first stream chunk (#1512)

💅 Refactors

• request: ⚠️ Make x-forwarded-proto trust opt-in (#1461)
• event-stream: ⚠️ Drop autoclose option (#1495)
• sse: Promote EventStream to public API, deprecate createEventStream (#1509)

... (truncated)

Changelog

Sourced from h3's changelog.

v2.0.1-rc.26

compare changes

🚀 Enhancements

• resolveDotSegments: Add mergeSlashes option (9581407)
• session: Default session cookie to SameSite=Lax (acf8d77)
• ⚠️ Escape interpolated values in html tagged template (#1459)
• readValidatedBody: Support readBody options (#1476)
• Add onDispose hook (#1488)
• defineValidatedHandler: Support async validation (#1491)
• sse: Allow returning EventStream directly from handlers (#1508)

🔥 Performance

• Single-scan fast-path guard for resolveDotSegments (#1458)
• cookie: Avoid quadratic chunked cookie parsing and header rebuilds (#1472)
• middleware: Precompose middleware chains (#1475)
• body-limit: Stream enforcement instead of pre-buffering (#1500)

🩹 Fixes

• resolveDotSegments: Preserve trailing slash on trailing dot segments (ca7de07)
• cookie: Dedup cookies with leading-dot / mixed-case domains (#1462)
• cors: Warn on credentials with null origin (#1464)
• Decode Basic-auth credentials as UTF-8 (#1463)
• proxy: ForwardHeaders must not override framing headers (#1467)
• cookie: Cap chunk count in setChunkedCookie (#1469)
• cors: Set single-valued CORS headers instead of appending (#1466)
• auth: Harden basic-auth realm handling and credential timing (#1468)
• validate: Convert malformed JSON to 400 in validated-handler path (#1465)
• base: Collapse leading-slash run in all base-stripping sites (#1471)
• html: Make raw() trust marker unforgeable and hoist escape map (#1473)
• json-rpc: Use -32600 for valid-JSON non-object bodies (#1483)
• Only discard prepared headers for error responses (#1486)
• event-stream: Correct stream teardown on close and client disconnect (#1484)
• deprecated: Correct v1 signatures in the compat shim (#1492)
• response: Do not render non-Error throws as successful responses (#1485)
• event: Keep event.context and req.context as one reference (#1499)
• response: Absorb errors thrown in onResponse hook (4a32c1b)
• response: Route synchronous prepareResponse throws through the error pipeline (#1503)
• response: Keep content-length header for Uint8Array responses (#1504)
• response: Strip HEAD body when merging prepared headers into a mutable Response (#1490)
• response: Allow status and headers staged during the first stream chunk (#1512)

💅 Refactors

• request: ⚠️ Make x-forwarded-proto trust opt-in (#1461)
• event-stream: ⚠️ Drop autoclose option (#1495)

... (truncated)

Commits

• 64ebd14 chore(release): v2.0.1-rc.26
• 6e24eb3 chore: update deps
• 6ebd459 fix(response): allow status and headers staged during the first stream chunk ...
• 321b1dc chore: apply automated updates
• 50266f3 chore: update docs
• ba42947 chore: update undocs
• dd19737 refactor(sse): promote EventStream to public API, deprecate createEventStream...
• c82019d feat(sse): allow returning EventStream directly from handlers (#1508)
• 8dc8a28 fix(response): strip HEAD body when merging prepared headers into a mutable R...
• 5cba776 fix(response): keep content-length header for Uint8Array responses (#1504)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[pkg-pr-new]

Open in StackBlitz

rescript

npm i https://pkg.pr.new/rescript@8521

@rescript/darwin-arm64

npm i https://pkg.pr.new/@rescript/darwin-arm64@8521

@rescript/darwin-x64

npm i https://pkg.pr.new/@rescript/darwin-x64@8521

@rescript/linux-arm64

npm i https://pkg.pr.new/@rescript/linux-arm64@8521

@rescript/linux-x64

npm i https://pkg.pr.new/@rescript/linux-x64@8521

@rescript/runtime

npm i https://pkg.pr.new/@rescript/runtime@8521

@rescript/win32-x64

npm i https://pkg.pr.new/@rescript/win32-x64@8521

commit: 2e2f86b

[github-actions]

Developer playground preview: https://rescript-lang.github.io/rescript/dev-playground/?version=pr-8521