Update dependency h3 to v2.0.1-rc.29

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
h3 (source)	2.0.1-rc.26 → 2.0.1-rc.29

---

Release Notes

h3js/h3 (h3)

v2.0.1-rc.29

Compare Source

compare changes

🩹 Fixes

• ws: Keep WebSocket hooks reachable when the response is rebuilt (3a57939)

❤️ Contributors

• Pooya Parsa (@​pi0)

v2.0.1-rc.28

Compare Source

compare changes

🩹 Fixes

• static: Keep a leading separator run from bypassing a route guard (f3e4c46)
• proxy: Strip tab/LF/CR from internal proxy targets (ffd9620)
• proxy: Do not include upstream failure message in gateway error (936f14b)
• response: Normalize values thrown from the onError hook (2d6a10a)
• response: Detect HTTPResponse by brand instead of constructor.name (0bbcbc4)
• fromNodeHandler: Don't hang the event when a piped client disconnects (373e32a)
• handler: Run middleware for object syntax with fetch (cf7e585)
• response: Call the onError hook again (f176b35)
• static: Refuse a non-canonical pathname instead of resolving it (baef4b9)

📖 Documentation

• Rewrite route rules (abd4d77)
• request: Add security caveat for getRequestIP xForwardedFor (b09eda1)

🏡 Chore

• Apply automated updates (a98d6d6)
• Apply automated updates (449aa7f)
• Update deps (75fd2de)
• Lint (f05b374)
• Update deps (71715ce)

✅ Tests

• Bump bundle size (bd5cd6a)

❤️ Contributors

• Pooya Parsa (@​pi0)

v2.0.1-rc.27

Compare Source

compare changes

🚀 Enhancements

• Route rules (#​1524)
• session: Add opt-in idleTimeout for sliding expiration (#​1513)

🩹 Fixes

• session: Encode large payloads outside node-compatible runtimes (#​1515)
• event: ⚠️ Decode only needless escapes in the pathname (#​1526)
• middleware: Match use() route filters with rou3 (d9d3124)
• response: Sanitize status and statusText (8e69593)
• Normalize route patterns as pathnames (cbd5c73)
• middleware: Compare method scopes case-insensitively (850f25c)
• request: Compare methods case-insensitively in isMethod (#​1528)
• proxy: Keep internal targets on the app origin (07d22ec)
• json-rpc: ⚠️ Require JSON content-type, validate origin and cap batch size (72d8e05)
• fingerprint: ⚠️ Default to SHA-256 and disambiguate components (51e68cd)
• cookie: Keep unparseable set-cookie headers when merging (175ba5c)
• static: Keep encoded backslashes opaque in the asset id (ab3f23c)
• request: Keep the request proxy cache from shadowing real properties (c71f5c0)
• proxy: ⚠️ Xfwd must not let client x-forwarded-* headers win (0c7429e)
• response: Keep prepared headers from accumulating on reused Responses (9f766d9)
• request: Keep a malformed x-forwarded-host from stripping the real port (429b994)
• request: ⚠️ Keep the host header from steering the synthesized URL (2b59a3a)
• rules: Keep a route-scoped cache rule from deadlocking the request (484ec58)
• route: Keep removeRoute from unregistering sibling routes (94d0edd)

📖 Documentation

• Clarify getRouterParams decode is a single pass (44621f3)
• rules: Cache rule ends the global middleware chain on misses too (9f3eea3)

📦 Build

• Prevent malformed pathname guard from being tree-shaken (fa00775)

🏡 Chore

• Apply automated updates (cbb3063)
• Update undocs (502c59f)
• Fix types (2dbb9f3)
• Update undocs (176e507)
• Update undocs (dd993c4)
• Update undocs (7ab53b2)
• Update undocs (d60b5e0)
• Update undocs (9ef8ec2)
• Update undocs (0f987dd)
• Update docs lock (c040817)
• Update undocs (50b00d2)
• Update undocs (5e8a317)
• Update gitignore (7e4ce44)
• Update deps (516444b)
• Apply automated updates (55335c5)
• Apply automated updates (0da4bf0)
• Bump bundle (957dbe6)

🤖 CI

• Harden workflows (#​1529)

⚠️ Breaking Changes

• event: ⚠️ Decode only needless escapes in the pathname (#​1526)
• json-rpc: ⚠️ Require JSON content-type, validate origin and cap batch size (72d8e05)
• fingerprint: ⚠️ Default to SHA-256 and disambiguate components (51e68cd)
• proxy: ⚠️ Xfwd must not let client x-forwarded-* headers win (0c7429e)
• request: ⚠️ Keep the host header from steering the synthesized URL (2b59a3a)

❤️ Contributors

• Shree Bohara (@​ShreeBohara)
• Pooya Parsa (@​pi0)
• Pi0x x@pi0.io
• Vijay Misal (@​vjymisal0)
• Jayesh Bhade (@​Jaybhade)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.