Skip to content

chore(deps): update nitro to v2.0.1-rc.26 - #1752

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/nitro
Closed

chore(deps): update nitro to v2.0.1-rc.26#1752
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/nitro

Conversation

@renovate

@renovate renovate Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
h3 (source) 2.0.1-rc.22 → 2.0.1-rc.26 age confidence
h3-next (source) 2.0.1-rc.22 → 2.0.1-rc.26 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

h3js/h3 (h3)

v2.0.1-rc.26

Compare Source

compare changes

🚀 Enhancements
  • resolveDotSegments: Add mergeSlashes option (9581407)
  • session: Default session cookie to SameSite=Lax (acf8d77)
  • ⚠️ Escape interpolated values in html tagged template (#​1459)
  • readValidatedBody: Support readBody options (#​1476)
  • Add onDispose hook (#​1488)
  • defineValidatedHandler: Support async validation (#​1491)
  • sse: Allow returning EventStream directly from handlers (#​1508)
🔥 Performance
  • Single-scan fast-path guard for resolveDotSegments (#​1458)
  • cookie: Avoid quadratic chunked cookie parsing and header rebuilds (#​1472)
  • middleware: Precompose middleware chains (#​1475)
  • body-limit: Stream enforcement instead of pre-buffering (#​1500)
🩹 Fixes
  • resolveDotSegments: Preserve trailing slash on trailing dot segments (ca7de07)
  • cookie: Dedup cookies with leading-dot / mixed-case domains (#​1462)
  • cors: Warn on credentials with null origin (#​1464)
  • Decode Basic-auth credentials as UTF-8 (#​1463)
  • proxy: ForwardHeaders must not override framing headers (#​1467)
  • cookie: Cap chunk count in setChunkedCookie (#​1469)
  • cors: Set single-valued CORS headers instead of appending (#​1466)
  • auth: Harden basic-auth realm handling and credential timing (#​1468)
  • validate: Convert malformed JSON to 400 in validated-handler path (#​1465)
  • base: Collapse leading-slash run in all base-stripping sites (#​1471)
  • html: Make raw() trust marker unforgeable and hoist escape map (#​1473)
  • json-rpc: Use -32600 for valid-JSON non-object bodies (#​1483)
  • Only discard prepared headers for error responses (#​1486)
  • event-stream: Correct stream teardown on close and client disconnect (#​1484)
  • deprecated: Correct v1 signatures in the compat shim (#​1492)
  • response: Do not render non-Error throws as successful responses (#​1485)
  • event: Keep event.context and req.context as one reference (#​1499)
  • response: Absorb errors thrown in onResponse hook (4a32c1b)
  • response: Route synchronous prepareResponse throws through the error pipeline (#​1503)
  • response: Keep content-length header for Uint8Array responses (#​1504)
  • response: Strip HEAD body when merging prepared headers into a mutable Response (#​1490)
  • response: Allow status and headers staged during the first stream chunk (#​1512)
💅 Refactors
  • request: ⚠️ Make x-forwarded-proto trust opt-in (#​1461)
  • event-stream: ⚠️ Drop autoclose option (#​1495)
  • sse: Promote EventStream to public API, deprecate createEventStream (#​1509)
📖 Documentation
  • Security caveats for cors, proxy, redirect, host and static utils (#​1470)
  • Explain event.url.pathname decoding (3f8b5bc)
🌊 Types
  • Canonical RouteRules interface (#​1474)
  • Remove unused StaticAssetMeta.path (0b34e24)
🏡 Chore
⚠️ Breaking Changes
  • ⚠️ Escape interpolated values in html tagged template (#​1459)
  • request: ⚠️ Make x-forwarded-proto trust opt-in (#​1461)
  • event-stream: ⚠️ Drop autoclose option (#​1495)
❤️ Contributors

v2.0.1-rc.25

Compare Source

compare changes

🚀 Enhancements
🩹 Fixes
  • cors: Correct vary handling and credentialed wildcard behavior (#​1456)
  • session: Raise default seal PBKDF2 iterations to 8192 (#​1457)
🏡 Chore
❤️ Contributors

v2.0.1-rc.24

Compare Source

compare changes

🚀 Enhancements
  • proxy: Support client aborts (#​1417)
  • ws: Allow optional HTTP handling in defineWebSocketHandler (#​1425)
  • Export resolveDotSegments as a public path utility (#​1428)
  • readBody: Support formdata type (#​1164)
  • Add QUERY method support (#​1445)
  • Add requireContentType and appendAcceptQuery utils (#​1446)
  • Automatically match GET routes for HEAD requests (#​1452)
🩹 Fixes
  • sanitizeStatusCode: Return default for non-numeric input instead of NaN (#​1420)
  • auth: Reject Basic credentials with no colon separator (#​1393)
  • sse: Ignore pushes after stream close (#​1411)
  • proxy: Ignore incoming accept-encoding header (#​1423)
  • cache: HandleCacheHeaders ignores multi-value If-None-Match header (#​1395)
  • serve-static: Compare if-modified-since at whole-second precision (#​1394)
  • request: Parse first entry of comma-list x-forwarded-proto header (#​1413)
  • serve-static: Check the response (not request) for an existing content-length (#​1391)
  • cors: Merge Vary headers when both origin and allow-headers emit vary (#​1396)
  • writeEarlyHints: Normalize Link key to prevent hanging with Node.js (#​1385)
  • event: Return 400 for malformed percent-encoded request URLs (#​1424)
  • mount: Restore pathname on error with try/finally (#​1319)
  • serve-static: Decode the resolved id before lookup (#​1431)
  • request: Shadow parsed _url in requestWithURL proxy (d21d93c)
  • event: Clone URL for pathname normalization instead of mutating shared _url (a1cf066)
  • adapters: Sync raw node req.url with event.url in fromNodeHandler (#​1433)
  • json-rpc: Do not leak internal exception messages to clients (ea2f2a3)
  • request: Prevent decode:true from reintroducing path separators (cd03d41)
  • handleCacheHeaders: Correct conditional-request precedence and Cache-Control default (#​1454)
💅 Refactors
📖 Documentation
  • proxy: Add note about reading body (7eb018e)
  • Fix decode function name in router param helpers (#​1419)
  • session: Note secure cookie limitation over local HTTP (#​1409)
  • Document the session name option for multiple sessions (#​1405)
  • Add arkstack framework to community section (#​1382)
  • ws: Use zero-config crossws server plugin (#​1427)
  • Fix typos in response and handler guides (#​1444)
  • Add QUERY method docs (#​1447)
  • Remove non-existent sendEventStream from createEventStream example (#​1450)
🌊 Types
  • Expose .crossws on defineWebSocketHandler return type (#​1435)
🏡 Chore
✅ Tests
  • Cover zod schema query validation types (#​1404)
  • Cover cloned pipeable node responses (#​1414)
  • iron-crypto: Accept getRandomValues length error for invalid salt bits (dae12fe)
  • event: Cover shared _url normalization semantics (4a218a8)
  • event: Assert req.url reflects normalization per runtime (8410ec9)
❤️ Contributors

v2.0.1-rc.23

Compare Source

compare changes

🚀 Enhancements
  • proxy: Support client aborts (#​1417)
  • ws: Allow optional HTTP handling in defineWebSocketHandler (#​1425)
  • Export resolveDotSegments as a public path utility (#​1428)
  • readBody: Support formdata type (#​1164)
🩹 Fixes
  • sanitizeStatusCode: Return default for non-numeric input instead of NaN (#​1420)
  • auth: Reject Basic credentials with no colon separator (#​1393)
  • sse: Ignore pushes after stream close (#​1411)
  • proxy: Ignore incoming accept-encoding header (#​1423)
  • cache: HandleCacheHeaders ignores multi-value If-None-Match header (#​1395)
  • serve-static: Compare if-modified-since at whole-second precision (#​1394)
  • request: Parse first entry of comma-list x-forwarded-proto header (#​1413)
  • serve-static: Check the response (not request) for an existing content-length (#​1391)
  • cors: Merge Vary headers when both origin and allow-headers emit vary (#​1396)
  • writeEarlyHints: Normalize Link key to prevent hanging with Node.js (#​1385)
  • event: Return 400 for malformed percent-encoded request URLs (#​1424)
  • mount: Restore pathname on error with try/finally (#​1319)
  • serve-static: Decode the resolved id before lookup (#​1431)
  • request: Shadow parsed _url in requestWithURL proxy (d21d93c)
  • event: Clone URL for pathname normalization instead of mutating shared _url (a1cf066)
  • adapters: Sync raw node req.url with event.url in fromNodeHandler (#​1433)
💅 Refactors
📖 Documentation
  • proxy: Add note about reading body (7eb018e)
  • Fix decode function name in router param helpers (#​1419)
  • session: Note secure cookie limitation over local HTTP (#​1409)
  • Document the session name option for multiple sessions (#​1405)
  • Add arkstack framework to community section (#​1382)
  • ws: Use zero-config crossws server plugin (#​1427)
🌊 Types
  • Expose .crossws on defineWebSocketHandler return type (#​1435)
🏡 Chore
✅ Tests
  • Cover zod schema query validation types (#​1404)
  • Cover cloned pipeable node responses (#​1414)
  • iron-crypto: Accept getRandomValues length error for invalid salt bits (dae12fe)
  • event: Cover shared _url normalization semantics (4a218a8)
  • event: Assert req.url reflects normalization per runtime (8410ec9)
❤️ Contributors

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from danielroe as a code owner July 27, 2026 03:15
@socket-security

socket-security Bot commented Jul 27, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedh3@​2.0.1-rc.2699100879580

View full report

@socket-security

socket-security Bot commented Jul 27, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm seroval is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/nuxt@4.5.0 → npm/seroval@1.5.6

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/seroval@1.5.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@pkg-pr-new

pkg-pr-new Bot commented Jul 27, 2026

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/@nuxt/test-utils@1752

npm i https://pkg.pr.new/vitest-environment-nuxt@1752

commit: 64039b5

@danielroe danielroe closed this Jul 27, 2026
@renovate

renovate Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (2.0.1-rc.26). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@renovate
renovate Bot deleted the renovate/nitro branch July 27, 2026 07:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@danielroe danielroe Awaiting requested review from danielroe danielroe is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@danielroe