Skip to content

fix(deps): update lockfile to resolve h3@1.15.10 - #19933

Merged
chargome merged 1 commit into
developfrom
fix/dependabot-alert-h3-1236-1237
Mar 23, 2026
Merged

fix(deps): update lockfile to resolve h3@1.15.10#19933
chargome merged 1 commit into
developfrom
fix/dependabot-alert-h3-1236-1237

Conversation

@chargome

Copy link
Copy Markdown
Member

Fixes Dependabot alerts #1236 (SSE Event Injection) and #1237 (Path Traversal via Double Decoding) by updating the yarn.lock resolution for h3 from 1.15.5 to 1.15.10.

Easier fix than #19910 as Nuxt 3.21.x introduced breaking type changes (removed nitro from NuxtOptions and nitro:config from NuxtHooks).

@chargomechargome self-assigned this Mar 23, 2026
@github-actions

github-actionsBot commented Mar 23, 2026

Copy link
Copy Markdown
Contributor

Semver Impact of This PR

🟢 Patch (bug fixes)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).


New Features ✨

Deps

  • Bump mongodb-memory-server-global from 10.1.4 to 11.0.1 by dependabot in #19888
  • Bump stacktrace-parser from 0.1.10 to 0.1.11 by dependabot in #19887

Bug Fixes 🐛

Cloudflare

  • Send correct events in local development by JPeer264 in #19900
  • Forward ctx argument to Workflow.do user callback by Lms24 in #19891

Core

  • Send internal_error as span status for Vercel error spans by nicohrubec in #19921
  • Do not overwrite user provided conversation id in Vercel by nicohrubec in #19903
  • Return same value from startSpan as callback returns by s1gr1d in #19300

Deps

  • Update lockfile to resolve h3@1.15.10 by chargome in #19933
  • Bump fast-xml-parser to 5.5.8 in @azure/core-xml chain by chargome in #19918
  • Bump next to 15.5.14 in nextjs-15 and nextjs-15-intl E2E test apps by chargome in #19917
  • Bump socket.io-parser to 4.2.6 to fix CVE-2026-33151 by chargome in #19880

Other

  • (craft) Add missing mainDocsUrl for @sentry/effect SDK by bc-sentry in #19860
  • (nestjs) Add node to nest metadata by chargome in #19875
  • (serverless) Add node to metadata by nicohrubec in #19878

Internal Changes 🔧

Deps Dev

  • Bump effect from 3.19.19 to 3.20.0 by dependabot in #19926
  • Bump qunit-dom from 3.2.1 to 3.5.0 by dependabot in #19546
  • Bump @react-router/node from 7.13.0 to 7.13.1 by dependabot in #19544

Other

  • (astro) Re-enable server island tracing e2e test in Astro 6 by Lms24 in #19872
  • (ci) Fix "Gatbsy" typo in issue package label workflow by chargome in #19905
  • (claude) Enable Claude Code Intelligence (LSP) by s1gr1d in #19930
  • (lint) Resolve oxlint warnings by isaacs in #19893
  • (node-integration-tests) Remove unnecessary file-type dependency by Lms24 in #19824
  • (nuxt) Extract handler patching to extra plugin for Nitro v2/v3 by s1gr1d in #19915
  • (remix) Replace glob with native recursive fs walk by roli-lpci in #19531
  • (sveltekit) Replace recast + @babel/parser with acorn by roli-lpci in #19533
  • Add external contributor to CHANGELOG.md by javascript-sdk-gitflow in #19925
  • Add external contributor to CHANGELOG.md by javascript-sdk-gitflow in #19909

🤖 This preview updates automatically when you update the PR.

Co-Authored-By: Claude Sonnet 4 <noreply@anthropic.com>
@chargome
chargomeforce-pushed the fix/dependabot-alert-h3-1236-1237 branch from 93dbf6a to 761ec58CompareMarch 23, 2026 10:26
@github-actions

Copy link
Copy Markdown
Contributor

size-limit report 📦

⚠️Warning: Base artifact is not the latest one, because the latest workflow run is not done yet. This may lead to incorrect results. Try to re-run all tests to get up to date results.

PathSize% ChangeChange
@sentry/browser25.69 kB+0.2%+49 B 🔺
@sentry/browser - with treeshaking flags24.17 kB+0.14%+33 B 🔺
@sentry/browser (incl. Tracing)42.67 kB+0.13%+54 B 🔺
@sentry/browser (incl. Tracing, Profiling)47.33 kB+0.12%+55 B 🔺
@sentry/browser (incl. Tracing, Replay)81.48 kB+0.08%+57 B 🔺
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags71.06 kB+0.1%+69 B 🔺
@sentry/browser (incl. Tracing, Replay with Canvas)86.17 kB+0.06%+50 B 🔺
@sentry/browser (incl. Tracing, Replay, Feedback)98.41 kB+0.04%+36 B 🔺
@sentry/browser (incl. Feedback)42.48 kB+0.08%+30 B 🔺
@sentry/browser (incl. sendFeedback)30.35 kB+0.15%+43 B 🔺
@sentry/browser (incl. FeedbackAsync)35.4 kB+0.12%+39 B 🔺
@sentry/browser (incl. Metrics)26.96 kB+0.15%+38 B 🔺
@sentry/browser (incl. Logs)27.1 kB+0.12%+32 B 🔺
@sentry/browser (incl. Metrics & Logs)27.78 kB+0.15%+39 B 🔺
@sentry/react27.45 kB+0.22%+58 B 🔺
@sentry/react (incl. Tracing)45.01 kB+0.14%+60 B 🔺
@sentry/vue30.13 kB+0.16%+46 B 🔺
@sentry/vue (incl. Tracing)44.52 kB+0.09%+39 B 🔺
@sentry/svelte25.7 kB+0.16%+40 B 🔺
CDN Bundle28.35 kB+0.27%+75 B 🔺
CDN Bundle (incl. Tracing)43.57 kB+0.15%+62 B 🔺
CDN Bundle (incl. Logs, Metrics)29.22 kB+0.27%+77 B 🔺
CDN Bundle (incl. Tracing, Logs, Metrics)44.43 kB+0.17%+75 B 🔺
CDN Bundle (incl. Replay, Logs, Metrics)68.29 kB+0.13%+85 B 🔺
CDN Bundle (incl. Tracing, Replay)80.41 kB+0.1%+73 B 🔺
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)81.31 kB+0.1%+76 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback)85.97 kB+0.12%+103 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)86.86 kB+0.1%+86 B 🔺
CDN Bundle - uncompressed82.7 kB+0.1%+77 B 🔺
CDN Bundle (incl. Tracing) - uncompressed128.62 kB+0.05%+64 B 🔺
CDN Bundle (incl. Logs, Metrics) - uncompressed85.57 kB+0.1%+77 B 🔺
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed131.49 kB+0.05%+64 B 🔺
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed209.22 kB+0.05%+102 B 🔺
CDN Bundle (incl. Tracing, Replay) - uncompressed245.5 kB+0.04%+89 B 🔺
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed248.35 kB+0.04%+89 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed258.41 kB+0.04%+89 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed261.26 kB+0.04%+89 B 🔺
@sentry/nextjs (client)47.4 kB+0.08%+37 B 🔺
@sentry/sveltekit (client)43.12 kB+0.12%+51 B 🔺
@sentry/node-core56.42 kB+0.13%+73 B 🔺
@sentry/node173.39 kB+0.14%+235 B 🔺
@sentry/node - without tracing96.43 kB+0.1%+87 B 🔺
@sentry/aws-serverless113.44 kB+0.09%+100 B 🔺

View base workflow run

@github-actions

Copy link
Copy Markdown
Contributor

node-overhead report 🧳

Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.

ScenarioRequests/s% of BaselinePrev. Requests/sChange %
GET Baseline11,380-8,842+29%
GET With Sentry1,97117%1,653+19%
GET With Sentry (error only)7,70768%6,134+26%
POST Baseline1,291-1,144+13%
POST With Sentry63049%563+12%
POST With Sentry (error only)1,13288%991+14%
MYSQL Baseline3,489-3,278+6%
MYSQL With Sentry45813%463-1%
MYSQL With Sentry (error only)2,94584%2,644+11%

View base workflow run

@chargome
chargome marked this pull request as ready for review March 23, 2026 11:42
@chargome
chargome requested a review from s1gr1dMarch 23, 2026 11:42
@chargome
chargome merged commit 66b48de into developMar 23, 2026
238 checks passed
@chargome
chargome deleted the fix/dependabot-alert-h3-1236-1237 branch March 23, 2026 12:11
logaretm pushed a commit that referenced this pull request Mar 24, 2026
Fixes Dependabot alerts #1236 (SSE Event Injection) and #1237 (Path
Traversal via Double Decoding) by updating the yarn.lock resolution for
h3 from 1.15.5 to 1.15.10.
Easier fix than
#19910 as Nuxt 3.21.x
introduced breaking type changes (removed nitro from NuxtOptions and
nitro:config from NuxtHooks).
Co-authored-by: Claude Sonnet 4 <noreply@anthropic.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@chargome@s1gr1d