build(deps): bump the production-dependencies group across 1 directory with 2 updates

[dependabot]

Bumps the production-dependencies group with 2 updates in the / directory: h3 and shiki.

Updates h3 from 2.0.1-rc.22 to 2.0.1-rc.26

Release notes

Sourced from h3's releases.

v2.0.1-rc.26

compare changes

🚀 Enhancements

• resolveDotSegments: Add mergeSlashes option (9581407)
• session: Default session cookie to SameSite=Lax (acf8d77)
• ⚠️ Escape interpolated values in html tagged template (#1459)
• readValidatedBody: Support readBody options (#1476)
• Add onDispose hook (#1488)
• defineValidatedHandler: Support async validation (#1491)
• sse: Allow returning EventStream directly from handlers (#1508)

🔥 Performance

• Single-scan fast-path guard for resolveDotSegments (#1458)
• cookie: Avoid quadratic chunked cookie parsing and header rebuilds (#1472)
• middleware: Precompose middleware chains (#1475)
• body-limit: Stream enforcement instead of pre-buffering (#1500)

🩹 Fixes

• resolveDotSegments: Preserve trailing slash on trailing dot segments (ca7de07)
• cookie: Dedup cookies with leading-dot / mixed-case domains (#1462)
• cors: Warn on credentials with null origin (#1464)
• Decode Basic-auth credentials as UTF-8 (#1463)
• proxy: forwardHeaders must not override framing headers (#1467)
• cookie: Cap chunk count in setChunkedCookie (#1469)
• cors: Set single-valued CORS headers instead of appending (#1466)
• auth: Harden basic-auth realm handling and credential timing (#1468)
• validate: Convert malformed JSON to 400 in validated-handler path (#1465)
• base: Collapse leading-slash run in all base-stripping sites (#1471)
• html: Make raw() trust marker unforgeable and hoist escape map (#1473)
• json-rpc: Use -32600 for valid-JSON non-object bodies (#1483)
• Only discard prepared headers for error responses (#1486)
• event-stream: Correct stream teardown on close and client disconnect (#1484)
• deprecated: Correct v1 signatures in the compat shim (#1492)
• response: Do not render non-Error throws as successful responses (#1485)
• event: Keep event.context and req.context as one reference (#1499)
• response: Absorb errors thrown in onResponse hook (4a32c1b)
• response: Route synchronous prepareResponse throws through the error pipeline (#1503)
• response: Keep content-length header for Uint8Array responses (#1504)
• response: Strip HEAD body when merging prepared headers into a mutable Response (#1490)
• response: Allow status and headers staged during the first stream chunk (#1512)

💅 Refactors

• request: ⚠️ Make x-forwarded-proto trust opt-in (#1461)
• event-stream: ⚠️ Drop autoclose option (#1495)
• sse: Promote EventStream to public API, deprecate createEventStream (#1509)

... (truncated)

Changelog

Sourced from h3's changelog.

v2.0.1-rc.26

compare changes

🚀 Enhancements

• resolveDotSegments: Add mergeSlashes option (9581407)
• session: Default session cookie to SameSite=Lax (acf8d77)
• ⚠️ Escape interpolated values in html tagged template (#1459)
• readValidatedBody: Support readBody options (#1476)
• Add onDispose hook (#1488)
• defineValidatedHandler: Support async validation (#1491)
• sse: Allow returning EventStream directly from handlers (#1508)

🔥 Performance

• Single-scan fast-path guard for resolveDotSegments (#1458)
• cookie: Avoid quadratic chunked cookie parsing and header rebuilds (#1472)
• middleware: Precompose middleware chains (#1475)
• body-limit: Stream enforcement instead of pre-buffering (#1500)

🩹 Fixes

• resolveDotSegments: Preserve trailing slash on trailing dot segments (ca7de07)
• cookie: Dedup cookies with leading-dot / mixed-case domains (#1462)
• cors: Warn on credentials with null origin (#1464)
• Decode Basic-auth credentials as UTF-8 (#1463)
• proxy: ForwardHeaders must not override framing headers (#1467)
• cookie: Cap chunk count in setChunkedCookie (#1469)
• cors: Set single-valued CORS headers instead of appending (#1466)
• auth: Harden basic-auth realm handling and credential timing (#1468)
• validate: Convert malformed JSON to 400 in validated-handler path (#1465)
• base: Collapse leading-slash run in all base-stripping sites (#1471)
• html: Make raw() trust marker unforgeable and hoist escape map (#1473)
• json-rpc: Use -32600 for valid-JSON non-object bodies (#1483)
• Only discard prepared headers for error responses (#1486)
• event-stream: Correct stream teardown on close and client disconnect (#1484)
• deprecated: Correct v1 signatures in the compat shim (#1492)
• response: Do not render non-Error throws as successful responses (#1485)
• event: Keep event.context and req.context as one reference (#1499)
• response: Absorb errors thrown in onResponse hook (4a32c1b)
• response: Route synchronous prepareResponse throws through the error pipeline (#1503)
• response: Keep content-length header for Uint8Array responses (#1504)
• response: Strip HEAD body when merging prepared headers into a mutable Response (#1490)
• response: Allow status and headers staged during the first stream chunk (#1512)

💅 Refactors

• request: ⚠️ Make x-forwarded-proto trust opt-in (#1461)
• event-stream: ⚠️ Drop autoclose option (#1495)

... (truncated)

Commits

• 64ebd14 chore(release): v2.0.1-rc.26
• 6e24eb3 chore: update deps
• 6ebd459 fix(response): allow status and headers staged during the first stream chunk ...
• 321b1dc chore: apply automated updates
• 50266f3 chore: update docs
• ba42947 chore: update undocs
• dd19737 refactor(sse): promote EventStream to public API, deprecate createEventStream...
• c82019d feat(sse): allow returning EventStream directly from handlers (#1508)
• 8dc8a28 fix(response): strip HEAD body when merging prepared headers into a mutable R...
• 5cba776 fix(response): keep content-length header for Uint8Array responses (#1504)
• Additional commits viewable in compare view

Updates shiki from 4.2.0 to 4.3.1

Release notes

Sourced from shiki's releases.

v4.3.1

   🚀 Features

• Add type field for ThemedToken  -  by @​ije in shikijs/shiki#1293 (585b5)

    View changes on GitHub

v4.3.0

   🚀 Features

• stream: Add svelte renderer  -  by @​CNSeniorious000 and Anthony Fu (via agent) in shikijs/shiki#1291 (2d18a)

    View changes on GitHub

Commits

• fdff6e2 chore: release v4.3.1
• e3cf080 chore: release v4.3.0
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[changeset-bot]

⚠️ No Changeset found

Latest commit: 621b44c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR