chore(deps): bump h3 from 2.0.1-rc.23 to 2.0.1-rc.24

[dependabot]

Bumps h3 from 2.0.1-rc.23 to 2.0.1-rc.24.

Release notes

Sourced from h3's releases.

v2.0.1-rc.24

compare changes

🚀 Enhancements

• Add QUERY method support (#1445)
• Add requireContentType and appendAcceptQuery utils (#1446)
• Automatically match GET routes for HEAD requests (#1452)

🩹 Fixes

• json-rpc: Do not leak internal exception messages to clients (ea2f2a3)
• request: Prevent decode:true from reintroducing path separators (cd03d41)
• handleCacheHeaders: Correct conditional-request precedence and Cache-Control default (#1454)

📖 Documentation

• Fix typos in response and handler guides (#1444)
• Add QUERY method docs (#1447)
• Remove non-existent sendEventStream from createEventStream example (#1450)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Sueun Cho (@​sueun-dev)
• Prateek Anand (@​bizprat)
• Max (@​maxtaran2010)

Changelog

Sourced from h3's changelog.

v2.0.1-rc.24

compare changes

🚀 Enhancements

• proxy: Support client aborts (#1417)
• ws: Allow optional HTTP handling in defineWebSocketHandler (#1425)
• Export resolveDotSegments as a public path utility (#1428)
• readBody: Support formdata type (#1164)
• Add QUERY method support (#1445)
• Add requireContentType and appendAcceptQuery utils (#1446)
• Automatically match GET routes for HEAD requests (#1452)

🩹 Fixes

• sanitizeStatusCode: Return default for non-numeric input instead of NaN (#1420)
• auth: Reject Basic credentials with no colon separator (#1393)
• sse: Ignore pushes after stream close (#1411)
• proxy: Ignore incoming accept-encoding header (#1423)
• cache: HandleCacheHeaders ignores multi-value If-None-Match header (#1395)
• serve-static: Compare if-modified-since at whole-second precision (#1394)
• request: Parse first entry of comma-list x-forwarded-proto header (#1413)
• serve-static: Check the response (not request) for an existing content-length (#1391)
• cors: Merge Vary headers when both origin and allow-headers emit vary (#1396)
• writeEarlyHints: Normalize Link key to prevent hanging with Node.js (#1385)
• event: Return 400 for malformed percent-encoded request URLs (#1424)
• mount: Restore pathname on error with try/finally (#1319)
• serve-static: Decode the resolved id before lookup (#1431)
• request: Shadow parsed _url in requestWithURL proxy (d21d93c)
• event: Clone URL for pathname normalization instead of mutating shared _url (a1cf066)
• adapters: Sync raw node req.url with event.url in fromNodeHandler (#1433)
• json-rpc: Do not leak internal exception messages to clients (ea2f2a3)
• request: Prevent decode:true from reintroducing path separators (cd03d41)
• handleCacheHeaders: Correct conditional-request precedence and Cache-Control default (#1454)

💅 Refactors

• validate: Drop always-true if (validate.body) guard in body proxy (#1392)
• Leftover changes from #1428 (#1430, #1428)

📖 Documentation

• proxy: Add note about reading body (7eb018e)
• Fix decode function name in router param helpers (#1419)
• session: Note secure cookie limitation over local HTTP (#1409)
• Document the session name option for multiple sessions (#1405)
• Add arkstack framework to community section (#1382)
• ws: Use zero-config crossws server plugin (#1427)
• Fix typos in response and handler guides (#1444)

... (truncated)

Commits

• 20bf346 chore(release): v2.0.1-rc.24
• 1fee5c7 bump pkg for previous release
• 2af124c fix(handleCacheHeaders): correct conditional-request precedence and Cache-Con...
• 536f224 docs: remove non-existent sendEventStream from createEventStream example (#1450)
• c495c6c feat: automatically match GET routes for HEAD requests (#1452)
• 3eb3a57 docs: add QUERY method docs (#1447)
• 71295c6 feat: add requireContentType and appendAcceptQuery utils (#1446)
• a6ba340 feat: add QUERY method support (#1445)
• 4e27b27 docs: fix typos in response and handler guides (#1444)
• e3d4bf8 chore: update deps
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clawhub	Error		Jul 10, 2026 4:07pm

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	h3@​2.0.1-rc.23 ⏵ 2.0.1-rc.24	-16		+1

View full report