build(deps): bump the production-dependencies group with 2 updates

[dependabot]

Bumps the production-dependencies group with 2 updates: h3 and shiki.

Updates h3 from 2.0.1-rc.26 to 2.0.1-rc.29

Release notes

Sourced from h3's releases.

v2.0.1-rc.29

compare changes

🩹 Fixes

• ws: Keep WebSocket hooks reachable when the response is rebuilt (3a57939)

v2.0.1-rc.28

compare changes

🩹 Fixes

• static: Keep a leading separator run from bypassing a route guard (f3e4c46)
• proxy: Strip tab/LF/CR from internal proxy targets (ffd9620)
• proxy: Do not include upstream failure message in gateway error (936f14b)
• response: Normalize values thrown from the onError hook (2d6a10a)
• response: Detect HTTPResponse by brand instead of constructor.name (0bbcbc4)
• fromNodeHandler: Don't hang the event when a piped client disconnects (373e32a)
• handler: Run middleware for object syntax with fetch (cf7e585)
• response: Call the onError hook again (f176b35)
• static: Refuse a non-canonical pathname instead of resolving it (baef4b9)

📖 Documentation

• Rewrite route rules (abd4d77)
• request: Add security caveat for getRequestIP's xForwardedFor (b09eda1)

v2.0.1-rc.27

compare changes

🚀 Enhancements

• New route rules engine (#1524) (docs)
• session: Add opt-in idleTimeout for sliding expiration (#1513)

🩹 Fixes

• session: Encode large payloads outside node-compatible runtimes (#1515)
• event: ⚠️ Decode only needless escapes in the pathname (#1526)
• middleware: Match use() route filters with rou3 (d9d3124)
• response: Sanitize status and statusText (8e69593)
• Normalize route patterns as pathnames (cbd5c73)
• middleware: Compare method scopes case-insensitively (850f25c)
• request: Compare methods case-insensitively in isMethod (#1528)
• proxy: Keep internal targets on the app origin (07d22ec)
• json-rpc: ⚠️ Require JSON content-type, validate origin and cap batch size (72d8e05)
• fingerprint: ⚠️ Default to SHA-256 and disambiguate components (51e68cd)
• cookie: Keep unparseable set-cookie headers when merging (175ba5c)
• static: Keep encoded backslashes opaque in the asset id (ab3f23c)
• request: Keep the request proxy cache from shadowing real properties (c71f5c0)

... (truncated)

Changelog

Sourced from h3's changelog.

v2.0.1-rc.29

compare changes

🩹 Fixes

• ws: Keep WebSocket hooks reachable when the response is rebuilt (3a57939)

❤️ Contributors

• Pooya Parsa (@​pi0)

v2.0.1-rc.28

compare changes

🩹 Fixes

• static: Keep a leading separator run from bypassing a route guard (f3e4c46)
• proxy: Strip tab/LF/CR from internal proxy targets (ffd9620)
• proxy: Do not include upstream failure message in gateway error (936f14b)
• response: Normalize values thrown from the onError hook (2d6a10a)
• response: Detect HTTPResponse by brand instead of constructor.name (0bbcbc4)
• fromNodeHandler: Don't hang the event when a piped client disconnects (373e32a)
• handler: Run middleware for object syntax with fetch (cf7e585)
• response: Call the onError hook again (f176b35)
• static: Refuse a non-canonical pathname instead of resolving it (baef4b9)

📖 Documentation

• Rewrite route rules (abd4d77)
• request: Add security caveat for getRequestIP xForwardedFor (b09eda1)

🏡 Chore

• Apply automated updates (a98d6d6)
• Apply automated updates (449aa7f)
• Update deps (75fd2de)
• Lint (f05b374)
• Update deps (71715ce)

✅ Tests

• Bump bundle size (bd5cd6a)

❤️ Contributors

• Pooya Parsa (@​pi0)

v2.0.1-rc.27

... (truncated)

Commits

• b137cde chore(release): v2.0.1-rc.29
• 3a57939 fix(ws): keep WebSocket hooks reachable when the response is rebuilt
• 61b1548 chore(release): v2.0.1-rc.28
• 71715ce chore: update deps
• f05b374 chore: lint
• 75fd2de chore: update deps
• 449aa7f chore: apply automated updates
• baef4b9 fix(static): refuse a non-canonical pathname instead of resolving it
• bd5cd6a test: bump bundle size
• f176b35 fix(response): call the onError hook again
• Additional commits viewable in compare view

Updates shiki from 4.3.1 to 4.4.3

Release notes

Sourced from shiki's releases.

v4.4.3

   🚀 Features

• Update deps and grammar  -  by @​antfu (72f26)

   🐞 Bug Fixes

• vitepress-twoslash: Delay twoslash tooltip show by 200ms  -  by @​antfubot in shikijs/shiki#1306 (9f2aa)

    View changes on GitHub

v4.4.2

   🐞 Bug Fixes

• Unbreak CI after vite 8 bump and grammar/deps updates  -  by @​antfubot in shikijs/shiki#1300 (c5d31)

   🏎 Performance

• core: Token split performance improvements  -  by @​amadeus in shikijs/shiki#1301 (41896)

    View changes on GitHub

v4.4.1

   🚀 Features

• Update deps  -  by @​antfu (e07fd)

    View changes on GitHub

v4.4.0

   🚀 Features

• Update grammars and themes  -  by @​antfu (dec2a)

   🐞 Bug Fixes

• core: Guess yaml from frontmatter segments  -  by @​antfubot in shikijs/shiki#1299 (1b8b6)

    View changes on GitHub

Commits

• 48cd2cc chore: release v4.4.3
• 2aec856 chore: release v4.4.2
• c5d310b fix: unbreak CI after vite 8 bump and grammar/deps updates (#1300)
• 407dca0 chore: release v4.4.1
• a64bab1 chore: release v4.4.0
• dec2a32 feat: update grammars and themes
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[changeset-bot]

⚠️ No Changeset found

Latest commit: a6b2db9

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR