h3 1.12.0 → 1.13.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/dist/index.cjs +6 -2
  2. package/dist/index.d.cts +8 -5
  3. package/dist/index.d.mts +8 -5
  4. package/dist/index.d.ts +8 -5
  5. package/dist/index.mjs +6 -2
  6. package/package.json +38 -34
package/dist/index.cjs CHANGED
@@ -414,6 +414,9 @@ function readRawBody(event, encoding = "utf8") {
414
414
  if (_resolved.constructor === Object) {
415
415
  return Buffer.from(JSON.stringify(_resolved));
416
416
  }
417
+ if (_resolved instanceof URLSearchParams) {
418
+ return Buffer.from(_resolved.toString());
419
+ }
417
420
  return Buffer.from(_resolved);
418
421
  });
419
422
  return encoding ? promise2.then((buff) => buff.toString(encoding)) : promise2;
@@ -671,7 +674,7 @@ function splitCookiesString(cookiesString) {
671
674
  }
672
675
  }
673
676
  if (!cookiesSeparatorFound || pos >= cookiesString.length) {
674
- cookiesStrings.push(cookiesString.slice(start, cookiesString.length));
677
+ cookiesStrings.push(cookiesString.slice(start));
675
678
  }
676
679
  }
677
680
  return cookiesStrings;
@@ -2114,7 +2117,8 @@ function websocketOptions(evResolver, appOptions) {
2114
2117
  return {
2115
2118
  ...appOptions.websocket,
2116
2119
  async resolve(info) {
2117
- const { pathname } = ufo.parseURL(info.url || "/");
2120
+ const url = info.request?.url || info.url || "/";
2121
+ const { pathname } = typeof url === "string" ? ufo.parseURL(url) : url;
2118
2122
  const resolved = await evResolver(pathname);
2119
2123
  return resolved?.handler?.__websocket__ || {};
2120
2124
  }
package/dist/index.d.cts CHANGED
@@ -48,7 +48,7 @@ declare class H3Event<_RequestT extends EventHandlerRequest = EventHandlerReques
48
48
  toJSON(): string;
49
49
  /** @deprecated Please use `event.node.req` instead. */
50
50
  get req(): IncomingMessage & {
51
- originalUrl?: string | undefined;
51
+ originalUrl?: string;
52
52
  };
53
53
  /** @deprecated Please use `event.node.res` instead. */
54
54
  get res(): ServerResponse<IncomingMessage>;
@@ -93,7 +93,7 @@ declare const lazyEventHandler: typeof defineLazyEventHandler;
93
93
  * https://developer.mozilla.org/en-US/docs/Web/API/Headers
94
94
  */
95
95
  declare const H3Headers: {
96
- new (init?: HeadersInit | undefined): Headers;
96
+ new (init?: HeadersInit): Headers;
97
97
  prototype: Headers;
98
98
  };
99
99
  /**
@@ -101,11 +101,11 @@ declare const H3Headers: {
101
101
  * https://developer.mozilla.org/en-US/docs/Web/API/Response
102
102
  */
103
103
  declare const H3Response: {
104
- new (body?: BodyInit | null | undefined, init?: ResponseInit | undefined): Response;
104
+ new (body?: BodyInit | null, init?: ResponseInit): Response;
105
105
  prototype: Response;
106
106
  error(): Response;
107
- json(data: any, init?: ResponseInit | undefined): Response;
108
- redirect(url: string | URL, status?: number | undefined): Response;
107
+ json(data: any, init?: ResponseInit): Response;
108
+ redirect(url: string | URL, status?: number): Response;
109
109
  };
110
110
 
111
111
  type SessionDataT = Record<string, any>;
@@ -470,6 +470,9 @@ declare function readRawBody<E extends Encoding = "utf8">(event: H3Event, encodi
470
470
  /**
471
471
  * Reads request body and tries to safely parse using [destr](https://github.com/unjs/destr).
472
472
  *
473
+ * Be aware that this utility is not restricted to `application/json` and will parse `application/x-www-form-urlencoded` content types.
474
+ * Because of this, authenticated `GET`/`POST` handlers may be at risk of a [CSRF](https://owasp.org/www-community/attacks/csrf) attack, and must check the `content-type` header manually.
475
+ *
473
476
  * @example
474
477
  * export default defineEventHandler(async (event) => {
475
478
  * const body = await readBody(event);
package/dist/index.d.mts CHANGED
@@ -48,7 +48,7 @@ declare class H3Event<_RequestT extends EventHandlerRequest = EventHandlerReques
48
48
  toJSON(): string;
49
49
  /** @deprecated Please use `event.node.req` instead. */
50
50
  get req(): IncomingMessage & {
51
- originalUrl?: string | undefined;
51
+ originalUrl?: string;
52
52
  };
53
53
  /** @deprecated Please use `event.node.res` instead. */
54
54
  get res(): ServerResponse<IncomingMessage>;
@@ -93,7 +93,7 @@ declare const lazyEventHandler: typeof defineLazyEventHandler;
93
93
  * https://developer.mozilla.org/en-US/docs/Web/API/Headers
94
94
  */
95
95
  declare const H3Headers: {
96
- new (init?: HeadersInit | undefined): Headers;
96
+ new (init?: HeadersInit): Headers;
97
97
  prototype: Headers;
98
98
  };
99
99
  /**
@@ -101,11 +101,11 @@ declare const H3Headers: {
101
101
  * https://developer.mozilla.org/en-US/docs/Web/API/Response
102
102
  */
103
103
  declare const H3Response: {
104
- new (body?: BodyInit | null | undefined, init?: ResponseInit | undefined): Response;
104
+ new (body?: BodyInit | null, init?: ResponseInit): Response;
105
105
  prototype: Response;
106
106
  error(): Response;
107
- json(data: any, init?: ResponseInit | undefined): Response;
108
- redirect(url: string | URL, status?: number | undefined): Response;
107
+ json(data: any, init?: ResponseInit): Response;
108
+ redirect(url: string | URL, status?: number): Response;
109
109
  };
110
110
 
111
111
  type SessionDataT = Record<string, any>;
@@ -470,6 +470,9 @@ declare function readRawBody<E extends Encoding = "utf8">(event: H3Event, encodi
470
470
  /**
471
471
  * Reads request body and tries to safely parse using [destr](https://github.com/unjs/destr).
472
472
  *
473
+ * Be aware that this utility is not restricted to `application/json` and will parse `application/x-www-form-urlencoded` content types.
474
+ * Because of this, authenticated `GET`/`POST` handlers may be at risk of a [CSRF](https://owasp.org/www-community/attacks/csrf) attack, and must check the `content-type` header manually.
475
+ *
473
476
  * @example
474
477
  * export default defineEventHandler(async (event) => {
475
478
  * const body = await readBody(event);
package/dist/index.d.ts CHANGED
@@ -48,7 +48,7 @@ declare class H3Event<_RequestT extends EventHandlerRequest = EventHandlerReques
48
48
  toJSON(): string;
49
49
  /** @deprecated Please use `event.node.req` instead. */
50
50
  get req(): IncomingMessage & {
51
- originalUrl?: string | undefined;
51
+ originalUrl?: string;
52
52
  };
53
53
  /** @deprecated Please use `event.node.res` instead. */
54
54
  get res(): ServerResponse<IncomingMessage>;
@@ -93,7 +93,7 @@ declare const lazyEventHandler: typeof defineLazyEventHandler;
93
93
  * https://developer.mozilla.org/en-US/docs/Web/API/Headers
94
94
  */
95
95
  declare const H3Headers: {
96
- new (init?: HeadersInit | undefined): Headers;
96
+ new (init?: HeadersInit): Headers;
97
97
  prototype: Headers;
98
98
  };
99
99
  /**
@@ -101,11 +101,11 @@ declare const H3Headers: {
101
101
  * https://developer.mozilla.org/en-US/docs/Web/API/Response
102
102
  */
103
103
  declare const H3Response: {
104
- new (body?: BodyInit | null | undefined, init?: ResponseInit | undefined): Response;
104
+ new (body?: BodyInit | null, init?: ResponseInit): Response;
105
105
  prototype: Response;
106
106
  error(): Response;
107
- json(data: any, init?: ResponseInit | undefined): Response;
108
- redirect(url: string | URL, status?: number | undefined): Response;
107
+ json(data: any, init?: ResponseInit): Response;
108
+ redirect(url: string | URL, status?: number): Response;
109
109
  };
110
110
 
111
111
  type SessionDataT = Record<string, any>;
@@ -470,6 +470,9 @@ declare function readRawBody<E extends Encoding = "utf8">(event: H3Event, encodi
470
470
  /**
471
471
  * Reads request body and tries to safely parse using [destr](https://github.com/unjs/destr).
472
472
  *
473
+ * Be aware that this utility is not restricted to `application/json` and will parse `application/x-www-form-urlencoded` content types.
474
+ * Because of this, authenticated `GET`/`POST` handlers may be at risk of a [CSRF](https://owasp.org/www-community/attacks/csrf) attack, and must check the `content-type` header manually.
475
+ *
473
476
  * @example
474
477
  * export default defineEventHandler(async (event) => {
475
478
  * const body = await readBody(event);
package/dist/index.mjs CHANGED
@@ -407,6 +407,9 @@ function readRawBody(event, encoding = "utf8") {
407
407
  if (_resolved.constructor === Object) {
408
408
  return Buffer.from(JSON.stringify(_resolved));
409
409
  }
410
+ if (_resolved instanceof URLSearchParams) {
411
+ return Buffer.from(_resolved.toString());
412
+ }
410
413
  return Buffer.from(_resolved);
411
414
  });
412
415
  return encoding ? promise2.then((buff) => buff.toString(encoding)) : promise2;
@@ -664,7 +667,7 @@ function splitCookiesString(cookiesString) {
664
667
  }
665
668
  }
666
669
  if (!cookiesSeparatorFound || pos >= cookiesString.length) {
667
- cookiesStrings.push(cookiesString.slice(start, cookiesString.length));
670
+ cookiesStrings.push(cookiesString.slice(start));
668
671
  }
669
672
  }
670
673
  return cookiesStrings;
@@ -2107,7 +2110,8 @@ function websocketOptions(evResolver, appOptions) {
2107
2110
  return {
2108
2111
  ...appOptions.websocket,
2109
2112
  async resolve(info) {
2110
- const { pathname } = parseURL(info.url || "/");
2113
+ const url = info.request?.url || info.url || "/";
2114
+ const { pathname } = typeof url === "string" ? parseURL(url) : url;
2111
2115
  const resolved = await evResolver(pathname);
2112
2116
  return resolved?.handler?.__websocket__ || {};
2113
2117
  }
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "h3",
3
- "version": "1.12.0",
3
+ "version": "1.13.0",
4
4
  "description": "Minimal H(TTP) framework built for high performance and portability.",
5
5
  "repository": "unjs/h3",
6
6
  "license": "MIT",
@@ -19,54 +19,58 @@
19
19
  "files": [
20
20
  "dist"
21
21
  ],
22
+ "scripts": {
23
+ "build": "unbuild",
24
+ "dev": "vitest",
25
+ "lint": "eslint --cache . && prettier -c src test playground examples docs",
26
+ "lint:fix": "eslint --cache . --fix && prettier -c src test playground examples docs -w",
27
+ "play": "listhen -w ./playground/app.ts",
28
+ "profile": "0x -o -D .profile -P 'autocannon -c 100 -p 10 -d 40 http://localhost:$PORT' ./playground/server.cjs",
29
+ "release": "pnpm test && pnpm build && changelogen --release --publish --publishTag latest && git push --follow-tags",
30
+ "test": "pnpm lint && vitest --run --coverage"
31
+ },
32
+ "resolutions": {
33
+ "h3": "link:."
34
+ },
22
35
  "dependencies": {
23
- "cookie-es": "^1.1.0",
24
- "crossws": "^0.2.4",
36
+ "cookie-es": "^1.2.2",
37
+ "crossws": ">=0.2.0 <0.4.0",
25
38
  "defu": "^6.1.4",
26
39
  "destr": "^2.0.3",
27
- "iron-webcrypto": "^1.1.1",
28
- "ohash": "^1.1.3",
40
+ "iron-webcrypto": "^1.2.1",
41
+ "ohash": "^1.1.4",
29
42
  "radix3": "^1.1.2",
30
- "ufo": "^1.5.3",
43
+ "ufo": "^1.5.4",
31
44
  "uncrypto": "^0.1.3",
32
- "unenv": "^1.9.0"
45
+ "unenv": "^1.10.0"
33
46
  },
34
47
  "devDependencies": {
35
48
  "0x": "^5.7.0",
36
- "@types/express": "^4.17.21",
37
- "@types/node": "^20.12.7",
49
+ "@types/express": "^5.0.0",
50
+ "@types/node": "^22.7.4",
38
51
  "@types/supertest": "^6.0.2",
39
- "@vitest/coverage-v8": "^1.5.2",
52
+ "@vitest/coverage-v8": "^2.1.2",
40
53
  "autocannon": "^7.15.0",
41
- "automd": "^0.3.7",
42
- "changelogen": "^0.5.5",
54
+ "automd": "^0.3.9",
55
+ "changelogen": "^0.5.7",
43
56
  "connect": "^3.7.0",
44
- "eslint": "^9.1.1",
45
- "eslint-config-unjs": "^0.3.0-rc.6",
46
- "express": "^4.19.2",
57
+ "eslint": "^9.11.1",
58
+ "eslint-config-unjs": "^0.4.1",
59
+ "express": "^4.21.0",
47
60
  "get-port": "^7.1.0",
48
- "jiti": "^1.21.0",
49
- "listhen": "^1.7.2",
61
+ "h3": "link:.",
62
+ "jiti": "^2.1.2",
63
+ "listhen": "^1.9.0",
50
64
  "node-fetch-native": "^1.6.4",
51
- "prettier": "^3.2.5",
65
+ "prettier": "^3.3.3",
52
66
  "react": "^18.3.1",
53
67
  "react-dom": "^18.3.1",
54
68
  "supertest": "^7.0.0",
55
- "typescript": "^5.4.5",
69
+ "typescript": "^5.6.2",
56
70
  "unbuild": "^2.0.0",
57
- "undici": "^6.19.2",
58
- "vitest": "^1.5.2",
59
- "zod": "^3.23.4"
71
+ "undici": "^6.19.8",
72
+ "vitest": "^2.1.2",
73
+ "zod": "^3.23.8"
60
74
  },
61
- "scripts": {
62
- "build": "unbuild",
63
- "dev": "vitest",
64
- "lint": "eslint --cache . && prettier -c src test playground examples docs",
65
- "lint:fix": "eslint --cache . --fix && prettier -c src test playground examples docs -w",
66
- "play": "listhen -w ./playground/app.ts",
67
- "profile": "0x -o -D .profile -P 'autocannon -c 100 -p 10 -d 40 http://localhost:$PORT' ./playground/server.cjs",
68
- "release": "pnpm test && pnpm build && changelogen --release && pnpm publish && git push --follow-tags",
69
- "release-rc": "pnpm test && pnpm build && changelogen --release --prerelease rc --push --publish --publishTag rc",
70
- "test": "pnpm lint && vitest --run --coverage"
71
- }
72
- }
75
+ "packageManager": "pnpm@9.7.1"
76
+ }