Bumps [h3](https://github.com/h3js/h3) from 1.15.6 to 1.15.10. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/h3js/h3/releases">h3's releases</a>.</em></p> <blockquote> <h2>v1.15.10</h2> <p><a href="https://github.com/h3js/h3/compare/v1.15.9...v1.15.10">compare changes</a></p> <h3>🩹 Fixes</h3> <ul> <li>Preserve percent-encoded req.url in app event handler (<a href="https://redirect.github.com/h3js/h3/pull/1355">#1355</a>)</li> </ul> <h3>❤️ Contributors</h3> <ul> <li>Sergio Azócar (<a href="https://github.com/sergioazoc"><code>@sergioazoc</code></a>)</li> </ul> <h2>v1.15.9</h2> <p><a href="https://github.com/h3js/h3/compare/v1.15.7...v1.15.9">compare changes</a></p> <h3>🩹 Fixes</h3> <ul> <li>Preserve <code>%25</code> in pathname (<a href="https://github.com/h3js/h3/commit/1103df6">1103df6</a>)</li> <li><strong>static:</strong> Prevent path traversal via double-encoded dot segments (<code>%252e%252e</code>) (<a href="https://github.com/h3js/h3/commit/c56683d">c56683d</a>)</li> <li><strong>sse:</strong> Sanitize carriage returns in event stream data and comments (<a href="https://github.com/h3js/h3/commit/ba3c3fe">ba3c3fe</a>)</li> </ul> <h2>v1.15.8</h2> <p><a href="https://github.com/h3js/h3/compare/v1.15.7...v1.15.8">compare changes</a></p> <h3>🩹 Fixes</h3> <ul> <li>Preserve <code>%25</code> in pathname (<a href="https://github.com/h3js/h3/commit/1103df6">1103df6</a>)</li> </ul> <h2>v1.15.7</h2> <p><a href="https://github.com/h3js/h3/compare/v1.15.6...v1.15.7">compare changes</a></p> <h3>🩹 Fixes</h3> <ul> <li><strong>static:</strong> Narrow path traversal check to match <code>..</code> as a path segment only (<a href="https://github.com/h3js/h3/commit/c049dc0">c049dc0</a>)</li> <li><strong>app:</strong> Decode percent-encoded path segments to prevent auth bypass (<a href="https://github.com/h3js/h3/commit/313ea52">313ea52</a>)</li> </ul> <h3>💅 Refactors</h3> <ul> <li>Remove implicit event handler conversion warning (<a href="https://redirect.github.com/h3js/h3/pull/1340">#1340</a>)</li> </ul> <h3>❤️ Contributors</h3> <ul> <li>Pooya Parsa (<a href="https://github.com/pi0"><code>@pi0</code></a>)</li> <li>Wind (<a href="https://github.com/productdevbook"><code>@productdevbook</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/h3js/h3/blob/v1.15.10/CHANGELOG.md">h3's changelog</a>.</em></p> <blockquote> <h2>v1.15.10</h2> <p><a href="https://github.com/h3js/h3/compare/v1.15.9...v1.15.10">compare changes</a></p> <h3>🩹 Fixes</h3> <ul> <li>Preserve percent-encoded req.url in app event handler (<a href="https://redirect.github.com/h3js/h3/pull/1355">#1355</a>)</li> </ul> <h3>🏡 Chore</h3> <ul> <li>Update deps (<a href="https://github.com/h3js/h3/commit/26fec6f">26fec6f</a>)</li> </ul> <h3>❤️ Contributors</h3> <ul> <li>Pooya Parsa (<a href="https://github.com/pi0"><code>@pi0</code></a>)</li> <li>Sergio Azócar (<a href="https://github.com/sergioazoc"><code>@sergioazoc</code></a>)</li> </ul> <h2>v1.15.9</h2> <p><a href="https://github.com/h3js/h3/compare/v1.15.7...v1.15.9">compare changes</a></p> <h3>🩹 Fixes</h3> <ul> <li>Preserve <code>%25</code> in pathname (<a href="https://github.com/h3js/h3/commit/1103df6">1103df6</a>)</li> <li><strong>static:</strong> Prevent path traversal via double-encoded dot segments (<code>%252e%252e</code>) (<a href="https://github.com/h3js/h3/commit/c56683d">c56683d</a>)</li> <li><strong>sse:</strong> Sanitize carriage returns in event stream data and comments (<a href="https://github.com/h3js/h3/commit/ba3c3fe">ba3c3fe</a>)</li> </ul> <h3>🏡 Chore</h3> <ul> <li><strong>release:</strong> V1.15.8 (<a href="https://github.com/h3js/h3/commit/e3b9c9e">e3b9c9e</a>)</li> <li>Update deps (<a href="https://github.com/h3js/h3/commit/23045df">23045df</a>)</li> </ul> <h3>❤️ Contributors</h3> <ul> <li>Pooya Parsa (<a href="https://github.com/pi0"><code>@pi0</code></a>)</li> </ul> <h2>v1.15.8</h2> <p><a href="https://github.com/h3js/h3/compare/v1.15.7...v1.15.8">compare changes</a></p> <h3>🩹 Fixes</h3> <ul> <li>Preserve <code>%25</code> in pathname (<a href="https://github.com/h3js/h3/commit/1103df6">1103df6</a>)</li> </ul> <h3>❤️ Contributors</h3> <ul> <li>Pooya Parsa (<a href="https://github.com/pi0"><code>@pi0</code></a>)</li> </ul> <h2>v1.15.7</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/h3js/h3/commit/b72bb57060cf68e627575e0c350742f4fa8206fa"><code>b72bb57</code></a> chore(release): v1.15.10</li> <li><a href="https://github.com/h3js/h3/commit/d8ef318fa9ce086036588443d683f97f9bb9faf8"><code>d8ef318</code></a> remove resolutions for h3</li> <li><a href="https://github.com/h3js/h3/commit/26fec6ff549e646bef284b8df4e267ddb8fc0b67"><code>26fec6f</code></a> chore: update deps</li> <li><a href="https://github.com/h3js/h3/commit/51ca9b3750a2a1426257c96e5a81001e3ec3bb42"><code>51ca9b3</code></a> fix: preserve percent-encoded req.url in app event handler (<a href="https://redirect.github.com/h3js/h3/issues/1355">#1355</a>)</li> <li><a href="https://github.com/h3js/h3/commit/4e8d43a7703d0d5c8bbc09748db1d8b9f3c51b42"><code>4e8d43a</code></a> chore(release): v1.15.9</li> <li><a href="https://github.com/h3js/h3/commit/23045df515a67f00182b5f7ca126cbec40efda4d"><code>23045df</code></a> chore: update deps</li> <li><a href="https://github.com/h3js/h3/commit/ba3c3feb6afbef8790714185fa4d12ed4ca31f6d"><code>ba3c3fe</code></a> fix(sse): sanitize carriage returns in event stream data and comments</li> <li><a href="https://github.com/h3js/h3/commit/c56683dcb134969d9c01d403d43eaa6327012007"><code>c56683d</code></a> fix(static): prevent path traversal via double-encoded dot segments (`%252e%2...</li> <li><a href="https://github.com/h3js/h3/commit/e3b9c9e3e78119dc0e047c07396c98d084c28b96"><code>e3b9c9e</code></a> chore(release): v1.15.8</li> <li><a href="https://github.com/h3js/h3/commit/1103df6d638df2d3f3959f1b2678873e2535ad5d"><code>1103df6</code></a> fix: preserve <code>%25</code> in pathname</li> <li>Additional commits viewable in <a href="https://github.com/h3js/h3/compare/v1.15.6...v1.15.10">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Sarah Etter <sarah.etter@netlify.com>