skyberd · Oct 8, 2026 · Oct 8, 2026 · Oct 8, 2026 · Oct 8, 2026 · Oct 8, 2026
diff --git a/.changeset/h3-srvx-stable.md b/.changeset/h3-srvx-stable.md
@@ -0,0 +1,12 @@
+---
+'@tanstack/start-server-core': patch
+'@tanstack/start-plugin-core': patch
+---
+
+Update `h3` to 2.0.1 and `srvx` to 1.0.5. Requests with malformed percent-encoded paths (e.g. `/%80`) still respond with 400 Bad Request.
+
+Behavior changes from h3 2.0.1:
+
+- `getRequestProtocol()` and `getRequestUrl()` only read `x-forwarded-proto` when called with `{ xForwardedProto: true }`.
+- Session cookies default to `SameSite=Lax`, and `getSession()` no longer sets a cookie for a new session until the session is updated.
+- Sessions are sealed with more PBKDF2 iterations. Existing session cookies are still accepted and re-sealed on the next request.
diff --git a/e2e/e2e-utils/mock-api.mjs b/e2e/e2e-utils/mock-api.mjs
@@ -1,4 +1,10 @@
-import { setupServer } from 'msw/node'
+import { FetchInterceptor } from '@mswjs/interceptors/fetch'
+import { SetupServerApi } from 'msw/node'
 import { apiHandlers } from './src/api-handlers.ts'
 
-setupServer(...apiHandlers).listen({ onUnhandledRequest: 'bypass' })
+// The apps only call the API with `fetch`, so only `fetch` is intercepted. MSW 2's
+// default `http` interceptor replaces the global `Headers` and drops entries when
+// one `Headers` is copied into another (mswjs/interceptors#850).
+new SetupServerApi(apiHandlers, [new FetchInterceptor()]).listen({
+  onUnhandledRequest: 'bypass',
+})
diff --git a/e2e/e2e-utils/package.json b/e2e/e2e-utils/package.json
@@ -35,6 +35,7 @@
   },
   "devDependencies": {
     "@msw/playwright": "0.6.7",
+    "@mswjs/interceptors": "0.41.9",
     "msw": "2.15.0",
     "rimraf": "catalog:",
     "vite": "^8.0.14",

diff --git a/e2e/react-start/basic-react-query/package.json b/e2e/react-start/basic-react-query/package.json
@@ -32,7 +32,7 @@
     "@types/react": "^19.0.8",
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^6.0.1",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "tailwindcss": "^4.2.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",

diff --git a/e2e/react-start/basic-tsr-config/package.json b/e2e/react-start/basic-tsr-config/package.json
@@ -21,7 +21,7 @@
     "@types/node": "^22.10.2",
     "@types/react": "^19.0.8",
     "@types/react-dom": "^19.0.3",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vite": "^8.0.14",

diff --git a/e2e/react-start/basic/package.json b/e2e/react-start/basic/package.json
@@ -41,7 +41,7 @@
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^6.0.1",
     "combinate": "^1.1.11",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "tailwindcss": "^4.2.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",

diff --git a/e2e/react-start/csp/package.json b/e2e/react-start/csp/package.json
@@ -22,7 +22,7 @@
     "@types/node": "^22.10.2",
     "@types/react": "^19.0.8",
     "@types/react-dom": "^19.0.3",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vite": "^8.0.14"

diff --git a/e2e/react-start/css-inline/package.json b/e2e/react-start/css-inline/package.json
@@ -20,7 +20,7 @@
     "express": "^5.2.1",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
-    "srvx": "^0.11.9"
+    "srvx": "^1.0.5"
   },
   "devDependencies": {
     "@playwright/test": "^1.61.0",

diff --git a/e2e/react-start/css-modules/package.json b/e2e/react-start/css-modules/package.json
@@ -43,7 +43,7 @@
     "@vitejs/plugin-react": "^6.0.1",
     "nitro": "^3.0.260903-beta",
     "sass": "^1.97.2",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vite": "^8.0.14",

diff --git a/e2e/react-start/custom-basepath/package.json b/e2e/react-start/custom-basepath/package.json
@@ -29,7 +29,7 @@
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^6.0.1",
     "cross-env": "^10.0.0",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "tailwindcss": "^4.2.2",
     "tsx": "^4.20.3",
     "@typescript/native": "npm:typescript@^7.0.2",

diff --git a/e2e/react-start/custom-server-rsbuild/package.json b/e2e/react-start/custom-server-rsbuild/package.json
@@ -30,7 +30,7 @@
     "@types/react": "^19.0.8",
     "@types/react-dom": "^19.0.3",
     "cross-env": "^10.0.0",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "tailwindcss": "^4.2.2",
     "tsx": "^4.20.3",
     "@typescript/native": "npm:typescript@^7.0.2",

diff --git a/e2e/react-start/deferred-hydration/package.json b/e2e/react-start/deferred-hydration/package.json
@@ -33,7 +33,7 @@
     "@types/react": "^19.0.8",
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^6.0.1",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vite": "^8.0.14"

diff --git a/e2e/react-start/dev-ssr-styles/package.json b/e2e/react-start/dev-ssr-styles/package.json
@@ -41,7 +41,7 @@
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^6.0.1",
     "nitro": "^3.0.260903-beta",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vite": "^8.0.14",

diff --git a/e2e/react-start/early-hints/package.json b/e2e/react-start/early-hints/package.json
@@ -27,7 +27,7 @@
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^6.0.1",
     "node-forge": "^1.3.1",
-    "srvx": "0.11.15",
+    "srvx": "1.0.5",
     "tsx": "4.20.3",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",

diff --git a/e2e/react-start/flamegraph-bench/package.json b/e2e/react-start/flamegraph-bench/package.json
@@ -14,7 +14,7 @@
     "@tanstack/react-start": "workspace:*",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
-    "srvx": "^0.11.9"
+    "srvx": "^1.0.5"
   },
   "devDependencies": {
     "@platformatic/flame": "latest",

diff --git a/e2e/react-start/import-protection-custom-config/package.json b/e2e/react-start/import-protection-custom-config/package.json
@@ -25,7 +25,7 @@
     "@types/react": "^19.0.8",
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^6.0.1",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vite": "^8.0.14"

diff --git a/e2e/react-start/import-protection/package.json b/e2e/react-start/import-protection/package.json
@@ -29,7 +29,7 @@
     "@types/react": "^19.0.8",
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^6.0.1",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vite": "^8.0.14"

diff --git a/e2e/react-start/root-document-hydration/package.json b/e2e/react-start/root-document-hydration/package.json
@@ -25,7 +25,7 @@
     "@types/react": "^19.0.8",
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^6.0.1",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vite": "^8.0.14"

diff --git a/e2e/react-start/rsbuild/package.json b/e2e/react-start/rsbuild/package.json
@@ -34,7 +34,7 @@
     "@types/node": "^22.10.2",
     "@types/react": "^19.0.8",
     "@types/react-dom": "^19.0.3",
-    "srvx": "^0.10.0",
+    "srvx": "^1.0.5",
     "typescript": "^5.7.2"
   }
 }
diff --git a/e2e/react-start/rsc-deferred-hydration/package.json b/e2e/react-start/rsc-deferred-hydration/package.json
@@ -45,8 +45,8 @@
     "@types/react": "^19.0.8",
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^6.0.1",
-    "@vitejs/plugin-rsc": "^0.5.30",
-    "srvx": "^0.11.9",
+    "@vitejs/plugin-rsc": "^0.5.36",
+    "srvx": "^1.0.5",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vite": "^8.0.14"

diff --git a/e2e/react-start/rsc-query/package.json b/e2e/react-start/rsc-query/package.json
@@ -28,8 +28,8 @@
     "@types/react": "^19.0.8",
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^6.0.1",
-    "@vitejs/plugin-rsc": "^0.5.30",
-    "srvx": "^0.10.0",
+    "@vitejs/plugin-rsc": "^0.5.36",
+    "srvx": "^1.0.5",
     "typescript": "^5.7.2",
     "vite": "^8.0.14"
   }

diff --git a/e2e/react-start/rsc-rsbuild/package.json b/e2e/react-start/rsc-rsbuild/package.json
@@ -34,7 +34,7 @@
     "@types/node": "^22.10.2",
     "@types/react": "^19.0.8",
     "@types/react-dom": "^19.0.3",
-    "srvx": "^0.10.0",
+    "srvx": "^1.0.5",
     "typescript": "^5.7.2"
   }
 }
diff --git a/e2e/react-start/rsc/package.json b/e2e/react-start/rsc/package.json
@@ -49,9 +49,9 @@
     "@types/react-dom": "^19.0.3",
     "@typescript-eslint/parser": "^8.23.0",
     "@vitejs/plugin-react": "^6.0.1",
-    "@vitejs/plugin-rsc": "^0.5.30",
+    "@vitejs/plugin-rsc": "^0.5.36",
     "eslint": "^9.22.0",
-    "srvx": "^0.10.0",
+    "srvx": "^1.0.5",
     "typescript": "^5.7.2",
     "vite": "^8.0.14"
   }

diff --git a/e2e/react-start/scroll-restoration/package.json b/e2e/react-start/scroll-restoration/package.json
@@ -30,7 +30,7 @@
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^6.0.1",
     "combinate": "^1.1.11",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "tailwindcss": "^4.2.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",

diff --git a/e2e/react-start/selective-ssr/package.json b/e2e/react-start/selective-ssr/package.json
@@ -26,7 +26,7 @@
     "@types/react": "^19.0.8",
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^6.0.1",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "tailwindcss": "^4.2.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",

diff --git a/e2e/react-start/serialization-adapters/package.json b/e2e/react-start/serialization-adapters/package.json
@@ -26,7 +26,7 @@
     "@types/react": "^19.0.8",
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^6.0.1",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "tailwindcss": "^4.2.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",

diff --git a/e2e/react-start/server-functions-global-middleware/package.json b/e2e/react-start/server-functions-global-middleware/package.json
@@ -25,7 +25,7 @@
     "@types/react": "^19.0.8",
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^6.0.1",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "tailwindcss": "^4.2.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",

diff --git a/e2e/react-start/server-functions/package.json b/e2e/react-start/server-functions/package.json
@@ -42,7 +42,7 @@
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^6.0.1",
     "combinate": "^1.1.11",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "tailwindcss": "^4.2.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",

diff --git a/e2e/react-start/server-routes-global-middleware/package.json b/e2e/react-start/server-routes-global-middleware/package.json
@@ -25,7 +25,7 @@
     "@types/react": "^19.0.8",
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^6.0.1",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "tailwindcss": "^4.2.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",

diff --git a/e2e/react-start/server-routes/package.json b/e2e/react-start/server-routes/package.json
@@ -34,7 +34,7 @@
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^6.0.1",
     "combinate": "^1.1.11",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "tailwindcss": "^4.2.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",

diff --git a/e2e/react-start/split-base-and-basepath/package.json b/e2e/react-start/split-base-and-basepath/package.json
@@ -26,7 +26,7 @@
     "@types/react": "^19.0.8",
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^6.0.1",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vite": "^8.0.14"

diff --git a/e2e/react-start/streaming-ssr/package.json b/e2e/react-start/streaming-ssr/package.json
@@ -28,7 +28,7 @@
     "@types/react": "^19.0.8",
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^6.0.1",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vite": "^8.0.14"

diff --git a/e2e/react-start/transform-asset-urls/package.json b/e2e/react-start/transform-asset-urls/package.json
@@ -46,7 +46,7 @@
     "@types/react": "^19.0.8",
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^6.0.1",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vite": "^8.0.14"

diff --git a/e2e/react-start/virtual-routes/package.json b/e2e/react-start/virtual-routes/package.json
@@ -31,7 +31,7 @@
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^6.0.1",
     "combinate": "^1.1.11",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "tailwindcss": "^4.2.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",

diff --git a/e2e/react-start/website/package.json b/e2e/react-start/website/package.json
@@ -29,7 +29,7 @@
     "@types/react": "^19.0.8",
     "@types/react-dom": "^19.0.3",
     "@vitejs/plugin-react": "^6.0.1",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "tailwindcss": "^4.2.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",

diff --git a/e2e/solid-start/basic-auth/package.json b/e2e/solid-start/basic-auth/package.json
@@ -30,7 +30,7 @@
     "@types/node": "^22.10.2",
     "dotenv": "^17.2.3",
     "prisma": "^7.0.0",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "tailwindcss": "^4.2.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",

diff --git a/e2e/solid-start/basic-solid-query/package.json b/e2e/solid-start/basic-solid-query/package.json
@@ -28,7 +28,7 @@
     "@tailwindcss/vite": "^4.2.2",
     "@tanstack/router-e2e-utils": "workspace:^",
     "@types/node": "^22.10.2",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "tailwindcss": "^4.2.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",

diff --git a/e2e/solid-start/basic-tsr-config/package.json b/e2e/solid-start/basic-tsr-config/package.json
@@ -19,7 +19,7 @@
   "devDependencies": {
     "@tanstack/router-e2e-utils": "workspace:^",
     "@types/node": "^22.10.2",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vite": "^8.0.14",

diff --git a/e2e/solid-start/basic/package.json b/e2e/solid-start/basic/package.json
@@ -36,7 +36,7 @@
     "@types/js-cookie": "^3.0.6",
     "@types/node": "^22.10.2",
     "combinate": "^1.1.11",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "tailwindcss": "^4.2.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",

diff --git a/e2e/solid-start/csp/package.json b/e2e/solid-start/csp/package.json
@@ -19,7 +19,7 @@
     "@playwright/test": "^1.61.0",
     "@tanstack/router-e2e-utils": "workspace:^",
     "@types/node": "^22.10.2",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vite": "^8.0.14",

diff --git a/e2e/solid-start/css-modules/package.json b/e2e/solid-start/css-modules/package.json
@@ -23,7 +23,7 @@
     "@tanstack/router-e2e-utils": "workspace:*",
     "@types/node": "^22.10.2",
     "sass": "^1.97.2",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vite": "^8.0.14",

diff --git a/e2e/solid-start/custom-basepath/package.json b/e2e/solid-start/custom-basepath/package.json
@@ -25,7 +25,7 @@
     "@types/express": "^5.0.6",
     "@types/node": "^22.10.2",
     "cross-env": "^10.0.0",
-    "srvx": "^0.11.9",
+    "srvx": "^1.0.5",
     "tailwindcss": "^4.2.2",
     "tsx": "^4.20.3",
     "@typescript/native": "npm:typescript@^7.0.2",