fix(deps): update dependency @fastly/js-compute to v3.43.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@fastly/js-compute	3.32.2 → 3.43.1

---

Release Notes

fastly/js-compute-runtime (@​fastly/js-compute)

v3.43.1

Compare Source

Fixed

• base64 patch wasn't applying cleanly (#​1494) (9311b97)

v3.43.0

Compare Source

Added

• stale-if-error support (#​1307) (3e06237)

Fixed

• Make boundary parameter of multi-part form data requests safe for use in Content-Type headers (#​1493) (938f15f)
• Remove memory leak of cache write options in error cases (#​1483) (79874b6)

v3.42.1

Compare Source

Fixed

• Null body for non-downstream requests with no stream created for them (#​1479) (511c667)

v3.42.0

Compare Source

Added

• Bail out of reusable sandbox if request fails (#​1453) (b6f41b0)

Fixed

• Allocation failure checks (#​1457) (c882105)
• Avoid dereferencing one-past-the-end iterator in host_api (#​1461) (acf2b25)
• Be more defensive in ip_octets_to_js_string (#​1468) (60bbec1)
• Cache body range check (#​1463) (f38ce55)
• Cache override getters for beforeSend and afterSend (#​1466) (5261936)
• Correct GC guard type in KVStore::put to prevent wasm unreachable crashes and fix some CI issues (#​1475) (15f850d)
• Ensure nul-termination of string for inet_pton (#​1462) (0e3afbe)
• Find invalid characters after nul bytes in KV store keys (#​1464) (5f0f0f2)
• Incorrect catch handler failure check (#​1458) (fb3c01a)
• Memory leak in get_found_response (#​1456) (17559d3)
• Memory leak on failed inspect hostcall (#​1455) (9b77977)
• Protect against GC from validate_bytes (#​1447) (be0867b)
• Shrinking realloc in KVStorePendingLookup (#​1467) (5a72d13)
• Throw error on negative ttl and swr (#​1465) (7d29650)

v3.41.2

Compare Source

Fixed

• HttpBody::read_all for large bodies (#​1444) (99f45b5)
• Check pending exceptions between requests in reusable sandbox mode (#​1425) (64a6b21)
• Memory issues exposed by high GC zeal (#​1442) (f406308)
• Memory leak in normalize_http_method (#​1449) (669b58a)
• mislabeled Response::Slots::URL slot (#​1445) (6d4d268)
• Numeric overflow issue in Core Cache API (#​1448) (360c9bf)
• Potential buffer size issues in shielding (#​1443) (4bf9d72)
• Reset StarlingMonkey engine between requests (#​1426) (238cf70)
• SSL string cipher intersection (#​1446) (13ef2d5)
• Use length rather than NUL-terminator when copying HostStrings (#​1429) (8aa3f4c)

v3.41.1

Compare Source

Fixed

• Deal with bodyless statuses in CandidateResponse situations (#​1414) (cfd6c4b)
• Mark FetchEvent as done when we redirect to ws/grip proxies (9831bd4)
• Support setCacheKey for HTTP cache (#​1411) (a707c3d)

v3.41.0

Compare Source

Added

• Add --gc-frequency option to debug-build.sh (#​1395) (a6e4a1f)
• Allow the use of project-level external config file for js-compute-runtime CLI behavior (#​1405) (9749cab)
• Support installation in projects that use TypeScript 6 (e4273a3)

Fixed

• Allow --aot-cache and --debug-intermediate-files flags to be specified with equals (#​1403) (81a75f8)
• Double free in convertBodyInit (#​1387) (72acfc3)
• GC fixes for edge rate limiter (#​1397) (fd9e322)
• GC issue in handoffs (#​1396) (b57fc8f)
• Shielding GC (#​1401) (6de2f55)

v3.40.1

Compare Source

Fixed

• early-hints: early hints don't need to be sync inside a FetchEve… (#​1323) (22ac0cc)

v3.40.0

Compare Source

Added

• Allow custom weval binary (#​1315) (b143150)
• Reusable sandboxes (#​1314) (70a9d28)

Fixed

• Add security to docs rename script (#​1316) (7028c0b)

v3.39.4

Compare Source

Fixed

• Body truncation error in chained extract_body requests (#​1310) (b929648)

v3.39.3

Compare Source

Fixed

• Don't throw from event.client.geo or event.client.address on hostcall error (#​1306) (471b112)

v3.39.2

Compare Source

Fixed

• NPM publication (f80c089)

v3.39.1

Compare Source

Fixed

• For now, go back to old behavior for default exported types. (#​1298) (e6d96d4)
• TransformStream shortcutting fixes (#​1301) (51369ae)

v3.39.0

Compare Source

Added

• Add isBot support to device detection (#​1287) (fe079b1)
• Implement firstByteTimeout for shielding (#​1286) (ad445b7)
• Map the FastlyStatus values into KVStoreError values the same way the Rust SDK does (#​1280) (726f4e2)

Fixed

• Correct default export (#​1269) (58d872e)
• suppress sourcemap for bundle() step when --enable-stack-traces is not set (#​1277) (ab8c12e)

v3.38.4

Compare Source

Fixed

• Don't shortcut transform too early (#​1281) (291814e)

v3.38.3

Compare Source

Fixed

• clean script to include TypeScript output directory (#​1270) (015e40c)
• pin lol_html to 2.7.0 (#​1276) (363550a)
• Rename shielding docs (#​1272) (e12ab47)
• Try and shortcut transform stream reading before doing a regular read (#​1279) (6b9b939)

v3.38.2

Compare Source

Fixed

• Handle cross-volume renames of intermediate files (#​1264) (94e5671)

v3.38.1

Compare Source

Fixed

• Build CLI in npm publish (#​1262) (2fe6e2d)

v3.38.0

Compare Source

Added

• config: add support for config store buffers longer than 8k (#​1181) (da4c169)
• inspect: add support for NGWAF inspect api (#​1212) (98f45e4)

Fixed

• Correct behaviour of chained body proxy streams in some circumstances (#​1259) (11f9a4b)
• make shielding.d.ts ambient (#​1256) (7a0e987)

v3.37.0

Compare Source

Added

• Add client fingerprint properties (tlsJA4, h2Fingerprint, ohFingerprint) (#​1248) (9390e8c)
• Shielding support (#​1241) (985c55e)

v3.36.0

Compare Source

Added

• Image Optimizer support (#​1224) (c3dd3de)
• Implement 103 Early Hints (#​1217) (fda6ad3)

Fixed

• fanout: commit request headers before fanout handoff (#​1222) (8dfefad)
• Fix broken KVStore test (#​1223) (6055d88)

v3.35.2

Compare Source

Fixed

• compute-file-server: bump MSRV to fix ICU build issues (#​1221) (379e511)
• surrogateKeys not being added when using CoreCache (#​1219) (b0efe20)
• ws: commit ws request headers before upgrading (#​1216) (a15fa61)

v3.35.1

Compare Source

Fixed

• Root HTML rewriter variables to ensure no GC (#​1202) (6aaf9f3)

v3.35.0

Compare Source

Added

• HTML Rewriter (0015ff1)

Fixed

• Remove broken CI tests (5b645f7)
• Update rust toolchain for compute-file-server-cli (09d5a6d)

v3.34.0

Compare Source

Added

• add support for Websocket passthrough (#​1172) (fcf2a54)

v3.33.4

Compare Source

Fixed

• publish workflow (#​1166) (3db857c)

v3.33.2

Compare Source

Fixed

• TypeScript declaration return type of Acl.open() (#​1149) (b9765f6)
• TypeScript type definitions for Blob, File, FormData (#​1150) (4c93d79)
• TypeScript type definitions for Event and EventTarget (#​1151) (eb1ab0d)

v3.33.1

Compare Source

Fixed

• documentation fix (#​1147) (15b9ea5)

v3.33.0

Compare Source

Added

• add support for EventTarget (#​1145) (a735993)
• FormData support and Request.formData and Response.formData (#​1144) (0214ae7)

Fixed

• Backend.prototype.health method definition (#​1143) (42d429b)
• Weval stack overflow bug (#​1135) (f6947d9)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
forma-36	Ready	Preview	Jul 15, 2026 4:14am
forma-36-storybook	Ready	Preview	Jul 15, 2026 4:14am

[changeset-bot]

⚠️ No Changeset found

Latest commit: d17f649

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

size-limit report 📦

Path	Size	Loading time (3g)	Running time (snapdragon)	Total time
CommonJS	132.7 KB (0%)	2.7 s (0%)	193 ms (-22.34% 🔽)	2.9 s
Module	129.62 KB (0%)	2.6 s (0%)	253 ms (-38.17% 🔽)	2.9 s

[wiz-inc-38d59fb8d7]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	-
Software Management Findings	-
Total	-

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.