fix(readBody): set default return type to unknown

[rijkvanzanten]

Fixes #386

[pi0]

The return type of readBody is consistent with JSON.parse and destr types which are both any as well and used in readBody. It is ultimately your responsibility to make sure body is both type validated and runtimeValidated. However i agree we need better type safety..

This change is also breaking for types in existing projects. I would be happy to discuss about possible breaking change in next major versions of h3/nitro or alternatively have a more specific util like readValidatedBody with more strict types. Followup: #402

[danielroe]

I don't believe replacing with unknown is a breaking change; I would consider it fixing a bug with type safety.

Users who do not care about type safety in this kind of way can always set strict: false in order for TS to treat the unknown as any.

[rijkvanzanten]

The return type of readBody is consistent with JSON.parse [...]

I'm pretty sure JSON.parse is any because it was typed before unknown even existed. There's also a long running suggestion around replacing those anys with unknowns for the same reason. (for example microsoft/TypeScript#27265)

[...] and destr types [...]

Which is your design decision! 😄 IMO that should be unknown as well

It is ultimately your responsibility to make sure body is both type validated and runtimeValidated. However i agree we need better type safety..

I fully agree, which is why I proposed this change. Right now, by default, h3 effectively disables type safety by setting it to any instead of making it my responsibility with an unknown.

[pi0]

destr v2 is out with default unknown and generic type support. The next major version of h3 is planned soon alongside with object syntax for handlers so rest assured this change will happen soon and thanks for the idea.

[rijkvanzanten]

@pi0 Is there any public issue tracker or milestone to keep up with the development of the next major version? 🙂

[pi0]

We have added todos in the code to change from any to unknown in next future versions. Also any new utils that are being introduced will prefer unknown by default. (on a related note, other than JSON.parse, i noticed even response.json() with web standards used any by default -- nothing that stops us from this change!)

#459 adds safe and validated (type + runtime) alternative utils and #417 a much better way to type events input via the Event handler itself.

Let's keep tracking it by #386 (closing this PR to clear up open PRs) and thanks again for pushing forward this important change in typings.