Skip to content

chore(deps): update nuxt - #91

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/nuxt
Open

chore(deps): update nuxt#91
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/nuxt

Conversation

@renovate

@renovate renovate Bot commented Apr 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@nuxt/content (source) 3.13.0 → 3.16.2 age confidence
@nuxt/devtools (source) 3.2.4 → 3.4.4 age confidence
@nuxt/eslint-config (source) 1.15.2 → 1.17.0 age confidence
@nuxt/image (source) 2.0.0 → 2.2.1 age confidence
@nuxt/kit (source) 4.4.2 → 4.6.4 age confidence
@nuxt/module-builder 1.0.2 → 1.0.3 age confidence
@nuxt/schema (source) 4.4.2 → 4.6.4 age confidence
@nuxt/test-utils 4.0.2 → 4.3.4 age confidence
@nuxt/ui (source) 4.5.1 → 4.12.0 age confidence
@nuxt/ui (source) 4.6.1 → 4.12.0 age confidence
nuxt (source) 4.3.1 → 4.6.4 age confidence
nuxt (source) 4.4.2 → 4.6.4 age confidence

Release Notes

nuxt/content (@​nuxt/content)

v3.16.2

Compare Source

Bug Fixes
Performance Improvements

v3.16.1

Compare Source

Features
  • add content.llms option to disable the nuxt-llms integration (#​3843) (656a5ce)
Bug Fixes

v3.16.0

Compare Source

Bug Fixes
  • avoid install prompt in non-interactive environments (#​3833) (2d0e84b)
  • ContentRenderer: keep async component identity stable across re-resolves (#​3835) (dcf86e6)
  • improve generated git cache key (#​3839) (d1e353e)
  • module: keep content templates when building with _prepare (#​3837) (e390c3b)
  • nuxthub: handle object form of hub.db (#​3822) (8841abc)
  • query: tolerate trailing slashes in path-based lookups (#​3838) (220d392)
  • runtime: use dynamic import for #content/adapter to prevent prerender failure (#​3830) (400390a)
  • use UTC getters in formatDate/formatDateTime to prevent timezone drift (#​3782) (9f1f89a)

v3.15.2

Compare Source

Bug Fixes
  • dev: ignore temporary files in content source paths (#​3784) (a019e70)
  • security: reject SQL function calls in query WHERE clauses (#​3819) (847d523)

v3.15.1

Compare Source

Bug Fixes

v3.15.0

Compare Source

Features
Bug Fixes
  • content: support validator detection with pnpm enableGlobalVirtualStore (#​3791) (6b2720b)
  • hmr: update all matching collections when a file changes (#​3802) (06f8edb)
  • search: softer heading-level boost curve and tuned defaults (#​3801) (00d25a5)
  • vercel: use tmp directory to clone contents (#​3810) (793d59a)

v3.14.0

Compare Source

Features
Bug Fixes
  • docs: update Nuxt version from 3 to 4 in template features (#​3780) (1f24029)
  • path-meta: slugify function did not pass to transformer (#​3794) (778d7db)
  • preview: skip collections without source in preview template (#​3771) (8aabefd)
nuxt/devtools (@​nuxt/devtools)

v3.4.4

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v3.4.3

Compare Source

   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v3.4.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v3.4.1

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v3.4.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v3.3.1

Compare Source

No significant changes

    View changes on GitHub
nuxt/eslint (@​nuxt/eslint-config)

v1.17.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.16.0

Compare Source

   🚀 Features
    View changes on GitHub
nuxt/image (@​nuxt/image)

v2.2.1

Compare Source

v2.2.1 is a security release.

🚨 Security

This release fixes a vulnerability in the /_ipx image transformation route. ipx was affected by an integer overflow when decoding a multi-page image, so a crafted source image could corrupt memory in the server process with a single unauthenticated request (GHSA-qf89-6xm4-66wm; our advisory for the @nuxt/image side is GHSA-p5vf-pjf5-ggj3). Sites where an attacker cannot control any image source are not affected.

@nuxt/image now requires ipx ^4.1.0, which rejects oversized multi-page images with a 400 before decoding them. ipx is an optional dependency, so after upgrading run npm ls ipx to confirm a patched version resolves.

Behaviour change: /_ipx now only accepts common web image formats as input (JPEG, PNG, WebP, GIF, SVG, AVIF, HEIC) and responds 403 to anything else, before decoding it. If you transform other formats (for example TIFF), list them with the new image.ipx.allowedInputFormats option. For sources you do not fully trust, also consider image.ipx.restrictDecoders, which blocks the decoders of every other format for the whole process.

👉 Changelog

compare changes

🩹 Fixes
  • ipx: require patched ipx and restrict input formats for /_ipx route (GHSA-p5vf-pjf5-ggj3) (750a4f0)
  • ipx: use IPXFetchHandler so srvx/node is not required at runtime (#​2336)
  • ipx: import NitroRuntimeConfig from nitropack/types (#​2354)
🎉 New Contributors
❤️ Contributors

v2.2.0

Compare Source

v2.2.0 is the next minor release.

👉 Changelog

compare changes

🚀 Enhancements
🩹 Fixes
  • use explicit imports in nitro v2 server runtime (#​2347)
  • directus: remove deprecated sharpen option (#​2294)
🏡 Chore
  • exempt first-party packages from pnpm minimumReleaseAge (#​2306)
✅ Tests
  • increase e2e provider test timeout to 60s (#​2350)
🤖 CI
  • only run release workflows in nuxt org (#​2296)
  • use pnpm/setup and devEngines (#​2332)
  • only fail fast in merge groups (de96294)
❤️ Contributors

v2.1.0

Compare Source

v2.1.0 is the next minor release.

👀 Highlights

Nuxt Image 2.1 ships eight new image providers, a major upgrade to our image processing engine, and a bunch of fixes across existing providers.

🖼️ IPX v4

Under the hood, we've upgraded to IPX v4 which brings significant improvements:

  • Smaller bundles: IPX is now ESM-only with reduced dependency size
  • Stronger SVG security: SVG sanitization now always runs, regardless of optimization settings. This fixes a potential XSS vector where svgo: false would return untouched SVGs. The sanitizer now removes SMIL attribute injection, foreign content (<foreignObject>, <iframe>, etc.), and unsafe URIs across all elements
  • New image modifiers: opacity, brightness, saturation, hue, lightness, autoorient, dilate, erode, clahe, and linear
  • Better error messages: Invalid modifier arguments now return 400 errors with clear messages instead of cryptic 500s
  • Custom URL parsing: IPX now supports custom URL formats via the parseURL option
🌐 New Providers

This release adds support for eight new image optimization services:

🔧 Provider Improvements
  • Directus: Added support for sharp transforms and a key modifier for named presets (#​2207)
  • Sanity: Support for absolute URLs with automatic project/dataset extraction (#​2274), and a configurable baseURL for custom CDN setups (#​2273)
  • AWS Amplify & Vercel: minimumCacheTTL is now configurable (#​2278)
📦 Type Exports

NuxtImgProps and NuxtPictureProps are now exported from the runtime, making it easier to type your own components that wrap <NuxtImg> or <NuxtPicture> (#​2115).

import type { NuxtImgProps, NuxtPictureProps } from '#image'

👉 Changelog

compare changes

🚀 Enhancements
  • deps: migrate to ipx v4 (#​2094)
  • provider: add EdgeOne Pages provider (#​2173)
  • imgproxy: add provider (#​2117)
  • directus: add sharp transforms & key modifier (#​2207)
  • sanity: support absolute URLs with project and dataset extraction (#​2274)
  • awsAmplify,vercel: make minimumCacheTTL configurable (#​2278)
  • sanity: add configurable baseURL option to Sanity provider (#​2273)
  • runtime: export Picture and Image props types (#​2115)
  • umbraco: add image provider (#​2165)
  • flyimg: add Flyimg built-in provider (#​2125)
  • cloudflareimages: add new provider (#​2100)
  • builderio: add Builder.io Image API provider (#​2050)
  • picsum: add Lorem Picsum placeholder image provider (#​2106)
  • supabase: add image provider (#​2027)
🩹 Fixes
  • flyimg: encode all # characters in color values (137ee63)
  • remove duplicated provider key in generated image options (#​2279)
  • nuxt-picture: align preload link type with unhead v3 (#​2254)
  • github: set max size of 460 (7e561f6)
  • umbraco: shallow clone modifiers before modifying (237e480)
  • cloudflare: add baseURL for urls with no operations (#​2162)
  • nuxt-img: set imagesrcset preload when densities are set w/o sizes (#​2176)
  • fastly: handle absolute URLs and merge preexisting query params (#​2140)
  • ipx: merge user-defined runtimeConfig.ipx with defaults (#​2134)
  • directus: add withoutEnlargement modifier type (#​2133)
  • shopify: merge preexisting query params with modifiers (#​2135)
  • reduce max-width breakpoint values by 1px (#​2132)
  • netlifyImageCdn,netlifyLargeMedia: set netlify remote_images config (#​2086)
  • deduplicate formats (#​2038)
  • sanitise custom provider import names (#​2092)
  • guard access from layer.config.image (23b8cef)
  • bunny: merge query params with existing image src (#​2054)
  • do not shadow custom provider types with builtins (#​2016)
  • nuxt-picture: allow data-* in imgAttrs (#​2017)
  • resolve public/ dir in relation to rootDir (3e07761)
📖 Documentation
  • sanity: document baseURL option (6f59ab1)
  • shopify: update NuxtImg syntax to use v-bind for modifiers (#​2277)
  • update list of auto-detected providers (#​2147)
  • add sharp cross-platform installation section (#​2142)
  • add preload example for NuxtImg (#​2124)
  • exempt patterns from cf _routes.json (#​2136)
  • update placeholder attributes in <NuxtImg /> example (#​2074)
  • add nuxt.care health badge (93de8a9)
  • update docus and add mcp name (#​2080)
  • reference from Vercel's Edge Network to Vercel's CDN for image optimization. (2deacc0)
  • fix Nuxt badge icon (#​2049)
  • update installation warning (#​2061)
  • fix storyblok links (#​2046)
  • add deno example (#​2012)
📦 Build
  • deps: bump serialize-javascript from 7.0.4 to 7.0.5 (#​2249)
  • deps: bump js-cookie from 3.0.5 to 3.0.7 (#​2248)
  • deps: bump ws from 8.17.1 to 8.20.1 (#​2246)
  • deps: bump h3 from 1.15.6 to 1.15.9 (#​2177)
  • deps: bump h3 from 1.15.4 to 1.15.5 (#​2085)
🏡 Chore
  • run module prepare in prepack (97d3758)
  • move consola to dev dependencies (#​2275)
  • migrate to pnpm v11 (#​2236)
  • migrate resolutions to pnpm-workspace.yaml (9b80ce6)
  • migrate npm badges and links to npmx.dev (fd87f7d)
  • remove unused slot-related code from <NuxtPicture> (#​2145)
  • update lint scripts in package.json (#​2139)
  • remove deprecated github silent config (#​2026)
  • revert pnpm trust policy and restore provenance action (13b88c1)
  • update pnpm to 10.21 and enable trust policy (03b5ef4)
🤖 CI
  • add workflow to comment on issues resolved in the latest release (e529f37)
  • improve workflows (#​2288)
  • migrate to uppt (#​2286)
  • migrate agentscan-action to v2 (2f8b332)
  • add agent-scan workflow to flag bot-authored PRs (23ee710)
  • add merge group config (#​2137)
  • rename workflow (777239c)
  • avoid checkout for reproduction comment (a200dae)
  • pin github actions to full-length commit shas (f60d0f7)
  • unpin workflow (d1cb12b)
  • try pinning (09e5efb)
  • update var (402c729)
  • use new shared dependency review workflow (906111c)
🎉 New Contributors
❤️ Contributors
nuxt/nuxt (@​nuxt/kit)

v4.6.4

Compare Source

4.6.4 is a security release. It fixes eight advisories in Nuxt and pulls in nitropack 2.13.6, which fixes three more in Nitro. We recommend upgrading as soon as you can.

⚠️ Behaviour changes

These probably won't affect most apps, but it's worth flagging anyway:

  1. Error details in production. When a page fails to render on the server, the error page and the payload now only carry message and data of errors you create with createError. Everything else is stripped.
  2. Dev server Host checks. Webpack and rspack dev servers now reject requests with an unexpected Host header, as Vite already does. If you use a custom hostname or tunnel, you'll need to add it to the new devServer.allowedHosts option.
  3. workspaceDir detection. When workspaceDir isn't set, Nuxt now only widens it past rootDir to an explicit workspace root or the closest git repository.
  4. Nitropack cached routes. cache, swr and isr route rules now only cache GET and HEAD requests, and no longer store responses that set a cookie or send Cache-Control: private or no-store. Wildcard proxy and redirect rules also reject requests whose resolved target would leave the rule's scope.
  5. Route rules and encoded slashes. Route rules now match paths that contain encoded slashes, so /api%2Fadmin is covered by a /api/** rule.

👉 Changelog

compare changes

🩹 Fixes
  • nitro,nuxt: require unrouting 0.3.2 (768d21368)
  • nitro: preserve wildcard tails in case-insensitive route rules (bf31e4cd8)
  • nitro: require nitropack 2.13.6 (1b13c6981)
  • nitro: keep leading double slash in renderer request path (75c12c6fb)
  • nuxt: use unambiguous encoding for island hash (6f1b93c64)
  • vite-server: resolve wildcard redirect tails from the matched segments (1e7dfa6a7)
  • nuxt: do not expose details of untrusted thrown errors (8c56b71e4)
  • nuxt: strip trailing slashes in linear time (97424dd21)
  • nitro,webpack: include hosts the CLI allows after loading the config (8c11d965d)
  • webpack: skip hot middleware for forbidden dev requests (3c9645326)
  • rspack,webpack: reject unexpected Host headers in dev middleware (f8d64c9aa)
  • schema,nitro,vite: add devServer.allowedHosts (3e1c7964e)
  • nitro,nuxt: match route rules for paths with encoded slashes (084396b10)
  • schema: only widen workspace dir to a declared workspace root (89d3306d1)
  • nitro: only trust x-forwarded-proto in when opted-in (#​36818)
  • nitro: stream the body read through a nuxt/server handler (#​36817)
  • kit: suggest the specific fix when loading falls back to jiti (24d75659d)
  • vite: use a single type checker (#​36774)
  • nitro,vite: remove windows + virtual dev ssr css links after hydration (#​36765)
  • nitro,vite: dedupe dev css by module node (#​36420)
  • nuxt: avoid hoisting setup-only values from definePageMeta (#​36751)
  • nuxt: only match hydration modifiers after lazy prefix (#​36750)
  • kit,nitro,nuxt: make emitted tsconfig/types stable across reruns (#​36747)
  • nuxt: render inlined component styles after stylesheet links (#​36714)
  • webpack: use valid devtool for hidden client sourcemaps in dev (#​36555)
📖 Documentation
  • clarify template dependency regeneration (#​36766)
  • revise README structure and headings (#​36772)
  • link the Nuxt DevTools docs on nuxt.com (#​36769)
  • warn against spreading untrusted objects onto server components (1225ca7ff)
  • update anchors for flat heading ids (#​36664)
🏡 Chore
  • add 1000-row listing routes to the benchmark (c852d871f)
  • add client page weight and browser timing suites (#​36788)
✅ Tests
🤖 CI
  • check unversioned docs links against branch docs version (d093c88b1)
  • skip unneeded checks for release prs (4b90681bd)
  • skip benchmarks in merge groups (6428070e0)
  • re-enable codspeed ⚡ (bc17c03d1)
❤️ Contributors

v4.6.3

Compare Source

v4.6.3 is the next patch release.

👉 Changelog

compare changes

🚨 Security fixes
🔥 Performance
  • vite: skip compiling plain style blocks in the server build (#​36711)
  • nitro,nuxt,rspack,webpack: bundle esm vue + reuse caches (#​36710)
  • vite: avoid quadratic nested dir check for fs.allow (#​36702)
  • nuxt: server render internal custom links without RouterLink (#​36707)
  • nuxt: skip unneeded typed routes generation (#​36645)
🩹 Fixes
  • nitro: don't share prerender hints with self-fetched requests (#​36705)
  • nuxt: defer app scope cleanup on external navigation (#​36713)
  • nuxt: prevent useCookie CookieStore sync from rewriting with refresh (#​36673)
  • nuxt: only return redirects from navigateTo while middleware runs (#​36650)
  • nuxt: remove purged entries from _asyncData (#​36709)
  • vite: skip quoted import.meta keys + limit replace to client dev (#​36703)
  • nuxt: hide RouteLocationRaw from navigateTo's public return type (#​36691)
  • nuxt: tree-shake auto-imported #app composables (#​36696)
  • nuxt: don't treat constrained route rules as covering dynamic pages (#​36701)
  • nuxt: include shared/ in build cache hash (#​36704)
  • nuxt: hash keyed function ids + page import names relative to rootDir (#​36697)
  • nuxt: encode page paths before matching route rule keys (#​36683)
  • nuxt: handle rejected updateCallbackDone of aborted view transition (#​36639)
  • ui-templates: keep loading shader proportions on narrow screens (#​36654)
  • nuxt: reject case-dependent route rule constraints w/ sensitive: false (#​36708)
  • nuxt: don't case-fold regex constraints in route rule keys (#​36694)
  • nuxt: normalise page prefix when finding route rule exceptions (#​36685)
  • vite: mirror ssr invalidations for created and deleted files (634cba64c)
  • nitro: keep noScripts wildcard patterns single-segment (fa323db7d)
  • deps: update unrouting to v0.3.1 (#​36663)
  • nuxt: avoid self-referencing nuxt/schema augmentation (#​36633)
  • nuxt: let nightly runtime resolve its own nuxt/* imports (#​36632)
  • nuxt: don't warn for vite+ vite.config files (#​36628)
  • kit: keep generated declaration first in tsconfig include (#​36627)
  • nuxt: clamp numeric v-for sources in island renders at render time (#​36623)
  • rspack,webpack: register vue-loader plugin only once per config (#​36622)
  • nitro: abort the portable request when the client disconnects (#​36652)
  • deps: update nitropack to 2.13.5 + drop obsolete workarounds (#​36649)
📖 Documentation
  • note provide/inject limit in server components (#​35837)
  • use American spelling in a few guides (#​36706)
  • document controlling prefetch hints via build:manifest hook (#​36695)
  • update StackBlitz link to point to version 4 (#​36674)
  • link to the 2.x docs (#​36640)
  • clarify that island props must be validated before iteration (4b12d15c9)
✅ Tests
  • list NUXT_B4023 as main-only (4fd54ff9a)
  • wait for leave transition before each scroll behaviour test (453406999)
  • vite: assert spa server bundle does not ship the app (#​36699)
  • nuxt: cover route rule coverage under a base url (#​36682)
  • list NUXT_B9006 as main-only (e107e0f40)
🤖 CI
  • only run full checks for the last merge queue entry (132698a46)
  • run a reduced matrix in the merge queue (7d228ba4b)
  • compare merge queue changes against the base branch (bad8c3637)
  • notify resolved issues after publishing a release (9d47884f3)
  • remove broken ai-moderator and ecosystem-ci trigger workflows (1d89ad434)
🎉 New Contributors
❤️ Contributors

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/nuxt branch 5 times, most recently from 9087370 to 7b6ca06 Compare May 1, 2026 18:34
@renovate
renovate Bot force-pushed the renovate/nuxt branch 6 times, most recently from b4549ef to 02dd9b8 Compare May 15, 2026 18:07
@renovate
renovate Bot force-pushed the renovate/nuxt branch 6 times, most recently from e6706e3 to 952350f Compare May 21, 2026 17:05
@renovate
renovate Bot force-pushed the renovate/nuxt branch 5 times, most recently from d347928 to 7856c3d Compare May 30, 2026 10:12
@renovate
renovate Bot force-pushed the renovate/nuxt branch 5 times, most recently from 4027fe4 to b37761a Compare June 8, 2026 05:38
@renovate
renovate Bot force-pushed the renovate/nuxt branch 2 times, most recently from 9c881fe to a295713 Compare June 9, 2026 18:19
@renovate
renovate Bot force-pushed the renovate/nuxt branch 6 times, most recently from f78a99f to b94ab00 Compare July 27, 2026 14:47
@renovate
renovate Bot force-pushed the renovate/nuxt branch 4 times, most recently from f2a2c0c to 30997c3 Compare August 4, 2026 15:16
@renovate
renovate Bot force-pushed the renovate/nuxt branch 3 times, most recently from 95a5193 to e0df7b0 Compare August 12, 2026 01:10
@renovate
renovate Bot force-pushed the renovate/nuxt branch 2 times, most recently from ede63e9 to bb20834 Compare August 21, 2026 19:05
@renovate
renovate Bot force-pushed the renovate/nuxt branch 4 times, most recently from c719dcc to 0c9ec7f Compare August 27, 2026 19:13
@renovate
renovate Bot force-pushed the renovate/nuxt branch 7 times, most recently from 93bc0de to b06009b Compare September 9, 2026 19:52
@coderabbitai

coderabbitai Bot commented Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: f72cad55-2b1f-49b7-a407-8624479dcd52

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@renovate
renovate Bot force-pushed the renovate/nuxt branch 2 times, most recently from bc60bee to e2c9bfb Compare September 15, 2026 12:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants