chore: Update template dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@iconify-json/lucide	^1.2.117 → ^1.2.123
@nuxt/eslint-config (source)	^1.16.0 → ^1.17.0
@​nuxt/icon	^2.3.1 → ^2.5.0
@nuxt/image (source)	^2.0.0 → ^2.1.0
@nuxtjs/i18n (source)	^10.4.1 → ^10.6.0
eslint (source)	^10.7.0 → ^10.8.1
nuxt (source)	^4.4.8 → ^4.5.2
vue-tsc (source)	^3.3.7 → ^3.3.9

---

Release Notes

nuxt/eslint (@​nuxt/eslint-config)

v1.17.0

Compare Source

   🚀 Features

• Update deps  -  by @​antfu (542fc)

   🐞 Bug Fixes

• eslint-config: Disallow comments as extra template root  -  by @​Norbiros in #​695 (c051f)
• eslint-plugin: Handle some bugs with spread operators  -  by @​danielroe in #​706 (fad9c)

    View changes on GitHub

nuxt/image (@​nuxt/image)

v2.1.0

Compare Source

v2.1.0 is the next minor release.

👀 Highlights

Nuxt Image 2.1 ships eight new image providers, a major upgrade to our image processing engine, and a bunch of fixes across existing providers.

🖼️ IPX v4

Under the hood, we've upgraded to IPX v4 which brings significant improvements:

• Smaller bundles: IPX is now ESM-only with reduced dependency size
• Stronger SVG security: SVG sanitization now always runs, regardless of optimization settings. This fixes a potential XSS vector where svgo: false would return untouched SVGs. The sanitizer now removes SMIL attribute injection, foreign content (<foreignObject>, <iframe>, etc.), and unsafe URIs across all elements
• New image modifiers: opacity, brightness, saturation, hue, lightness, autoorient, dilate, erode, clahe, and linear
• Better error messages: Invalid modifier arguments now return 400 errors with clear messages instead of cryptic 500s
• Custom URL parsing: IPX now supports custom URL formats via the parseURL option

🌐 New Providers

This release adds support for eight new image optimization services:

• Builder.io - Builder.io's Image API (#​2050)
• Cloudflare Images - Cloudflare's dedicated image service (#​2100)
• EdgeOne Pages - Tencent EdgeOne Pages (#​2173)
• Flyimg - Self-hosted image resizing (#​2125)
• imgproxy - Fast, secure image processing server (#​2117)
• Lorem Picsum - Placeholder images for development (#​2106)
• Supabase - Supabase Storage image transformations (#​2027)
• Umbraco - Umbraco CMS image cropper (#​2165)

🔧 Provider Improvements

• Directus: Added support for sharp transforms and a key modifier for named presets (#​2207)
• Sanity: Support for absolute URLs with automatic project/dataset extraction (#​2274), and a configurable baseURL for custom CDN setups (#​2273)
• AWS Amplify & Vercel: minimumCacheTTL is now configurable (#​2278)

📦 Type Exports

NuxtImgProps and NuxtPictureProps are now exported from the runtime, making it easier to type your own components that wrap <NuxtImg> or <NuxtPicture> (#​2115).

import type { NuxtImgProps, NuxtPictureProps } from '#image'

👉 Changelog

compare changes

🚀 Enhancements

• deps: migrate to ipx v4 (#​2094)
• provider: add EdgeOne Pages provider (#​2173)
• imgproxy: add provider (#​2117)
• directus: add sharp transforms & key modifier (#​2207)
• sanity: support absolute URLs with project and dataset extraction (#​2274)
• awsAmplify,vercel: make minimumCacheTTL configurable (#​2278)
• sanity: add configurable baseURL option to Sanity provider (#​2273)
• runtime: export Picture and Image props types (#​2115)
• umbraco: add image provider (#​2165)
• flyimg: add Flyimg built-in provider (#​2125)
• cloudflareimages: add new provider (#​2100)
• builderio: add Builder.io Image API provider (#​2050)
• picsum: add Lorem Picsum placeholder image provider (#​2106)
• supabase: add image provider (#​2027)

🩹 Fixes

• flyimg: encode all # characters in color values (137ee63)
• remove duplicated provider key in generated image options (#​2279)
• nuxt-picture: align preload link type with unhead v3 (#​2254)
• github: set max size of 460 (7e561f6)
• umbraco: shallow clone modifiers before modifying (237e480)
• cloudflare: add baseURL for urls with no operations (#​2162)
• nuxt-img: set imagesrcset preload when densities are set w/o sizes (#​2176)
• fastly: handle absolute URLs and merge preexisting query params (#​2140)
• ipx: merge user-defined runtimeConfig.ipx with defaults (#​2134)
• directus: add withoutEnlargement modifier type (#​2133)
• shopify: merge preexisting query params with modifiers (#​2135)
• reduce max-width breakpoint values by 1px (#​2132)
• netlifyImageCdn,netlifyLargeMedia: set netlify remote_images config (#​2086)
• deduplicate formats (#​2038)
• sanitise custom provider import names (#​2092)
• guard access from layer.config.image (23b8cef)
• bunny: merge query params with existing image src (#​2054)
• do not shadow custom provider types with builtins (#​2016)
• nuxt-picture: allow data-* in imgAttrs (#​2017)
• resolve public/ dir in relation to rootDir (3e07761)

📖 Documentation

• sanity: document baseURL option (6f59ab1)
• shopify: update NuxtImg syntax to use v-bind for modifiers (#​2277)
• update list of auto-detected providers (#​2147)
• add sharp cross-platform installation section (#​2142)
• add preload example for NuxtImg (#​2124)
• exempt patterns from cf _routes.json (#​2136)
• update placeholder attributes in <NuxtImg /> example (#​2074)
• add nuxt.care health badge (93de8a9)
• update docus and add mcp name (#​2080)
• reference from Vercel's Edge Network to Vercel's CDN for image optimization. (2deacc0)
• fix Nuxt badge icon (#​2049)
• update installation warning (#​2061)
• fix storyblok links (#​2046)
• add deno example (#​2012)

📦 Build

• deps: bump serialize-javascript from 7.0.4 to 7.0.5 (#​2249)
• deps: bump js-cookie from 3.0.5 to 3.0.7 (#​2248)
• deps: bump ws from 8.17.1 to 8.20.1 (#​2246)
• deps: bump h3 from 1.15.6 to 1.15.9 (#​2177)
• deps: bump h3 from 1.15.4 to 1.15.5 (#​2085)

🏡 Chore

• run module prepare in prepack (97d3758)
• move consola to dev dependencies (#​2275)
• migrate to pnpm v11 (#​2236)
• migrate resolutions to pnpm-workspace.yaml (9b80ce6)
• migrate npm badges and links to npmx.dev (fd87f7d)
• remove unused slot-related code from <NuxtPicture> (#​2145)
• update lint scripts in package.json (#​2139)
• remove deprecated github silent config (#​2026)
• revert pnpm trust policy and restore provenance action (13b88c1)
• update pnpm to 10.21 and enable trust policy (03b5ef4)

🤖 CI

• add workflow to comment on issues resolved in the latest release (e529f37)
• improve workflows (#​2288)
• migrate to uppt (#​2286)
• migrate agentscan-action to v2 (2f8b332)
• add agent-scan workflow to flag bot-authored PRs (23ee710)
• add merge group config (#​2137)
• rename workflow (777239c)
• avoid checkout for reproduction comment (a200dae)
• pin github actions to full-length commit shas (f60d0f7)
• unpin workflow (d1cb12b)
• try pinning (09e5efb)
• update var (402c729)
• use new shared dependency review workflow (906111c)

🎉 New Contributors

• venzil (@​q153877011)
• Vlad Z. (@​Nks)
• kheiner (@​kheiner)
• Berk Altıok (@​berkaltiok)
• 山吹色御守 (@​KazariEX)
• dependabot[bot] (@​dependabot[bot])
• Jens Morten Mikkelsen (@​jemomi)
• Bernhard Berger (@​bernhardberger)
• FKarstein (@​FKarstein)
• Sergiu Daniel Vidican (@​vsergiu93)
• Mohamed Fadl (@​FADL285)
• Martin Arce (@​divagueame)
• Iniubong Obonguko (@​codiini)
• Alireza Jahandideh (@​Youhan)
• Leon Hornig (@​Leon338)
• Dino Kupinic (@​Dino-Kupinic)
• wotan-allfather (@​wotan-allfather)
• Hugo (@​HugoRCD)
• IO-Fire (@​IO-Fire)
• Ingo Fabbri (@​infabo)
• Andrey Shevtsov (@​andreyshivas)
• Tony Costanzo (@​Patrity)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Luke Nelson (@​luc122c)
• venzil (@​q153877011)
• Vlad Z. (@​Nks)
• kheiner (@​kheiner)
• Berk Altıok (@​berkaltiok)
• Nestor Vera (@​hacknug)
• Damian Głowala (@​DamianGlowala)
• 山吹色御守 (@​KazariEX)
• dependabot[bot] (@​dependabot[bot])
• Julien Huang (@​huang-julien)
• Jens Morten Mikkelsen (@​jemomi)
• Bernhard Berger (@​bernhardberger)
• FKarstein (@​FKarstein)
• Sergiu Daniel Vidican (@​vsergiu93)
• Mohamed Fadl (@​FADL285)
• Martin Arce (@​divagueame)
• Iniubong Obonguko (@​codiini)
• Alireza Jahandideh (@​Youhan)
• Leon Hornig (@​Leon338)
• Dino Kupinic (@​Dino-Kupinic)
• wotan-allfather (@​wotan-allfather)
• Hugo (@​HugoRCD)
• Sébastien Chopin (@​atinux)
• IO-Fire (@​IO-Fire)
• Ingo Fabbri (@​infabo)
• Maxime Pauvert (@​maximepvrt)
• Andrey Shevtsov (@​andreyshivas)
• Domenik Reitzner (@​dreitzner)
• Tony Costanzo (@​Patrity)
• abeer0 (@​iiio2)

nuxt-modules/i18n (@​nuxtjs/i18n)

v10.6.0

Compare Source

This changelog is generated by GitHub Releases

   🚀 Features

• Add experimental.optimizeMessageBundling option  -  by @​BobbieGoede in #​4068 (e7b6b)
• domain: Restrict locales to a subset of domains  -  by @​BobbieGoede in #​4085 (436c3)

   🐞 Bug Fixes

• Strip protocol when matching domain to host  -  by @​adamkasper, @​cursoragent and @​BobbieGoede in #​4064 (86a4d)
• Let vue-router encode switchLocalePath paths  -  by @​Vincentdevreede and @​BobbieGoede in #​4079 (03a8e)
• Load locale files that use Nuxt app composables in the app  -  by @​BobbieGoede in #​4102 (917c0)
• Keep params encoded when resolving a localized route by path  -  by @​BobbieGoede in #​4104 (a4eee)
• bundler:
  • Only precompile locale files the resource transform can re-emit  -  by @​BobbieGoede in #​4095 (930ff)
• domain:
  • Resolve locale availability from host membership  -  by @​BobbieGoede in #​4083 (ef5d3)
  • Resolve links for the host default locale under prefix_and_default  -  by @​BobbieGoede in #​4087 (de62b)
  • Resolve domain config the same way at build time and runtime  -  by @​BobbieGoede in #​4090 (b38b7)
  • Resolve the current origin from the host  -  by @​BobbieGoede in #​4103 (01d43)
  • Redirect detection to the domain serving the detected locale  -  by @​BobbieGoede in #​4105 (03eba)
  • Resolve a domain serving a single locale as its default  -  by @​BobbieGoede in #​4107 (efb9d)
  • Serve every locale on a host matching no configured domain  -  by @​BobbieGoede in #​4108 (187b3)
• hmr:
  • Use virtual module ids in import.meta.hot.accept() for vite 8  -  by @​sawa-ko and @​BobbieGoede in #​4065 (329db)
• routing:
  • Resolve the unprefixed locale per domain  -  by @​BobbieGoede in #​4082 (7a2db)
• seo:
  • Emit the same x-default on every domain  -  by @​BobbieGoede in #​4089 (45d95)
  • Warn when a domain setup has no locale to annotate as x-default  -  by @​BobbieGoede in #​4092 (e0706)
  • Resolve alternate and canonical links from one domain per locale  -  by @​BobbieGoede in #​4106 (21e1c)
• types:
  • Narrow locale head types to support useHeadSafe  -  by @​BobbieGoede in #​4062 (59e5d)
  • Annotate the logger so its declaration stays portable  -  by @​BobbieGoede in #​4094 (93754)
  • Prevent duplicate tsconfig paths for aliased deps  -  by @​BuuBux and Kamil Kras in #​4031 (d6930)

   🏎 Performance

• Skip client locale chunks when using messages endpoint  -  by @​BobbieGoede in #​4067 (7d762)
• Keep locale messages out of server build graphs  -  by @​BobbieGoede in #​4070 (640e1)
• Avoid copying locale messages per ssr request  -  by @​BobbieGoede in #​4071 (46ab4)
• Enable experimental.optimizeMessageBundling by default  -  by @​BobbieGoede in #​4073 (ba6f3)
• Keep message caching enabled for static locales in mixed projects  -  by @​BobbieGoede in #​4074 (d9d30)

    View changes on GitHub

v10.5.0

Compare Source

This changelog is generated by GitHub Releases

   🚀 Features

• Resolve route options from meta in all customRoutes modes  -  by @​BobbieGoede in #​4022 (39a8b)

   🐞 Bug Fixes

• UseRuntimeConfig type signature compatibility  -  by @​BobbieGoede (89b72)
• Derive route resources from route localization  -  by @​BobbieGoede in #​4047 (1d378)
• Skip localizing routeRules redirect stub pages  -  by @​BobbieGoede in #​4048 (af344)
• Locale head type compat  -  by @​BobbieGoede in #​4055 (ddeaa)
• Skip optimizing dynamic locale files  -  by @​BobbieGoede in #​4058 (c1187)
• Validate locale codes to ensure path segment safety  -  by @​BobbieGoede in #​4059 (45498)
• seo: Resolve canonical and og:url from the current locale domain  -  by @​BobbieGoede in #​4043 (2452a)

    View changes on GitHub

eslint/eslint (eslint)

v10.8.1

Compare Source

Bug Fixes

• 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#​21173) (dongkyu lee)
• 151ba3f fix: false positives in getter-return and accessor-pairs (#​21163) (Grit)
• 6898df9 fix: ignore meta-property names in id-denylist (#​21166) (Pixel)
• 4d7db66 fix: ignore meta-property names in id-match (#​21167) (Pixel)
• 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#​20935) (kuldeep kumar)

Documentation

• 7d0cbf8 docs: Update README (GitHub Actions Bot)
• 0a05812 docs: add missing backticks to no-duplicate-imports.js (#​21183) (Lee Daeun)
• 678c90b docs: Update README (GitHub Actions Bot)
• 8a10424 docs: Update README (GitHub Actions Bot)
• 69bb948 docs: Update README (GitHub Actions Bot)

Chores

• 0a14800 chore: update github/codeql-action action to v4.37.4 (#​21196) (renovate[bot])
• 05adcb1 test: fix failing ecosystem test for eslint-plugin-unicorn (#​21191) (Lazizbek Ergashev)
• 5611035 test: add error locations info to no-void (#​21185) (Lee Daeun)
• ee47333 ci: bump github/codeql-action from 4 to 4.37.3 (#​21176) (dependabot[bot])
• f131c03 chore: improve ecosystem test failure reporting (#​20937) (crimsonjay0)
• 1f6edde chore: update ecosystem plugins (#​21182) (ESLint Bot)
• d3266fb chore: unpin webpack dependency (#​21172) (Francesco Trotta)
• 65a6519 chore: add allowScripts field to package.json (#​21092) (GiHoon Noh)
• 22e5256 ci: add triage:no label to Dependabot PRs (#​21141) (lumir)
• 55c9038 ci: bump actions/labeler from 6 to 7 (#​21159) (dependabot[bot])
• 7280e78 chore: update dependency prettier to v3.9.6 (#​21162) (renovate[bot])
• eddbad6 test: fix failing ecosystem test for eslint-plugin-unicorn (#​21156) (Francesco Trotta)
• 60a178d chore: update ecosystem plugins (#​21150) (ESLint Bot)
• f9f61dc test: add error locations to no-unreachable (#​21151) (JIYEON)
• d086293 test: add error locations to no-undef (#​21147) (JIYEON)
• cc01b67 test: add error locations to no-useless-catch (#​21144) (devoil)
• 688e75e chore: add missing backticks in JSDoc (#​21143) (Bo Hyun Kim)
• 7c1e175 test: add error locations to require-await (#​21145) (Grit)
• 588a26d test: add error locations to no-extra-label (#​21139) (dongkyu lee)
• 059aa89 test: add error locations to no-useless-concat (#​21140) (dongkyu lee)
• 5a452a8 test: add error locations to no-const-assign (#​21138) (dongkyu lee)

v10.8.0

Compare Source

Features

• 2fee9bb feat: export ConfigObject from eslint/config (#​21082) (sethamus)

Bug Fixes

• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#​21129) (Francesco Trotta)
• 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#​21116) (Pixel)
• e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#​21081) (synthex-byte)
• 20b5ad0 fix: quadratic-time regex in prefer-template (#​21096) (Milos Djermanovic)
• 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#​21094) (Pixel)
• b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#​21083) (Francesco Trotta)

Documentation

• 6ddf858 docs: fix broken Specify Parser Options anchor link (#​21106) (Minsu)
• 784dfbe docs: Clarify no-eq-null description (#​21120) (Park Harin)
• 7ec733a docs: Fix typos and grammar in glossary (#​21095) (Marry (Subin Yang))
• 92bb13f docs: replace quake link (#​21108) (Jung Hyeon Jun)
• 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#​21103) (Minsu)
• d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#​21099) (Jung Hyeon Jun)
• eccc68d docs: correct --suppressions-location option description (#​21093) (Ga eun Lee)
• c5963f7 docs: Update README (GitHub Actions Bot)

Chores

• 4fbf46d test: pin webpack version to 5.108.4 (#​21137) (Francesco Trotta)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#​21101) (Bo Hyun Kim)
• eccbe7b test: add error locations to no-class-assign (#​21123) (devoil)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#​21118) (dependabot[bot])
• e9d66d0 ci: bump actions/setup-node from 6 to 7 (#​21119) (dependabot[bot])
• ee225b6 test: Add error location details to no-eq-null rule (#​21117) (Park Harin)
• 044a627 chore: update minimatch to ^10.2.5 (#​21107) (김채영)
• fb09aa8 chore: update ecosystem plugins (#​21115) (ESLint Bot)
• 5abd878 test: add error locations to no-proto (#​21114) (Gihyeon Jeong / 정기현)
• 9715887 test: Add error location details to no-div-regex (#​21110) (Park Harin)
• a746ec6 test: add error locations to no-new-wrappers (#​21109) (Gihyeon Jeong / 정기현)
• 8dde645 test: add error locations to no-ex-assign (#​21102) (devoil)
• 13ab0ec test: add error locations to no-label-var (#​21098) (Gihyeon Jeong / 정기현)
• a99906f test: Add error location details to no-delete-var rule (#​21105) (Park Harin)
• c47e8dc chore: add missing backticks to languages/js/index.js (#​21104) (beeen)
• 0174428 chore: add missing backticks to translate-cli-options.js (#​21097) (dongkyu lee)
• 3d36589 chore: add missing backticks to serialization.js (#​21091) (이규환)
• dcc9312 test: add error locations to eqeqeq (#​21090) (Ga eun Lee)
• 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#​21089) (Marry (Subin Yang))
• 5d2f866 chore: update dependency prettier to v3.9.5 (#​21086) (renovate[bot])
• d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#​21084) (Francesco Trotta)
• bf3eda0 chore: update ecosystem plugins (#​21079) (ESLint Bot)

nuxt/nuxt (nuxt)

v4.5.2

Compare Source

4.5.2 is the next patch release.

👉 Changelog

compare changes

🔥 Performance

• nuxt,kit: Skip rewriting unchanged generated files (#​35902)
• kit,nuxt: Use lazy imports to improve parsing speed (#​35901)
• vite: Skip html entry probes in bare-import resolver (#​35907)
• nuxt: Reuse app and component scans for unchanged structures (#​35912)

🩹 Fixes

• vite: Resolve client manifest path from resolved config (#​35883)
• nuxt: Use client-side navigation for links inside islands (#​35806)
• nuxt: Generate types for route params defined with definePageMeta (#​35857)
• nuxt: Serialize island payloads for components with underscores in keys (#​35807)
• nitro: Dedupe island renders when prerendering (#​35835)
• nuxt: Drop prefetch hints for never-hydrated chunks (#​35812)
• vite: Use same asset filenames for worker builds (#​35866)
• nitro: Reject non-object island props (#​35867)
• nuxt: Support options api in v-for islands transform (#​35877)
• nuxt: Improve page meta extraction + performance (#​35869)
• nuxt: Set build outputs when restoring vue cache (#​35895)
• kit: Honour nested apply and applyToEnvironment in vite wrapper (#​35899)
• nuxt: Re-check for preview mode after prerendered page hydration (#​35886)
• kit,nuxt,vite: Handle missed chokidar watch events (#​35887)
• nuxt: Settle asyncData status when bailing (#​35908)
• kit: Clone resolved config with klona rather than klona/full (#​35914)
• kit: Honour nested plugins' enforce in vite wrapper (#​35916)
• nuxt: Collect build cache once build outputs are final (#​35929)
• vite: Resolve vite env api sourcemaps in vite-node (#​35758)
• nuxt: Don't warn about missing <NuxtPage> on nav + with slot (#​35948)
• kit: Prepend vite environment wrapper plugin when prepend is set (#​35942)
• nuxt: Depend on rolldown as a peer to reuse vite's copy (3fda97f60)
• nitro: Define import.meta.test for server code (#​35987)
• nuxt: Match route rules against decoded paths (9123ed850)

💅 Refactors

• nuxt: Use vue-component-type-helpers instead of locally maintained helpers (#​35840)
• nuxt: Use isReferenceIdentifier in page-meta plugin (#​35882)

📖 Documentation

• Sync mcp server page with live tools and providers (#​35856)
• Add server components guide and mostly-static site recipe (#​35778)
• Minor changes (#​33479)
• Add accessible routing guide (#​34796)
• Update testing guide to test-utils v4.1.0 (#​35873)
• Update .env provider reference from dotenv to c12 (#​35911)
• Add note to avoid using defineVitestProject in e2e tests (#​35926)
• Update roadmap (f6e6027fe)

📦 Build

• ui-templates: Copy generated templates from resolved output dir (#​35921)

🏡 Chore

• nuxt: Bump @nuxt/devtools to v3.4.0 (#​35892)
• Fix lint (1951a2489)
• Throw error with cause in script (a90608d5c)
• Lint notification script 🤦 (429a96b24)
• Ignore safe pull_request_target (035a3a3d4)
• Reorder ignore (3baf6fedd)
• Bump nuxt rolldown peer dep to match unctx (2c38086f5)

✅ Tests

• Skip webpack dev tests for island v-for transform (73030e55a)
• Add regression test for #​35893 ([#​35893](https

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.