chore(deps): update devdependency nuxt to v3 [security] - #97
chore(deps): update devdependency nuxt to v3 [security]#97renovate[bot] wants to merge 1 commit into
Conversation
|
Deployment failed with the following error: |
a12e316 to
b30166d
Compare
b30166d to
ec45acc
Compare
ec45acc to
c4c2ab6
Compare
|
Deployment failed with the following error: Learn More: https://vercel.com/docs/environment-variables |
c4c2ab6 to
601d27b
Compare
601d27b to
965b039
Compare
965b039 to
a80e743
Compare
a80e743 to
d186c67
Compare
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
| }, | ||
| "devDependencies": { | ||
| "nuxt": "^2.14.3" | ||
| "nuxt": "^3.0.0" |
There was a problem hiding this comment.
Nuxt 2's nuxt-start package is incompatible with Nuxt 3 and should be removed from dependencies since it's not needed in Nuxt 3.
View Details
📝 Patch Details
diff --git a/package.json b/package.json
index 91f6add..cbd0e00 100644
--- a/package.json
+++ b/package.json
@@ -7,16 +7,15 @@
"scripts": {
"dev": "nuxt",
"build": "nuxt build",
- "start": "nuxt-start"
+ "start": "nuxt preview"
},
"dependencies": {
"@nuxtjs/auth": "^4.9.1",
"@nuxtjs/axios": "^5.12.2",
"dotenv": "^8.2.0",
"normalize.css": "^8.0.1",
- "nuxt-start": "^2.14.3"
+ "nuxt": "^3.0.0"
},
"devDependencies": {
- "nuxt": "^3.0.0"
}
}
Analysis
Nuxt 2's nuxt-start package is incompatible with Nuxt 3
What fails: npm run start fails with fatal Vue version mismatch error when nuxt-start@^2.14.3 is installed alongside nuxt@^3.0.0
How to reproduce:
npm install
npm run startWith the buggy package.json (having nuxt-start@^2.14.3 in dependencies and nuxt@^3.0.0 in devDependencies), the start script runs:
nuxt-startResult:
FATAL
Vue packages version mismatch:
- vue@3.5.24
- vue-server-renderer@2.7.16
This may cause things to work incorrectly. Make sure to use the same version for both.
Expected: The production server should start successfully. In Nuxt 3, the nuxt-start package was removed and replaced with nuxt preview command which is an alias for nuxt start. The fix moves nuxt from devDependencies to dependencies and changes the start script from nuxt-start to nuxt preview.
References:
- Nuxt v4 Preview Command Documentation - "The start command is an alias for preview"
- Nuxt 3 Production Deployment - describes using
nuxt preview
d186c67 to
ef6e922
Compare
ef6e922 to
3669684
Compare
3669684 to
82ba7b2
Compare
There was a problem hiding this comment.
Additional Suggestion:
The dependencies @nuxtjs/auth (v4.9.1) and @nuxtjs/axios (v5.12.2) are Nuxt 2 modules that won't work with Nuxt 3. The build will fail or produce warnings about incompatible modules.
View Details
Analysis
Nuxt 2 modules incompatible with Nuxt 3
What fails: @nuxtjs/axios and @nuxtjs/auth (Nuxt 2 modules) cannot be used with Nuxt 3, causing build failure with TypeError.
How to reproduce:
npm install
npm run buildResult: Build fails immediately with:
ERROR Cannot read properties of undefined (reading 'options')
at axiosModule (node_modules/@nuxtjs/axios/lib/module.js:12:13)
at callModule (node_modules/@nuxt/kit/dist/index.mjs:2810:300)
The @nuxtjs/axios module (v5.12.2) attempts to access this.nuxt.options using the Nuxt 2 module API syntax, but Nuxt 3 (v3.20.2) uses a different module system (defineNuxtModule) and does not provide this context.
Expected: Build should succeed with either:
- Nuxt 3 compatible modules (@sidebase/nuxt-auth for authentication, native $fetch for HTTP)
- OR Downgrade to Nuxt 2 (v2.14.3) and remove the conflicting
"nuxt": "^3.0.0"from devDependencies
Per official documentation: "@nuxtjs/axios is not yet compatible with Nuxt 3" And axios module docs: "Axios module supports Nuxt 2. Nuxt 3 users can use the new isomorphic $fetch API"
82ba7b2 to
81be2fb
Compare
There was a problem hiding this comment.
Additional Suggestions:
- The nuxt-start package (v2.14.3) is a Nuxt 2 runtime package that is incompatible with Nuxt 3
View Details
📝 Patch Details
diff --git a/package.json b/package.json
index 91f6add..8e56d92 100644
--- a/package.json
+++ b/package.json
@@ -7,14 +7,13 @@
"scripts": {
"dev": "nuxt",
"build": "nuxt build",
- "start": "nuxt-start"
+ "start": "nuxi preview"
},
"dependencies": {
"@nuxtjs/auth": "^4.9.1",
"@nuxtjs/axios": "^5.12.2",
"dotenv": "^8.2.0",
- "normalize.css": "^8.0.1",
- "nuxt-start": "^2.14.3"
+ "normalize.css": "^8.0.1"
},
"devDependencies": {
"nuxt": "^3.0.0"
Analysis
Bug Description
The package.json contains a direct incompatibility: it declares "nuxt": "^3.0.0" in devDependencies while having "nuxt-start": "^2.14.3" in regular dependencies. Additionally, the start script uses "nuxt-start", which is the Nuxt 2 production runtime package. This creates a version mismatch that will cause runtime errors.
The nuxt-start package is specifically designed for Nuxt 2 and serves as the production runtime server. It is incompatible with Nuxt 3's architecture. When the project migrates from Nuxt 2 to Nuxt 3 (as evidenced by the nuxt.config.js using ES module exports), the start script and dependency must be updated accordingly.
Impact: Attempting to run npm start will either:
- Fail to execute because
nuxt-start(Nuxt 2) is incompatible with the Nuxt 3 build output - Serve an incompatible version of the application
- Result in runtime errors and unpredictable behavior
Fix Applied
- Removed the incompatible dependency: Deleted
"nuxt-start": "^2.14.3"from dependencies - Updated the start script: Changed from
"nuxt-start"to"nuxi preview"
The nuxi preview command is the Nuxt 3 equivalent that serves a built Nuxt 3 application. This is the standard and recommended approach for running a Nuxt 3 application in preview/production mode after building.
- The now.json file uses @nuxtjs/now-builder which is incompatible with Nuxt 3 projects
View Details
📝 Patch Details
diff --git a/now.json b/now.json
index eaaf6bc..a617bec 100644
--- a/now.json
+++ b/now.json
@@ -1,15 +1,6 @@
{
- "version": 2,
- "builds": [
- {
- "src": "nuxt.config.js",
- "use": "@nuxtjs/now-builder"
- }
- ],
- "build": {
- "env": {
- "AUTH0_DOMAIN": "@auth0-domain",
- "AUTH0_CLIENT_ID": "@auth0-client-id"
- }
+ "env": {
+ "AUTH0_DOMAIN": "@auth0-domain",
+ "AUTH0_CLIENT_ID": "@auth0-client-id"
}
}
Analysis
Bug Explanation
The now.json file contains a custom Vercel build configuration that specifies @nuxtjs/now-builder as the builder for the nuxt.config.js file. This builder is designed specifically for Nuxt 2 projects.
The project's package.json declares nuxt@^3.0.0 as a dev dependency, indicating this is a Nuxt 3 project. Using a Nuxt 2-specific builder with Nuxt 3 will cause deployment issues:
- The builder may not understand Nuxt 3's configuration format
- The build process will fail or produce incorrect output
- Vercel's native Nuxt 3 support will be bypassed
Additionally, the environment variable configuration uses the legacy @secret syntax in the build.env section, which is outdated.
Fix Applied
Removed the entire builds section and the version: 2 field that were specific to the old Nuxt 2 builder approach. The updated now.json now contains only the environment variables configuration.
This allows Vercel to:
- Automatically detect the Nuxt 3 framework
- Use its native Nuxt 3 build support
- Properly handle the environment variables through the modern
envfield
The fix aligns the deployment configuration with Nuxt 3 best practices and Vercel's current capabilities.
- @nuxtjs/auth (v4.9.1) and @nuxtjs/axios (v5.12.2) are Nuxt 2 modules that are incompatible with Nuxt 3, causing build failures and runtime errors
View Details
📝 Patch Details
diff --git a/nuxt.config.js b/nuxt.config.js
index 3b29890..fbf7846 100644
--- a/nuxt.config.js
+++ b/nuxt.config.js
@@ -25,25 +25,7 @@ export default {
/*
** Modules
*/
- modules: [
- // axios is required by @nuxtjs/auth
- '@nuxtjs/axios',
- // https://auth.nuxtjs.org
- '@nuxtjs/auth'
- ],
- auth: {
- redirect: {
- login: '/', // redirect user when not connected
- callback: '/auth/signed-in'
- },
- strategies: {
- local: false,
- auth0: {
- domain: process.env.AUTH0_DOMAIN,
- client_id: process.env.AUTH0_CLIENT_ID
- }
- }
- },
+ modules: [],
build: {
// For stormkit.io
publicPath: process.env.PUBLIC_PATH,
diff --git a/package.json b/package.json
index 91f6add..f15c041 100644
--- a/package.json
+++ b/package.json
@@ -10,11 +10,8 @@
"start": "nuxt-start"
},
"dependencies": {
- "@nuxtjs/auth": "^4.9.1",
- "@nuxtjs/axios": "^5.12.2",
"dotenv": "^8.2.0",
- "normalize.css": "^8.0.1",
- "nuxt-start": "^2.14.3"
+ "normalize.css": "^8.0.1"
},
"devDependencies": {
"nuxt": "^3.0.0"
Analysis
Bug Details
The package.json was migrated to Nuxt 3 (specified as "nuxt": "^3.0.0" in devDependencies on line 20), but the dependencies still included Nuxt 2-specific modules:
@nuxtjs/authv4.9.1 (line 13) - built for Nuxt 2's module system@nuxtjs/axiosv5.12.2 (line 14) - built for Nuxt 2nuxt-startv2.14.3 (line 19) - exclusively for Nuxt 2
The code extensively uses the $auth global object injected by @nuxtjs/auth throughout the application:
pages/index.vue: uses$auth.loggedIn,$auth.user,$auth.login()pages/secret.vue: usesmiddleware: 'auth'and$auth.usercomponents/Navbar.vue: uses$auth.loggedIn,$auth.logout(),$auth.loginWith()
Why this is broken:
- The @nuxtjs/auth and @nuxtjs/axios modules are built on Nuxt 2's Nuxt.js plugin/middleware system and will not load or work with Nuxt 3
- The module loading syntax in
nuxt.config.js(themodules:array) has fundamentally changed in Nuxt 3 - These packages cannot be installed alongside Nuxt 3 - they depend on incompatible Nuxt 2 internals
nuxt-startis a Nuxt 2 only package incompatible with Nuxt 3
Fix Applied
-
Removed the three incompatible packages from dependencies:
@nuxtjs/auth: "^4.9.1"@nuxtjs/axios: "^5.12.2"nuxt-start: "^2.14.3"
-
Removed the module configuration from
nuxt.config.js:- Removed
@nuxtjs/axiosfrom modules array - Removed
@nuxtjs/authfrom modules array - Removed the entire
authconfiguration block that was specific to @nuxtjs/auth
- Removed
This resolves the incompatibility. For Nuxt 3, authentication and HTTP requests should use:
- Native fetch API or the new
$fetchcomposable for HTTP requests - A Nuxt 3-compatible auth library or custom auth implementation with composables/middleware
- Layout uses Nuxt 2 <nuxt/> component instead of Nuxt 3 <NuxtPage/>
View Details
📝 Patch Details
diff --git a/layouts/default.vue b/layouts/default.vue
index 4ac3ed9..b524de3 100644
--- a/layouts/default.vue
+++ b/layouts/default.vue
@@ -3,7 +3,7 @@
<fork-this/>
<div class="main">
<navbar/>
- <nuxt/>
+ <NuxtPage/>
</div>
</div>
</template>
Analysis
Bug Explanation
The layouts/default.vue file uses the <nuxt/> component on line 5, which is the Nuxt 2 syntax for rendering page content. The project's package.json shows it's using Nuxt 3.0.0 as a dev dependency, indicating this is a Nuxt 3 project.
In Nuxt 3, the <nuxt/> component was renamed to <NuxtPage/>. Using the old Nuxt 2 syntax in a Nuxt 3 application will cause:
- The component not to be recognized, resulting in runtime errors
- Page content may fail to render properly
- Potential build failures during the Nuxt 3 compilation process
Fix Explanation
The fix involved replacing the deprecated <nuxt/> component with the correct Nuxt 3 component <NuxtPage/> on line 5 of layouts/default.vue. This ensures:
- The page content is rendered correctly in Nuxt 3
- The application follows Nuxt 3 API standards
- No runtime errors occur due to unrecognized components
- The layout properly integrates with Nuxt 3's page rendering system
81be2fb to
62663c2
Compare
2a8e364 to
a1c6946
Compare
a1c6946 to
996cc2a
Compare
996cc2a to
9fa0f73
Compare
renovate
Bot
changed the title
renovate
Bot
changed the title
d5083e6 to
835ee14
Compare
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. |
c12cc04 to
85a8744
Compare
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
85a8744 to
cbc5500
Compare
cbc5500 to
fdb7ac3
Compare
fdb7ac3 to
a793d34
Compare
a793d34 to
3da23c4
Compare
3da23c4 to
20cf1ec
Compare
20cf1ec to
05e62ee
Compare
05e62ee to
6a700a4
Compare
6a700a4 to
61f3197
Compare
61f3197 to
f1cf856
Compare
f1cf856 to
7bbfb5d
Compare
7bbfb5d to
dea2d1b
Compare
dea2d1b to
49b0c57
Compare
49b0c57 to
d604c5d
Compare
This PR contains the following updates:
^2.14.3→^3.0.0nuxt vulnerable to Cross-site Scripting in navigateTo if used after SSR
CVE-2024-34343 / GHSA-vf6r-87q4-2vjf
More information
Details
Summary
The
navigateTofunction attempts to blockthejavascript:protocol, but does not correctly use API's provided byunjs/ufo. This library also contains parsing discrepancies.Details
The function first tests to see if the specified URL has a protocol. This uses the unjs/ufo package for URL parsing. This function works effectively, and returns true for a
javascript:protocol.After this, the URL is parsed using the
parseURLfunction. This function will refuse to parse poorly formatted URLs. Parsingjavascript:alert(1)returns null/"" for all values.Next, the protocol of the URL is then checked using the
isScriptProtocolfunction. This function simply checks the input against a list of protocols, and does not perform any parsing.The combination of refusing to parse poorly formatted URLs, and not performing additional parsing means that script checks fail as no protocol can be found. Even if a protocol was identified, whitespace is not stripped in the
parseURLimplementation, bypassing theisScriptProtocolchecks.Certain special protocols are identified at the top of
parseURL. Inserting a newline or tab into this sequence will block the special protocol check, and bypass the latter checks.PoC
POC - https://stackblitz.com/edit/nuxt-xss-navigateto?file=app.vue
Attempt payload X, then attempt payload Y.
Impact
XSS, access to cookies, make requests on user's behalf.
Recommendations
As always with these bugs, the
URLconstructor provided by the browser is always the safest method of parsing a URL.Given the cross-platform requirements of nuxt/ufo a more appropriate solution is to make parsing consistent between functions, and to adapt parsing to be more consistent with the WHATWG URL specification.
Note
I've reported this vulnerability here as it is unclear if this is a bug in ufo or a misuse of the ufo library.
This ONLY has impact after SSR has occurred, the
javascript:protocol within a location header does not trigger XSS.Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Cross-site scripting via slot content in Nuxt's head components
GHSA-m3q2-p4fw-w38m
More information
Details
Impact
Nuxt's globally registered
<NoScript>component (from@unhead/vuehead components, re-exported by Nuxt) wrote its default-slot content to theinnerHTMLof the<noscript>head tag, bypassing the HTML escaping that{{ }}interpolation normally applies in Vue templates.Applications that placed untrusted, attacker-controllable data inside a
<NoScript>slot, for example:would emit that value unescaped inside
<noscript>in the server-rendered HTML. With scripting enabled, the HTML parser treats<noscript>content in<head>under the "in head noscript" insertion mode: any tag other thanlink,meta,noframes, orstyleimplicitly closes<noscript>and is re-processed in the head. A payload such as<script>...</script>therefore escapes the element and executes in the document context.Sibling head components (
<Style>,<Title>) were not affected because they already routed slot text through the safetextContentpath.Affected versions
All currently supported versions of
nuxtthat ship the<NoScript>global component.Patches
Fixed in
nuxt@4.4.7(commit4b054e9d) and backported tonuxt@3.21.7(commit7fea9fd6). The fix escapes<NoScript>slot content withescapeHtmlfrom@vue/sharedand writes it totextContentrather thaninnerHTML. Slot content is now rendered as text; intentional markup inside<NoScript>is no longer parsed as HTML.Workarounds
Until you can upgrade:
<NoScript>slots. Replace<NoScript>{{ x }}</NoScript>with a static string, or sanitise / HTML-escapexat the source.useHead({ noscript: [{ textContent: escapedValue }] })after escapingescapedValue.Credit
Reported to Anthropic's coordinated vulnerability disclosure pipeline by Claude (Anthropic's AI assistant) and triaged by the Anthropic security team. Reference: ANT-2026-4NJYDFFM.
Independently reported by @alcls01111 via GitHub's coordinated disclosure flow (
GHSA-8grp-wcq9-925q), closed as a duplicate of this advisory.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
nuxt/nuxt (nuxt)
v3.21.7Compare Source
👉 make sure to check https://github.com/nuxt/nuxt/security/advisories to view open advisories resolved by this release.
👉 Changelog
compare changes
🩹 Fixes
noSSRbefore deciding payload extraction (#35108)allowDirs(#35112)pathefor buildCache path boundary check (#35111)isValidin dev clipboard-copy listener (#35109)reloadNuxtApppath before reload (#35115)clientServerwithssr: false(#34959).d.mts/.d.ctsinresolveTypePaths(#35235)<NuxtClientFallback>ssr output (#35199)isScriptProtocolguard tonavigateToopen option (#35206)defuin app config template (40bedf0db)vue-router(3f3e3fa7b)<NoScript>slot content (7fea9fd68)navigateTo(1f2dd5e78)reloadNuxtApp(6497d99dd)<NuxtLink>href (53284043d)defu(d11d7b1b5)📖 Documentation
🏡 Chore
execFileSyncfor safety in release scripts (9a455a658)✅ Tests
🤖 CI
❤️ Contributors
v3.21.6Compare Source
👉 Changelog
compare changes
🩹 Fixes
setPageLayoutprops on same-path navigation (#35055)useLoadingIndicatorproperties as readonly (#35062)statusCodefor nitro v2 compatibility (82dcd6a31)💅 Refactors
📖 Documentation
🏡 Chore
✅ Tests
app/(6d2ac69ff)🤖 CI
test:enginesfails (958abb882)❤️ Contributors
v3.21.5Compare Source
👉 Changelog
compare changes
🔥 Performance
isIgnoredrelative (#35015)🩹 Fixes
/+ overridessr: true(#34990).envbefore resolving nuxt schema (#34958)serverHandlersarray afternitro:config(#34985)📖 Documentation
🏡 Chore
✅ Tests
buildDirper matrix project for shared fixtures (#35007)❤️ Contributors
v3.21.4Compare Source
v3.21.2Compare Source
v3.21.1Compare Source
👉 Changelog
compare changes
🩹 Fixes
server/forbuilder:watchhook (#34208)x-nitro-prerenderheader (#34202)error.messagefor fatal errors (#34226)#appbarrel export in keyed functions (#34199)datetime in` (#33992)nuxt/schema(#34255)meta.name(#34263)#componentsimport mapping conflict for packages outside rootDir (#34139)nuxt/schemaonce more (9f5bb611d)💅 Refactors
genObjectKeyto omit unnecessary quotes (#34245)ComponentPropshelper to extract layout props (#34248)📖 Documentation
keyedComposables(#34201)🏡 Chore
pxfromwidthattribute (e80147f7d)✅ Tests
<NuxtPage>navigation (707a9dc44)❤️ Contributors
v3.21.0Compare Source
Nuxt 4.3 and 3.21 bring powerful new features for layouts, caching, and developer experience – plus significant performance improvements under the hood.
📣 Some News
Extended v3 Support
Early this month, I opened a discussion to find out how the upgrade had gone from v3 to v4. I was really pleased to hear how well it had gone for most people.
Having said that, we're committed to making sure no one gets left behind. And so we will continue to provide security updates and critical bug fix releases beyond the previously announced end-of-life date of January 31, 2026, meaning Nuxt v3 will meet its end-of-life on July 31, 2026.
Preparing for Nuxt 5
We're closer than ever to the releases of Nuxt v5 and Nitro v3. In the coming weeks, the
mainbranch of the Nuxt repository will begin receiving initial commits for Nuxt 5. However, it's still business as usual.mainbranch4.xand3.xbranchesKeep an eye out on the Upgrade Guide – we'll be adding details about how you can already start migrating your projects to prepare for Nuxt v4 with
future.compatibilityVersion: 5.🗂️ Route Rule Layouts
But that's enough about the future. We have a lot of good things for you today!
First, you can now set layouts directly in route rules using the new
appLayoutproperty (#31092). This provides a centralized, declarative way to manage layouts across your application without scatteringdefinePageMetacalls throughout your pages.This might be useful for:
📦 ISR/SWR Payload Extraction
Payload extraction now works with ISR (incremental static regeneration), SWR (stale-while-revalidate) and cache
routeRules(#33467). Previously, only pre-rendered pages could generate_payload.jsonfiles.This means:
🧹 Dev Mode Payload Extraction
Related to the above, payload extraction now also works in development mode (#30784). This makes it easier to test and debug payload behavior without needing to run a production build.
🚫 Disable Modules from Layers
When extending Nuxt layers, you can now disable specific modules that you don't need (#33883). Just pass
falseto the module's options:🏷️ Route Groups in Page Meta
Route groups (folders wrapped in parentheses like
(protected)/) are now exposed in page meta (#33460). This makes it easy to check which groups a route belongs to in middleware or anywhere you have access to the route.This provides a clean, convention-based approach to route-level authorization without needing to add
definePageMetato every protected page.🎨 Layout Props with
setPageLayoutThe
setPageLayoutcomposable now accepts a second parameter to pass props to your layout (#33805):🔧
#serverAliasA new
#serveralias provides clean imports within your server directory (#33870), similar to how#sharedworks:The alias includes import protection – you can't accidentally import
#servercode from client or shared contexts.🪟 Draggable Error Overlay
The development error overlay introduced in Nuxt 4.2 is now draggable and can be minimized (#33695). You can:
This is a quality-of-life improvement when you're iterating on fixes and don't want the overlay blocking your view.
https://github.com/user-attachments/assets/nuxt_4-3_error_demo.mp4
⚙️ Async Plugin Constructors
Module authors can now use async functions when adding build plugins (#33619):
This enables true lazy loading of build plugins, avoiding unnecessary code loading when plugins aren't needed.
🚀 Performance Improvements
This release includes several performance optimizations for faster builds:
nuxt:ssr-stylesplugin is now significantly faster (#33862, #33865)rou3, removing the need forradix3in the client bundle and eliminating app manifest fetches (#33920)🎨 Inline Styles for Webpack/Rspack
The
inlineStylesfeature now works with webpack and rspack builders (#33966), not just Vite. This enables critical CSS inlining for better Core Web Vitals regardless of your bundler choice.statusCode→status,statusMessage→statusTextIn preparation for Nitro v3 and H3 v2, we're moving to use Web API naming conventions (#33912). The old properties still work but are deprecated in advance of v5:
🐛 Bug Fixes
Notable fixes in this release:
keyattribute (#33958, #33963)useCookieunsafe number parsing during decode (#34007)NuxtPagenot re-rendering when nestedNuxtLayouthas layouts disabled (#34078)allowArbitraryExtensionsby default in TypeScript config (#34084)noUncheckedIndexedAccessto server tsconfig for safer typing (#33985)📚 Documentation
🎉 Nuxt 3.21.0
Alongside v4.3.0, we're releasing Nuxt v3.21.0 with many of the same improvements backported to the 3.x branch. This release includes:
setPageLayout,#serveralias, draggable error overlay, and morefalseuseCookienumber parsing, head component deduplication, and more✅ Upgrading
Our recommendation for upgrading is to run:
This will deduplicate your lockfile and help ensure you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.
👉 Changelog
compare changes
🚀 Enhancements
#serveralias for server directory imports (#33870)crosswstypes (6ff79ea6c)false(#33883)moduleDependenciesas an async function (#33504)appLayoutin route rules (#31092)setPageLayout(#33805)🔥 Performance
nuxt:ssr-stylesplugin (#33862)🩹 Fixes
router.replacein page hmr (#33897)page:loading:endin cache if already called (fbbe10133)NUXT_VITE_NODE_OPTIONS(8abb7ef5b)appMiddlewarereferences invalid key (ed8bb68c5)nuxt/meta(b748840bc)keyfor tag deduplication in<Head>component (#33958)build.transpilewhen initialising vite (#33868)onUpgradearguments with types (#33988)rou3(7da94e8c3)noUncheckedIndexedAccessto server tsconfig (#33985)useRequestFetch(#33976)h3types to auto-imports (#34035)nuxt/schema(9b40196a6)NuxtPagewhen nestedNuxtLayouthas explicitly disabled layouts (#34078)allowArbitraryExtensionsby default (#34084)useAsyncDatadebounced execute post watcher flush (#34125)typeFromsupport forimports.d.tstemplate exports (#34135)hydrate-nevercomponents (#34132)💅 Refactors
defu+consola(e31668f67).tsfile extensions to relative imports (458f3c9b6)<>toas(08f72881e)~prefix for internal ssrContext properties (#33896)status/statusText+ deprecate old props (#33912)nitropack/runtimenamespace (b06d53166)nitropack/runtimenamespace (897a2259f)📖 Documentation
useHeadreturn type (#33857)Module Author Guides(#33803)statusText(#32834)defineWrappedResponseHandler(#33952)useStatedocs (#34105).nuxtrcexample (#34107)appLayout(9b78698c3)falseto its options (18500730c)sourcefrom<NuxtIsland>(08778c98c)📦 Build
vite-nodeentrypoints (#33893)obuildexcept for nuxt + nitro-server packages (#34049)/builder-envsubpath types (1951648fa)🏡 Chore
build:stubcommand for those that need it (c682b2681)Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.