chore(deps): update nuxt core - #60
renovate[bot] wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
5bfd854 to
be05f14
Compare
be05f14 to
9e8febf
Compare
9e8febf to
d0bf1b9
Compare
1f4f7b1 to
99328d5
Compare
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
c832b9b to
7b107db
Compare
e82bcfa to
34d1341
Compare
3ed0164 to
306ab49
Compare
306ab49 to
d908bcf
Compare
◈ PR Lens
Architecture 1 component touched across 1 lane. Data flow No data-flow sequence changed in this PR. View
Tip The diagrams are links. Click one to open it on the canvas, then press W or click play to walk through the change. 🪧 More tips
Thanks for using PR Lens! It's built by Coldtea, free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
687e8b9 to
0c5afaf
Compare
16830af to
940af26
Compare
940af26 to
dd3f2b3
Compare
|
Important Review skippedIgnore keyword(s) in the title. ⛔ Ignored keywords (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This PR contains the following updates:
4.0.0→4.3.24.3.1→4.5.23.5.30→3.5.42Release Notes
nuxt/test-utils (@nuxt/test-utils)
v4.3.2Compare Source
👉 Changelog
compare changes
🩹 Fixes
vitest/environmentsimport opaque to rolldown (6d1195d38)❤️ Contributors
v4.3.1Compare Source
👉 Changelog
compare changes
🩹 Fixes
^5as peer dependency (#1809)🏡 Chore
e68ecfa28)🎉 New Contributors
❤️ Contributors
v4.3.0Compare Source
👉 Changelog
compare changes
🚀 Enhancements
unmockNuxtImporthelper (#1795)🩹 Fixes
✅ Tests
🎉 New Contributors
❤️ Contributors
v4.2.0Compare Source
👉 Changelog
compare changes
🚀 Enhancements
🩹 Fixes
mockNuxtImportsourcemap mapped position (#1787)setupTimeoutin playwright + surface server logs (#1785)includeSourcein both projects indefineVitestConfig(#1763)taskkillto kill processes on windows (#1760)🏡 Chore
latestranges with caret ranges (#1773)✅ Tests
🤖 CI
🎉 New Contributors
❤️ Contributors
v4.1.0Compare Source
👉 Changelog
compare changes
🚀 Enhancements
🩹 Fixes
RouterLinkstub works withpages: false(#1687)ssr.resolve.conditionsto removeimport(#1732)defineVitestProject(#1724)viteEnvironmentApi(#1708)📦 Build
🏡 Chore
h3-nextto optional dependencies (#1733)✅ Tests
autoImport: false(#1688)🤖 CI
❤️ Contributors
v4.0.3Compare Source
👉 Changelog
compare changes
🩹 Fixes
compilerOptionsconditionally (#1659)isActiveslot props (#1640)startServer(#1675)🏡 Chore
❤️ Contributors
v4.0.2Compare Source
👉 Changelog
compare changes
🩹 Fixes
🤖 CI
❤️ Contributors
v4.0.1Compare Source
👉 Changelog
compare changes
🩹 Fixes
mockNuxtImporttypes when using string target (#1592)defineConfigfromvite(1aa5e8748)ResourceLoaderremoval in jsdom v28 (#1611)vitest/environmentsimport warning (#1627)🏡 Chore
vitest-environment-nuxtversions (f5ec72127)pkg-pr-newprereleasevitest-environment-nuxt(#1601)✅ Tests
🤖 CI
pkg-pr-newprerelease (#1598)❤️ Contributors
nuxt/nuxt (nuxt)
v4.5.2Compare Source
👉 Changelog
compare changes
🔥 Performance
🩹 Fixes
v-forislands transform (#35877)applyandapplyToEnvironmentin vite wrapper (#35899)enforcein vite wrapper (#35916)vite-node(#35758)<NuxtPage>on nav + with slot (#35948)prependis set (#35942)import.meta.testfor server code (#35987)💅 Refactors
vue-component-type-helpersinstead of locally maintained helpers (#35840)isReferenceIdentifierin page-meta plugin (#35882)📖 Documentation
defineVitestProjectin e2e tests (#35926)📦 Build
🏡 Chore
@nuxt/devtoolsto v3.4.0 (#35892)✅ Tests
toFsUrl(a5ad667f7)🤖 CI
permissions: {}to workflows (2e1a1cbeb)❤️ Contributors
v4.5.1Compare Source
It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, cross-user payload disclosure on cached pages, and dev server path disclosure. Refreshing your lockfile also pulls in
@nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.
If you use the
cache,swrorisrroute rules, purge any CDN or edge cache after upgrading; a leaked_payload.jsonmay already be cached upstream.Full details: Nuxt Security Patch Releases and GitHub Security Advisories.
👉 Changelog
compare changes
🔥 Performance
vue.optionsApiand disable it for v5+ (#35791)ssr: false(#35782)🩹 Fixes
useRoutein detached effect scope (#35659)nameorpathwhen reusing an existing page inpages:extend(#35661)useFetchmethod inference (#35671)force-cache(#35672).mtsfile extension in resolver (#33845)@unhead/vue/*from nuxt's dependency tree (#35690)$fetchwith nitro's$Fetch(#35704)vue-routerwhen there are island pages (#35739)h3that pins it to the version nuxt depends on (#35774)fromcannot be resolved (#35799)app.buildAssetsDir(#35833)templateisland prop under runtime compiler (ee6c84633)asprop for islands (581651ff3)💅 Refactors
semverwithverkit(#35713)📖 Documentation
codeSplitting: false(#35683)onPrehydrateexample comment (#35684)runtimeConfigenv var casting edge cases (#35709)nuxtrather thannuxi(8891e179c)runtimeCompilersecurity best practices (449b63ab1)📦 Build
.tsfile extension fromruntime/imports (#35689)🏡 Chore
@nuxt/telemetryin knip (9824d4f10)@nuxt/devtoolsto v3.3.1 (#35815)✅ Tests
_routein gotoPath (ca92d082b)🤖 CI
knipjob (58f68bd64)❤️ Contributors
v4.5.0Compare Source
📣 Some News
Preparing for Nuxt 5
A good chunk of this release is (hopefully) invisible plumbing for Nuxt 5. We've moved onto the latest major versions of several core dependencies (
unheadv3,unctxv3, and Vite 8), switched the framework's own build over totsdown, and introduced a stablenuxt/*build output contract with dev exports so that type-checking in the Nuxt monorepo works without a build step (#35463, #35605).Much of this is working to shrink the gap between v4 and v5 internally, so that the migration will be as boring as possible.
With the release of Nuxt v4.5, our focus as a team will turn to stabilising Nuxt v5 and creating compatibility utilities to make the upgrade as smooth as possible.
Nuxt 3 End-of-Life
Nuxt 3 reaches end-of-life on July 31, 2026, so this is one of the last few 3.x releases we'll ship. If you're still on v3, now is a great time to move across. Most people told us the v3 to v4 upgrade was smooth, and we've kept the upgrade guide up to date.
Alongside v4.5.0 we're publishing a maintenance patch for the 3.x line (v3.21.9) with the compatible bug fixes and smaller improvements from this release backported. The headline items here (Vite 8, Rspack 2,
unheadv3,unctxv3) are major upgrades and stay v4-only, so 3.x remains stable as it approaches end-of-life.👀 Highlights
Nuxt 4.5 is a big one. This release ships three major upgrades to the build layer (Vite 8, Rspack 2, and a brand new Rsbuild-powered pipeline for the Rspack builder), an experimental SSR streaming mode, a handful of new composables and conventions, and a lot of groundwork that brings us closer to Nuxt 5.
There's a lot here, so grab a coffee. ☕️
⚡️ Vite 8
Nuxt now runs on Vite 8 (#34256). This brings faster cold starts, the latest Rolldown-powered internals, and many upstream improvements from the Vite team.
For most apps this is a transparent upgrade. If you have custom Vite plugins or config, it's worth skimming the Vite migration guide to check for anything that affects you.
🦀 Rspack 2 and Rsbuild
If you use the Rspack builder, this release is a substantial upgrade. We've moved to Rspack 2 (#34929), which is faster and lighter, and rebuilt the builder on top of
@rsbuild/core(#35489).The public surface stays the same. You still opt in with
builder: 'rspack'and the existingrspack:*hooks continue to work:Under the hood, though, a lot has changed for the better:
webpack-dev-middlewareandwebpack-hot-middleware(#35575).🌊 Experimental SSR Streaming
This is one I'm particularly excited about. You can now enable SSR streaming to dramatically improve Time to First Byte (#34411). Instead of buffering the whole rendered page and sending it in one go, Nuxt flushes the HTML shell (your
<head>, styles, preload hints, and entry scripts) immediately, then streams the body as Vue renders it.Streaming is automatically disabled for bots and crawlers so search engines still receive fully-rendered HTML. You can tune which user agents count as crawlers, and you can opt individual routes out:
There's one thing worth understanding before you turn it on. Because streaming commits the HTTP status and headers with the very first byte, anything that mutates the response after rendering has begun (a
setResponseStatus()in a<script setup>, a cookie write during middleware, and so on) can't reach the client. Nuxt handles the common cases for you: routes withredirect,cache,isr,swr,noScripts, orssr: falserules automatically fall back to the buffered renderer, and in development we log a warning naming any dropped mutations so nothing fails silently.📖 SSR streaming documentation
🩺 Stable Error Codes
This one I'm really happy about. Nuxt now has a stable error code system (#35429). Warnings and errors raised during build and at runtime now carry a stable code (like
NUXT_E1001orNUXT_B5001), a short explanation of why it happened, and a concrete fix to try.Every code is greppable and bookmarkable, and the ones that need more than a one-line fix link straight to a dedicated docs page. For example, the classic "a composable was called outside a Nuxt context" now surfaces as
NUXT_E1001with the why/fix inline and a docs page explaining the context rules and how to userunWithContext().To keep production output lean, the verbose why/fix text is stripped from production builds, leaving just the stable code.
This is the foundation for much better error messages across Nuxt, and we'll keep migrating existing warnings and errors onto it over the coming releases. If you've ever squinted at a cryptic Nuxt message, this is for you.
🎨
useLayoutComposableThere's a new
useLayoutcomposable for reading the layout that's been resolved for the current route (#35623). Previously there was no clean, reactive way to ask "which layout is this page using?" from within a component.It returns a read-only computed ref, so it stays in sync as you navigate or as route rules and
definePageMetachange the resolved layout.📖
useLayoutdocumentation🪟 Named Views
Nuxt now supports named views through a filename convention (#35123). If a parent page renders more than one
<NuxtPage>outlet, you can give each outlet a name and provide a sibling page file for it using thename@view.vueconvention:Navigating to
/parent/childrenderschild.vueinto the default outlet andchild@sidebar.vueinto thesidebaroutlet. This has actually been possible in Vue Router for a long time; this release wires it up to Nuxt's file-based routing.📖 Named views documentation
🚦
enabledOption foruseFetchanduseAsyncDataYou can now gate data fetching with a reactive
enabledoption (#33260). Whileenabledisfalse, every execution is blocked (the initial fetch,execute/refresh, and watch triggers), and if you flip it fromtruetofalsemid-flight, the in-flight request is cancelled without clearing your existingdata.This is perfect for dependent or conditional queries, where you don't want to fire a request until some precondition is met. It pairs naturally with a getter or a ref, so it stays reactive.
📖
useAsyncDatadocumentation🔗
NuxtLinkPrefetch Control for Custom SlotsWhen you use
<NuxtLink>with thecustomprop, Nuxt no longer attaches prefetch handlers for you, because it can't know how you've structured your markup. To make that ergonomic, the slot now exposes everything you need to wire prefetching up yourself (#34539):You get
prefetchto trigger it,prefetchedto know whether it's already happened (great for a prefetched class), andshouldPrefetchto respect the user's connection and config.📖
NuxtLinkdocumentation⚡️ Forwarded Preload Hints on Prefetch
Here's another one we'd love you to try. When you prefetch a link to a route with payload extraction, Nuxt already primes the destination's data and chunks. With the new opt-in
experimental.prefetchPreloadTags(#35144), it also forwards the destination's<link rel="preload">andmodulepreloadhints (whatever the page sets viauseHead, or via modules like@nuxt/image's<NuxtImg preload>) into the current document, downgraded torel="prefetch"so they don't compete with the resources the user is looking at right now.The practical effect is that heavy above-the-fold assets on the next page (a hero image, a critical script) start downloading while the user is still on the current one, so the navigation feels instant. It's off by default while we gather feedback, so please give it a spin and tell us how it behaves on your app.
🌐
import.meta.envNameThe resolved Nuxt environment name is now available at runtime as
import.meta.envNamefor both Vite and webpack/Rspack builds (#34844). This is the value set by--envName(or the resolved default), so you can branch on it in your app code:📖
import.metadocumentation🔭 Tracing Channels for SSR Events
Nuxt now publishes diagnostics-channel traces for its server-side subsystems (#35191). It's unopinionated: we emit
nuxt.render,nuxt.island,nuxt.data, andnuxt.pluginchannels following the untracing naming convention, and you can build OpenTelemetry (or anything else) on top. It works in Node, Deno, Bun, and Cloudflare Workers.You can also enable it granularly. In Nuxt v5, there will be additional Nitro-level channels:
📦 Dependency Upgrades
unheadv3Nuxt's head management now runs on
unheadv3 (#34793). It's smaller, uses a synchronous engine internally, and ships better type-safety foruseHeadout of the box. This also unblocks SSR streaming.unctxv3We've moved to
unctxv3 (#35541), which resolves a class of long-standing async context issues (#33644). This is part of the composable-context reliability work that continues into v5.And more
We've also updated
magic-stringto v1, Babel to v8, and pulled in the latest Rolldown across the board. Running `nuxt upgrade --dedConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.