chore(deps): update nuxt - #1395
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
commit: |
renovate
Bot
force-pushed
the
renovate/nuxt
branch
from
May 11, 2026 02:12
c120d9c to
8610e62
Compare
renovate
Bot
force-pushed
the
renovate/nuxt
branch
2 times, most recently
from
May 18, 2026 11:53
2cb0beb to
12c13fb
Compare
renovate
Bot
force-pushed
the
renovate/nuxt
branch
from
May 28, 2026 14:42
12c13fb to
b6d43fa
Compare
|
renovate
Bot
force-pushed
the
renovate/nuxt
branch
2 times, most recently
from
June 2, 2026 18:50
dfd75bc to
8a68222
Compare
renovate
Bot
force-pushed
the
renovate/nuxt
branch
from
June 8, 2026 22:48
8a68222 to
43c0bc8
Compare
|
renovate
Bot
force-pushed
the
renovate/nuxt
branch
from
June 10, 2026 11:55
43c0bc8 to
9f71297
Compare
renovate
Bot
force-pushed
the
renovate/nuxt
branch
from
June 11, 2026 20:07
9f71297 to
35bcde5
Compare
renovate
Bot
force-pushed
the
renovate/nuxt
branch
3 times, most recently
from
July 18, 2026 22:12
0fd95b3 to
ee99cd2
Compare
renovate
Bot
force-pushed
the
renovate/nuxt
branch
3 times, most recently
from
July 27, 2026 13:05
cd5a4bb to
5e88d19
Compare
renovate
Bot
force-pushed
the
renovate/nuxt
branch
2 times, most recently
from
July 30, 2026 18:04
6cdabde to
704a10c
Compare
renovate
Bot
force-pushed
the
renovate/nuxt
branch
3 times, most recently
from
August 12, 2026 01:29
53a3425 to
2159437
Compare
renovate
Bot
force-pushed
the
renovate/nuxt
branch
from
August 14, 2026 18:45
2159437 to
2d4ca73
Compare
renovate
Bot
force-pushed
the
renovate/nuxt
branch
from
August 26, 2026 15:14
2d4ca73 to
b46707a
Compare
Contributor
Author
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.



This PR contains the following updates:
1.15.2→1.17.02.0.0→2.1.01.0.2→1.0.34.4.2→4.5.24.4.2→4.5.2Release Notes
nuxt/eslint (@nuxt/eslint)
v1.17.0Compare Source
🚀 Features
🐞 Bug Fixes
View changes on GitHub
v1.16.0Compare Source
🚀 Features
View changes on GitHub
nuxt/image (@nuxt/image)
v2.1.0Compare Source
👀 Highlights
Nuxt Image 2.1 ships eight new image providers, a major upgrade to our image processing engine, and a bunch of fixes across existing providers.
🖼️ IPX v4
Under the hood, we've upgraded to IPX v4 which brings significant improvements:
svgo: falsewould return untouched SVGs. The sanitizer now removes SMIL attribute injection, foreign content (<foreignObject>,<iframe>, etc.), and unsafe URIs across all elementsopacity,brightness,saturation,hue,lightness,autoorient,dilate,erode,clahe, andlinear400errors with clear messages instead of cryptic500sparseURLoption🌐 New Providers
This release adds support for eight new image optimization services:
🔧 Provider Improvements
keymodifier for named presets (#2207)baseURLfor custom CDN setups (#2273)minimumCacheTTLis now configurable (#2278)📦 Type Exports
NuxtImgPropsandNuxtPicturePropsare now exported from the runtime, making it easier to type your own components that wrap<NuxtImg>or<NuxtPicture>(#2115).👉 Changelog
compare changes
🚀 Enhancements
keymodifier (#2207)minimumCacheTTLconfigurable (#2278)baseURLoption to Sanity provider (#2273)🩹 Fixes
137ee63)providerkey in generated image options (#2279)7e561f6)237e480)baseURLfor urls with no operations (#2162)imagesrcsetpreload when densities are set w/o sizes (#2176)runtimeConfig.ipxwith defaults (#2134)withoutEnlargementmodifier type (#2133)remote_imagesconfig (#2086)formats(#2038)layer.config.image(23b8cef)data-*in imgAttrs (#2017)public/dir in relation torootDir(3e07761)📖 Documentation
6f59ab1)_routes.json(#2136)<NuxtImg />example (#2074)93de8a9)2deacc0)📦 Build
🏡 Chore
prepack(97d3758)consolato dev dependencies (#2275)pnpm-workspace.yaml(9b80ce6)fd87f7d)<NuxtPicture>(#2145)13b88c1)03b5ef4)🤖 CI
e529f37)2f8b332)23ee710)777239c)a200dae)f60d0f7)d1cb12b)09e5efb)402c729)906111c)🎉 New Contributors
❤️ Contributors
nuxt/module-builder (@nuxt/module-builder)
v1.0.3Compare Source
👉 Changelog
compare changes
🩹 Fixes
📦 Build
🏡 Chore
resolutions/pnpm.overridestopnpm-workspace.yaml(cfb45fb)afcf2fa)aeb1d38)92eb2af)✅ Tests
809c89f)9412c91)#appornuxt/appin generated declarations (#727)🤖 CI
604d5b3)4442a14)f7be1a6)reproduction(57e7ce9)c3c8e72)d87d217)54c5f13)🎉 New Contributors
❤️ Contributors
nuxt/nuxt (@nuxt/webpack-builder)
v4.5.2Compare Source
👉 Changelog
compare changes
🔥 Performance
🩹 Fixes
v-forislands transform (#35877)applyandapplyToEnvironmentin vite wrapper (#35899)enforcein vite wrapper (#35916)vite-node(#35758)<NuxtPage>on nav + with slot (#35948)prependis set (#35942)import.meta.testfor server code (#35987)💅 Refactors
vue-component-type-helpersinstead of locally maintained helpers (#35840)isReferenceIdentifierin page-meta plugin (#35882)📖 Documentation
defineVitestProjectin e2e tests (#35926)📦 Build
🏡 Chore
@nuxt/devtoolsto v3.4.0 (#35892)✅ Tests
toFsUrl(a5ad667f7)🤖 CI
permissions: {}to workflows (2e1a1cbeb)❤️ Contributors
v4.5.1Compare Source
It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, cross-user payload disclosure on cached pages, and dev server path disclosure. Refreshing your lockfile also pulls in
@nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.
If you use the
cache,swrorisrroute rules, purge any CDN or edge cache after upgrading; a leaked_payload.jsonmay already be cached upstream.Full details: Nuxt Security Patch Releases and GitHub Security Advisories.
👉 Changelog
compare changes
🔥 Performance
vue.optionsApiand disable it for v5+ (#35791)ssr: false(#35782)🩹 Fixes
useRoutein detached effect scope (#35659)nameorpathwhen reusing an existing page inpages:extend(#35661)useFetchmethod inference (#35671)force-cache(#35672).mtsfile extension in resolver (#33845)@unhead/vue/*from nuxt's dependency tree (#35690)$fetchwith nitro's$Fetch(#35704)vue-routerwhen there are island pages (#35739)h3that pins it to the version nuxt depends on (#35774)fromcannot be resolved (#35799)app.buildAssetsDir(#35833)templateisland prop under runtime compiler (ee6c84633)asprop for islands (581651ff3)💅 Refactors
semverwithverkit(#35713)📖 Documentation
codeSplitting: false(#35683)onPrehydrateexample comment (#35684)runtimeConfigenv var casting edge cases (#35709)nuxtrather thannuxi(8891e179c)runtimeCompilersecurity best practices (449b63ab1)📦 Build
.tsfile extension fromruntime/imports (#35689)🏡 Chore
@nuxt/telemetryin knip (9824d4f10)@nuxt/devtoolsto v3.3.1 (#35815)✅ Tests
_routein gotoPath (ca92d082b)🤖 CI
knipjob (58f68bd64)❤️ Contributors
v4.5.0Compare Source
📣 Some News
Preparing for Nuxt 5
A good chunk of this release is (hopefully) invisible plumbing for Nuxt 5. We've moved onto the latest major versions of several core dependencies (
unheadv3,unctxv3, and Vite 8), switched the framework's own build over totsdown, and introduced a stablenuxt/*build output contract with dev exports so that type-checking in the Nuxt monorepo works without a build step (#35463, #35605).Much of this is working to shrink the gap between v4 and v5 internally, so that the migration will be as boring as possible.
With the release of Nuxt v4.5, our focus as a team will turn to stabilising Nuxt v5 and creating compatibility utilities to make the upgrade as smooth as possible.
Nuxt 3 End-of-Life
Nuxt 3 reaches end-of-life on July 31, 2026, so this is one of the last few 3.x releases we'll ship. If you're still on v3, now is a great time to move across. Most people told us the v3 to v4 upgrade was smooth, and we've kept the upgrade guide up to date.
Alongside v4.5.0 we're publishing a maintenance patch for the 3.x line (v3.21.9) with the compatible bug fixes and smaller improvements from this release backported. The headline items here (Vite 8, Rspack 2,
unheadv3,unctxv3) are major upgrades and stay v4-only, so 3.x remains stable as it approaches end-of-life.👀 Highlights
Nuxt 4.5 is a big one. This release ships three major upgrades to the build layer (Vite 8, Rspack 2, and a brand new Rsbuild-powered pipeline for the Rspack builder), an experimental SSR streaming mode, a handful of new composables and conventions, and a lot of groundwork that brings us closer to Nuxt 5.
There's a lot here, so grab a coffee. ☕️
⚡️ Vite 8
Nuxt now runs on Vite 8 (#34256). This brings faster cold starts, the latest Rolldown-powered internals, and many upstream improvements from the Vite team.
For most apps this is a transparent upgrade. If you have custom Vite plugins or config, it's worth skimming the Vite migration guide to check for anything that affects you.
🦀 Rspack 2 and Rsbuild
If you use the Rspack builder, this release is a substantial upgrade. We've moved to Rspack 2 (#34929), which is faster and lighter, and rebuilt the builder on top of
@rsbuild/core(#35489).The public surface stays the same. You still opt in with
builder: 'rspack'and the existingrspack:*hooks continue to work:Under the hood, though, a lot has changed for the better:
webpack-dev-middlewareandwebpack-hot-middleware(#35575).🌊 Experimental SSR Streaming
This is one I'm particularly excited about. You can now enable SSR streaming to dramatically improve Time to First Byte (#34411). Instead of buffering the whole rendered page and sending it in one go, Nuxt flushes the HTML shell (your
<head>, styles, preload hints, and entry scripts) immediately, then streams the body as Vue renders it.Streaming is automatically disabled for bots and crawlers so search engines still receive fully-rendered HTML. You can tune which user agents count as crawlers, and you can opt individual routes out:
There's one thing worth understanding before you turn it on. Because streaming commits the HTTP status and headers with the very first byte, anything that mutates the response after rendering has begun (a
setResponseStatus()in a<script setup>, a cookie write during middleware, and so on) can't reach the client. Nuxt handles the common cases for you: routes withredirect,cache,isr,swr,noScripts, orssr: falserules automatically fall back to the buffered renderer, and in development we log a warning naming any dropped mutations so nothing fails silently.📖 SSR streaming documentation
🩺 Stable Error Codes
This one I'm really happy about. Nuxt now has a stable error code system (#35429). Warnings and errors raised during build and at runtime now carry a stable code (like
NUXT_E1001orNUXT_B5001), a short explanation of why it happened, and a concrete fix to try.Every code is greppable and bookmarkable, and the ones that need more than a one-line fix link straight to a dedicated docs page. For example, the classic "a composable was called outside a Nuxt context" now surfaces as
NUXT_E1001with the why/fix inline and a docs page explaining the context rules and how to userunWithContext().To keep production output lean, the verbose why/fix text is stripped from production builds, leaving just the stable code.
This is the foundation for much better error messages across Nuxt, and we'll keep migrating existing warnings and errors onto it over the coming releases. If you've ever squinted at a cryptic Nuxt message, this is for you.
🎨
useLayoutComposableThere's a new
useLayoutcomposable for reading the layout that's been resolved for the current route ([#35623](https://redirect.github.com/nuxt/nuxt/issues/35Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.