chore(deps): update dependency nuxt to v3 [security] by renovate[bot] · Pull Request #117 · druxt/quickstart

renovate · 2024-08-05T22:50:15Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
nuxt (source)	`2.15.8` → `3.21.7`

nuxt vulnerable to Cross-site Scripting in navigateTo if used after SSR

CVE-2024-34343 / GHSA-vf6r-87q4-2vjf

More information

Details

Summary

The navigateTo function attempts to blockthe javascript: protocol, but does not correctly use API's provided by unjs/ufo. This library also contains parsing discrepancies.

Details

The function first tests to see if the specified URL has a protocol. This uses the unjs/ufo package for URL parsing. This function works effectively, and returns true for a javascript: protocol.

After this, the URL is parsed using the parseURL function. This function will refuse to parse poorly formatted URLs. Parsing javascript:alert(1) returns null/"" for all values.

Next, the protocol of the URL is then checked using the isScriptProtocol function. This function simply checks the input against a list of protocols, and does not perform any parsing.

The combination of refusing to parse poorly formatted URLs, and not performing additional parsing means that script checks fail as no protocol can be found. Even if a protocol was identified, whitespace is not stripped in the parseURL implementation, bypassing the isScriptProtocol checks.

Certain special protocols are identified at the top of parseURL. Inserting a newline or tab into this sequence will block the special protocol check, and bypass the latter checks.

PoC

POC - https://stackblitz.com/edit/nuxt-xss-navigateto?file=app.vue

Attempt payload X, then attempt payload Y.

Impact

XSS, access to cookies, make requests on user's behalf.

Recommendations

As always with these bugs, the URL constructor provided by the browser is always the safest method of parsing a URL.

Given the cross-platform requirements of nuxt/ufo a more appropriate solution is to make parsing consistent between functions, and to adapt parsing to be more consistent with the WHATWG URL specification.

Note

I've reported this vulnerability here as it is unclear if this is a bug in ufo or a misuse of the ufo library.

This ONLY has impact after SSR has occurred, the javascript: protocol within a location header does not trigger XSS.

Severity

CVSS Score: 5.1 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Cross-site scripting via slot content in Nuxt's head components

GHSA-m3q2-p4fw-w38m

More information

Details

Impact

Nuxt's globally registered <NoScript> component (from @unhead/vue head components, re-exported by Nuxt) wrote its default-slot content to the innerHTML of the <noscript> head tag, bypassing the HTML escaping that {{ }} interpolation normally applies in Vue templates.

Applications that placed untrusted, attacker-controllable data inside a <NoScript> slot, for example:

<NoScript>{{ route.query.banner }}</NoScript>

would emit that value unescaped inside <noscript> in the server-rendered HTML. With scripting enabled, the HTML parser treats <noscript> content in <head> under the "in head noscript" insertion mode: any tag other than link, meta, noframes, or style implicitly closes <noscript> and is re-processed in the head. A payload such as <script>...</script> therefore escapes the element and executes in the document context.

Sibling head components (<Style>, <Title>) were not affected because they already routed slot text through the safe textContent path.

Affected versions

All currently supported versions of nuxt that ship the <NoScript> global component.

Patches

Fixed in nuxt@4.4.7 (commit 4b054e9d) and backported to nuxt@3.21.7 (commit 7fea9fd6). The fix escapes <NoScript> slot content with escapeHtml from @vue/shared and writes it to textContent rather than innerHTML. Slot content is now rendered as text; intentional markup inside <NoScript> is no longer parsed as HTML.

Workarounds

Until you can upgrade:

Do not interpolate untrusted input into <NoScript> slots. Replace <NoScript>{{ x }}</NoScript> with a static string, or sanitise / HTML-escape x at the source.
If you must render dynamic noscript content, write the tag yourself via useHead({ noscript: [{ textContent: escapedValue }] }) after escaping escapedValue.

Credit

Reported to Anthropic's coordinated vulnerability disclosure pipeline by Claude (Anthropic's AI assistant) and triaged by the Anthropic security team. Reference: ANT-2026-4NJYDFFM.

Independently reported by @alcls01111 via GitHub's coordinated disclosure flow (GHSA-8grp-wcq9-925q), closed as a duplicate of this advisory.

Severity

CVSS Score: 2.3 / 10 (Low)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

nuxt/nuxt (nuxt)

`v3.21.7`

Compare Source

3.21.7 is the a security hotfix release.

👉 make sure to check https://github.com/nuxt/nuxt/security/advisories to view open advisories resolved by this release.

👉 Changelog

compare changes

🩹 Fixes

nitro: Assign noSSR before deciding payload extraction (#35108)
vite: Avoid filtering out dirs with shared prefix from allowDirs (#35112)
nuxt: Use resolve from pathe for buildCache path boundary check (#35111)
nuxt: Prevent sibling-directory traversal in test component wrapper (#35110)
nitro: Pass event data to isValid in dev clipboard-copy listener (#35109)
nuxt: Validate protocols in reloadNuxtApp path before reload (#35115)
vite: Resolve vite clientServer with ssr: false (#34959)
vite: Prefix public asset virtuals with null byte (38d330179)
nuxt: Handle missing payload in chunkError listener (#35155)
vite: Close vite dev server on nuxt close (d007d7060)
kit,nuxt: Handle cancelling prompts to install packages (59821a5ca)
nuxt: Await in-lifght template generation when closing nuxt (#35181)
webpack: Surface compilation errors when stats.toString is empty (71dccff2b)
kit: Improve TS extension stripping/substitutions (#35233)
nuxt: Preserve .d.mts/.d.cts in resolveTypePaths (#35235)
nuxt: Reject prototype-chain keys in the island registry (#35205)
nitro: Gate chrome devtools workspace endpoint to local requests (#35201)
nuxt: Escape props in <NuxtClientFallback> ssr output (#35199)
nuxt: Apply isScriptProtocol guard to navigateTo open option (#35206)
rspack,webpack: Require loopback host when missing same-origin signals (#35200)
nuxt: Absolutely resolve defu in app config template (40bedf0db)
nuxt: Match route rules case-insensitively to mirror vue-router (3f3e3fa7b)
nuxt: Escape <NoScript> slot content (7fea9fd68)
nuxt: Block path-normalization open redirect in navigateTo (1f2dd5e78)
nuxt: Reject cross-origin paths in reloadNuxtApp (6497d99dd)
vite: Bind vite-node IPC to a permissioned filesystem socket (c293bf950)
nuxt: Reject script-capable protocols in <NuxtLink> href (53284043d)
nuxt: Clarify page and layout usage warnings (#35184)
nuxt: Do not absolutely resolve defu (d11d7b1b5)

📖 Documentation

Edit for clarity and grammar (#35214)
Add dedicated module dependencies page (#35171)

🏡 Chore

Use execFileSync for safety in release scripts (9a455a658)
Assert there is always a tag (8da21fba8)
Fix type in test (bc2837125)
Fix lychee dynamic composable exclude (#35119)
Add autofix action tag in comment (70eba297f)
Update renovate minimum release age (27a6821a1)

✅ Tests

Update test for js payload rendering (b51a80840)
Improve reliability of hmr test (0078499f0)

🤖 CI

Always run all tests for 4.x/3.x (0519c0ade)
Update to agentscan v1.8.0 (#35120)
Automatically close PRs from automated accounts (#35161)
Migrate from tibdex (6277aedcb)
Disable provenance-change enforcement in dependency-review (1d4910eed)
Add zizmor github actions check (#35089)

❤️ Contributors

Daniel Roe (@danielroe)
Matej Černý (@cernymatej)
anton-gor-dev (@anton-gor-dev)
Julien Huang (@huang-julien)
David Stack (@davidstackio)
Noah3521 (@Noah3521)
Matteo Gabriele (@MatteoGabriele)
Mohit Kumar (@mohitkum4r)
Florian Heuberger (@Flo0806)

`v3.21.6`

Compare Source

3.21.6 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes

nuxt: Prefer our own builder/server deps (#35029)
nitro: Add json extension to payload cache items (#35043)
nuxt: Handle errors fetching app manifest (#35050)
nuxt: Preserve setPageLayout props on same-path navigation (#35055)
vite: Don't strip buildAssetsDir from vite-node SSR ids (#35040)
nuxt: Mark useLoadingIndicator properties as readonly (#35062)
vite: Strip queries in css inline styles map (#35067)
nuxt: Encode html-significant characters in external redirect body (#35052)
nitro: Validate island request hash matches props (#35077)
nitro: Use regexp to strip query (042b615e6)
nitro: Use statusCode for nitro v2 compatibility (82dcd6a31)
nuxt: Render component-less parent routes during client-side nav (#35036)
nuxt: Run middleware for page islands (#35092)

💅 Refactors

rspack,webpack: Extract same-origin check for dev middleware (#35051)

📖 Documentation

Remove CSB, set node 22 and use steps for clarity (#35066)

🏡 Chore

Ignore link-like syntax in code (f9bf11b11)
Narrow engines.node in test (5ed9a2691)
Remove unused import (3a8bb0030)

✅ Tests

Relax relative time assertion (256513eb0)
Move build assets dir fixture out of app/ (6d2ac69ff)

🤖 CI

Clean up agent-scan workflow (31590cf07)
Continue autofix workflow when test:engines fails (958abb882)
Improve workflows (#35088)

❤️ Contributors

Daniel Roe (@danielroe)
Julien Huang (@huang-julien)
Damian Głowala (@DamianGlowala)
Sébastien Chopin (@atinux)
Adrien Foulon (@Tofandel)

`v3.21.5`

Compare Source

3.21.5 is the next patch release.

👉 Changelog

compare changes

🔥 Performance

kit: Cache layer roots and short-circuit isIgnored relative (#35015)

🩹 Fixes

nitro: Correct payload route rule for / + override ssr: true (#34990)
nitro: Break recursive rendering deadlocks during prerender (#34939)
vite: Drop redundant css link when entry styles are inlined (#34950)
nuxt: Only force suspense remount after first resolve (#34949)
kit: Read .env before resolving nuxt schema (#34958)
nitro: Preserve serverHandlers array after nitro:config (#34985)
vite: Only consider CSS inlined when styles are actually emitted (#35006)
nuxt: Handle string presets in auto-imports (#35013)
nuxt: Correct island transform for server pages and 'deep' mode (#35005)
vite: Inline css for non-island children of server components (#35001)
nuxt: Defer head DOM updates until page transition finishes (#35016)
nuxt: Explicitly freeze head during island plugin phase (#35010)
vite: Inline css imported from non-vue js modules (#35020)
nitro: Remove unused middleware (fe857d36b)

📖 Documentation

Add warning about routing in server components (#34994)

🏡 Chore

Ignore pnpm cyclic workspace deps warn (#34998)
Remove jiti from build steps (#35004)
Fix lockfile (48e56a509)
nuxt: Cast to nitro event handler type (5b358ca19)

✅ Tests

Extract server components fixture + add some failing tests (#34995)
Isolate buildDir per matrix project for shared fixtures (#35007)
Split env testing into separate file (fd4019cf8)
Use 3.x style tsconfig (86625efad)
Use more 3.x style tsconfigs (4a9bde3f3)
Correct import path (133d5f6d7)
Update snapshots (9fc42f788)

❤️ Contributors

Daniel Roe (@danielroe)
Harlan Wilton (@harlan-zw)
Jonazzzz (@Bombastickj)
Damian Głowala (@DamianGlowala)
Florian Heuberger (@Flo0806)

3.21.1 is a regularly schedule patch release.

👉 Changelog

compare changes

🩹 Fixes

nuxt: Correct reference format of server builder (#34177)
nuxt: Add status/statusText getters to NuxtError (#34188)
schema: Add direnv and vendor to default ignore (#34190)
nuxt: Focus hash links after navigation (#34193)
nuxt: Exclude head runtime from unhead imports transform (#34195)
kit: Include prereleases in semver satisfy check (#34210)
nuxt: Watch server/ for builder:watch hook (#34208)
nitro: Encode unicode paths in x-nitro-prerender header (#34202)
nitro: Preserve error.message for fatal errors (#34226)
Only enable dynamic imports when ts plugin (#34205)
webpack: Use H3Error for 403 in dev server (#34233)
nuxt: Ensure NuxtError extends Error type (#34242)
vite: Use H3Error for 404 in dev server (#34225)
nuxt: Add backwards compat for #app barrel export in keyed functions (#34199)
nuxt: Track + re-add custom routes on hmr (#32044)
nuxt: Keep vnode when leaving deeper nested route (#33778)
vite: Prevent CSS flickering in dev mode after config changes (#33856)
nuxt: Do not start view transition if there is no route (#33723)
nuxt: Call deferHydration done on NuxtPage unmount (#34152)
nuxt: Handle invalid datetime in ` (#33992)
nuxt: Preserve middleware error status in 404 fallback (#34148)
nitro: Do not augment nuxt/schema (#34255)
nuxt: Cache manifest files to preserve buildId (#34002)
nuxt: Don't decode query string in SSR context URL (#34252)
nuxt: Allow specifying moduleDependencies by meta.name (#34263)
nuxt: Resolve #components import mapping conflict for packages outside rootDir (#34139)
vite,webpack: Use node.res to send 403/404 (#34266)
nitro,nuxt: Align path encoding with vue-router (#34265)
nitro: Augment nuxt/schema once more (9f5bb611d)

💅 Refactors

nuxt: Prefer genObjectKey to omit unnecessary quotes (#34245)
nuxt: Use ComponentProps helper to extract layout props (#34248)

📖 Documentation

Remove link to ai guide entirely (084b5d7f2)
Update roadmap dates (#34166)
Clarify shared type context limitations for custom imports (#34194)
Fix broken links (#34223)
Document payload extraction for ISR/SWR routes (#34222)
Update example of email validation (#34247)
Add documentation for keyedComposables (#34201)

🏡 Chore

Remove px from width attribute (e80147f7d)
Add ai config in gitignore (#34220)

✅ Tests

Vitest v4 compatibility (70e147b71)
Add runtime tests for deeply nested <NuxtPage> navigation (707a9dc44)
Resolve merge issues in tests (85abddc54)

❤️ Contributors

Daniel Roe (@danielroe)
Matej Černý (@cernymatej)
Octavio Araiza (@8ctavio)
Muhammad Yasir Ghaffar (@M-YasirGhaffar)
Max (@onmax)
Bobbie Goede (@BobbieGoede)
纸鹿/Zhilu (@L33Z22L11)
Florian Heuberger (@Flo0806)
山吹色御守 (@KazariEX)
ExXTreMe315 (@ExXTreMe315)
Eugene (@FlexIDK)
abeer0 (@iiio2)
Jonas Thelemann (@dargmuesli)
Erwan Jugand (@erwanjugand)

`v3.21.0`

Compare Source

3.21.0 is the next minor release.

Nuxt 4.3 and 3.21 bring powerful new features for layouts, caching, and developer experience – plus significant performance improvements under the hood.

📣 Some News

Extended v3 Support

Early this month, I opened a discussion to find out how the upgrade had gone from v3 to v4. I was really pleased to hear how well it had gone for most people.

Having said that, we're committed to making sure no one gets left behind. And so we will continue to provide security updates and critical bug fix releases beyond the previously announced end-of-life date of January 31, 2026, meaning Nuxt v3 will meet its end-of-life on July 31, 2026.

[!TIP]
As usual, today also brings a minor release for v3, with many of the same improvements backported from v4.3.

Preparing for Nuxt 5

We're closer than ever to the releases of Nuxt v5 and Nitro v3. In the coming weeks, the main branch of the Nuxt repository will begin receiving initial commits for Nuxt 5. However, it's still business as usual.

Continue making pull requests to the main branch
We'll backport changes to the 4.x and 3.x branches

Keep an eye out on the Upgrade Guide – we'll be adding details about how you can already start migrating your projects to prepare for Nuxt v4 with future.compatibilityVersion: 5.

🗂️ Route Rule Layouts

But that's enough about the future. We have a lot of good things for you today!

First, you can now set layouts directly in route rules using the new appLayout property (#31092). This provides a centralized, declarative way to manage layouts across your application without scattering definePageMeta calls throughout your pages.

export default defineNuxtConfig({
  routeRules: {
    '/admin/**': { appLayout: 'admin' },
    '/dashboard/**': { appLayout: 'dashboard' },
    '/auth/**': { appLayout: 'minimal' }
  }
})

This might be useful for:

Admin panels with a shared layout across many routes
Marketing pages that need a different layout from the app

[!TIP]
Plus, you can pass props to layouts now! See the setPageLayout improvements below.

📦 ISR/SWR Payload Extraction

Payload extraction now works with ISR (incremental static regeneration), SWR (stale-while-revalidate) and cache routeRules (#33467). Previously, only pre-rendered pages could generate _payload.json files.

This means:

Client-side navigation to ISR/SWR pages can use cached payloads
CDNs (Vercel, Netlify, Cloudflare) can cache payload files alongside HTML
Fewer API calls during navigation – data can be prefetched and served from the cached payload

export default defineNuxtConfig({
  routeRules: {
    '/products/**': { 
      isr: 3600, // Revalidate every hour
    }
  }
})

🧹 Dev Mode Payload Extraction

Related to the above, payload extraction now also works in development mode (#30784). This makes it easier to test and debug payload behavior without needing to run a production build.

[!IMPORTANT]
Payload extraction works in dev mode with nitro.static set to true, or for individual pages which have isr, swr, prerender or cache route rules.

🚫 Disable Modules from Layers

When extending Nuxt layers, you can now disable specific modules that you don't need (#33883). Just pass false to the module's options:

export default defineNuxtConfig({
  extends: ['../shared-layer'],
  // disable @nuxt/image from layer
  image: false,
})

🏷️ Route Groups in Page Meta

Route groups (folders wrapped in parentheses like (protected)/) are now exposed in page meta (#33460). This makes it easy to check which groups a route belongs to in middleware or anywhere you have access to the route.

<script setup lang="ts">
// This page's meta will include: { groups: ['protected'] }
useRoute().meta.groups
</script>

export default defineNuxtRouteMiddleware((to) => {
  if (to.meta.groups?.includes('protected') && !isAuthenticated()) {
    return navigateTo('/login')
  }
})

This provides a clean, convention-based approach to route-level authorization without needing to add definePageMeta to every protected page.

🎨 Layout Props with `setPageLayout`

The setPageLayout composable now accepts a second parameter to pass props to your layout (#33805):

export default defineNuxtRouteMiddleware((to) => {
  setPageLayout('admin', {
    sidebar: true,
    theme: 'dark'
  })
})

<script setup lang="ts">
defineProps<{
  sidebar?: boolean
  theme?: 'light' | 'dark'
}>()
</script>

🔧 `#server` Alias

A new #server alias provides clean imports within your server directory (#33870), similar to how #shared works:

// Before: relative path hell
import { helper } from '../../../../utils/helper'

// After: clean and predictable
import { helper } from '#server/utils/helper'

The alias includes import protection – you can't accidentally import #server code from client or shared contexts.

🪟 Draggable Error Overlay

The development error overlay introduced in Nuxt 4.2 is now draggable and can be minimized (#33695). You can:

Drag it to any corner of the screen (it snaps to edges)
Minimize it to a small pill button when you want to keep working
Your position and minimized state persist across page reloads

This is a quality-of-life improvement when you're iterating on fixes and don't want the overlay blocking your view.

https://github.com/user-attachments/assets/nuxt_4-3_error_demo.mp4

⚙️ Async Plugin Constructors

Module authors can now use async functions when adding build plugins (#33619):

export default defineNuxtModule({
  async setup() {
    // Lazy load only when actually needed
    addVitePlugin(() => import('my-cool-plugin').then(r => r.default()))
    
    // No need to load webpack plugin if using Vite
    addWebpackPlugin(() => import('my-cool-plugin/webpack').then(r => r.default()))
  }
})

This enables true lazy loading of build plugins, avoiding unnecessary code loading when plugins aren't needed.

🚀 Performance Improvements

This release includes several performance optimizations for faster builds:

Hook filters - Internal plugins now use filters to avoid running hooks unnecessarily (#33898)
SSR styles optimization - The nuxt:ssr-styles plugin is now significantly faster (#33862, #33865)
Layer alias transform - Skipped when using Vite (it handles this natively) (#33864)
Route rules compilation - Route rules are now compiled into a client chunk using rou3, removing the need for radix3 in the client bundle and eliminating app manifest fetches (#33920)

🎨 Inline Styles for Webpack/Rspack

The inlineStyles feature now works with webpack and rspack builders (#33966), not just Vite. This enables critical CSS inlining for better Core Web Vitals regardless of your bundler choice.

⚠️ Deprecations

`statusCode` → `status`, `statusMessage` → `statusText`

In preparation for Nitro v3 and H3 v2, we're moving to use Web API naming conventions (#33912). The old properties still work but are deprecated in advance of v5:

- throw createError({ statusCode: 404, statusMessage: 'Not Found' })
+ throw createError({ status: 404, statusText: 'Not Found' })

🐛 Bug Fixes

Notable fixes in this release:

Fixed head component deduplication using key attribute (#33958, #33963)
Fixed async data properties not being reactive in Options API (#34119)
Fixed useCookie unsafe number parsing during decode (#34007)
Fixed NuxtPage not re-rendering when nested NuxtLayout has layouts disabled (#34078)
Fixed client-side pathname decoding for non-ASCII route aliases (#34043)
Fixed suspense remounting when navigating after pending state (#33991)
Fixed clipboard copy in error overlay (#33873)
Enabled allowArbitraryExtensions by default in TypeScript config (#34084)
Added noUncheckedIndexedAccess to server tsconfig for safer typing (#33985)

[!IMPORTANT]
Enabling noUncheckedIndexedAccess in the Nitro server TypeScript config improves type safety but may surface new type errors in your server code. This change was necessary because Nuxt's app context performs type checks on server routes (learn more).

While we recommend keeping this enabled for better type safety, you can disable it if needed:
export default defineNuxtConfig({
  nitro: {
    typescript: {
      tsConfig: {
        compilerOptions: {
          noUncheckedIndexedAccess: false
        }
      }
    }
  }
})
Note that disabling this may allow type errors to slip through that could cause runtime issues with indexed access.

📚 Documentation

Improved module author guides with clearer structure (#33803)
Added MCP setup instructions for Claude Desktop (#33914)
Added layers directory documentation (#33967)
Added Deno package manager examples (#34070)
Clarified type-checking context limitations for server routes (#33964)

🎉 Nuxt 3.21.0

Alongside v4.3.0, we're releasing Nuxt v3.21.0 with many of the same improvements backported to the 3.x branch. This release includes:

All the same features: Route rule layouts, ISR payload extraction, layout props with setPageLayout, #server alias, draggable error overlay, and more
All performance improvements: SSR styles optimization, hook filters, and route rules compilation
Module disabling: Disable layer modules by setting options to false
Critical bug fixes: Async data reactivity in Options API, useCookie number parsing, head component deduplication, and more

✅ Upgrading

Our recommendation for upgrading is to run:

npx nuxt@latest upgrade --dedupe --channel=v3

This will deduplicate your lockfile and help ensure you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.

[!TIP]
Check out our upgrade guide if upgrading from an older version.

👉 Changelog

compare changes

🚀 Enhancements

kit: Support async constructor for adding plugins (#33619)
kit: Export Nuxt major version type (#33700)
schema: Add #server alias for server directory imports (#33870)
schema: Hoist nitro crossws types (6ff79ea6c)
nitro,nuxt: Compile route rules into client chunk (#33920)
nuxt: Allow disabling modules by setting module options to false (#33883)
kit: Allow specifying moduleDependencies as an async function (#33504)
nuxt: Support appLayout in route rules (#31092)
nuxt: Add route groups to page meta (#33460)
nuxt: Enable payload extraction for ISR/SWR routes (#33467)
nuxt: Allow updating props with setPageLayout (#33805)
nuxt: Enable dragging and minimizing for error overlay (#33695)
nitro,nuxt: Add support for payload extraction in dev (#30784)
rspack,webpack: Add inline styles (#33966)
kit: Add forward-compatible nitro types (#34036)

🔥 Performance

nuxt: Do not init layer alias transform when using vite (#33864)
vite: Add hook filters for ssr styles plugin (#33865)
vite: Optimize nuxt:ssr-styles plugin (#33862)
nuxt: Use filter for vfs plugin load (5bd8e81ed)
nuxt,vite: Use filters to avoid running hooks unnecessarily (e762a1e20)
nuxt,vite: Add more filters to internal plugins (#33898)

🩹 Fixes

kit: Normalize local layer paths with trailing slashes (#33858)
nuxt: Avoid overwriting multiple head input in island handler (#33849)
nuxt: Update meta instead of calling router.replace in page hmr (#33897)
nuxt: Don't call page:loading:end in cache if already called (fbbe10133)
vite: Add error handling for parsing NUXT_VITE_NODE_OPTIONS (8abb7ef5b)
nuxt: Do not skip middleware when appMiddleware references invalid key (ed8bb68c5)
nitro: Clipboard copy in error overlay (#33873)
webpack,rspack: Resolve deep imports in virtual files (#33927)
webpack: Disable async chunks in dev mode (c4bfd0a49)
webpack: Correctly evaluate sourcemap name (93e3d92b9)
nuxt: Handle node10 resolution for nuxt/meta (b748840bc)
nuxt: Do not early return if component priorities conflict (#33955)
nuxt: Use key for tag deduplication in <Head> component (#33958)
schema,vite: Resolve build.transpile when initialising vite (#33868)
nuxt,rspack,webpack: Inject module identifiers for webpack builders (#33962)
nuxt: Add key to head components for proper deduplication (#33963)
nitro: Check prettyResponse.body type before error overlay (#33977)
nuxt: Don't URI-encode static route paths (#33990)
nuxt: Skip internal stub routes from prerender (#34001)
kit,schema: Align module onUpgrade arguments with types (#33988)
nuxt: Handle unsafe number parsing in useCookie decode (#34007)
nuxt: Do not externalise rou3 (7da94e8c3)
nitro: Add noUncheckedIndexedAccess to server tsconfig (#33985)
nuxt: Update global reference to globalThis in useRequestFetch (#33976)
vite: Configure hmr port for server build (#33929)
kit: Add forward compatible nitro v3 types (#34053)
nitro,nuxt: Do not import nitro deps in builders (#34054)
nitro: Add h3 types to auto-imports (#34035)
schema: Add some more directories to ignore (9cb9a19dd)
nitro: Also augment nuxt/schema (9b40196a6)
nuxt: Make asyncData properties reactive in Options API (#34119)
nuxt: Rerender NuxtPage when nested NuxtLayout has explicitly disabled layouts (#34078)
nuxt,schema: Clean up types (5ce351d0f)
nuxt: Allow user augmentation of runtime config (dd30410cb)
kit,nitro: Enable allowArbitraryExtensions by default (#34084)
nuxt: Decode client-side pathname for non-ASCII route aliases (#34043)
nuxt: Force remount suspense when navigating after pending (#33991)
nuxt: Add documentation link to server builder error message (#34122)
nuxt: Validate placeholder/fallback tags + warn about placeholder/fallback props (f7912d3f3)
nuxt: Force flush useAsyncData debounced execute post watcher flush (#34125)
nitro: Process isr/swr/cache keys (7f2bf4d13)
nuxt: Add typeFrom support for imports.d.ts template exports (#34135)
nuxt: Ensure we inline styles for hydrate-never components (#34132)

💅 Refactors

kit: Add explicit return types for kit utilities (ec2239cb4)
nitro,nuxt,schema,vite: Provide explicit return types (2564002de)
kit,nuxt,schema: Use named imports from defu + consola (e31668f67)
Add explicit .ts file extensions to relative imports (458f3c9b6)
kit,nitro,nuxt,schema: Reduce barrels + move <> to as (08f72881e)
nitro,nuxt: Use ~ prefix for internal ssrContext properties (#33896)
nitro: Add explicit return types for runtime utils (74bb6ddeb)
nitro: Move tree-shaken flags from replace plugin -> vfs (#33907)
nitro,nuxt,vite,webpack: Use status/statusText + deprecate old props (#33912)
webpack: Use RuntimeModule API for chunk preloads (#33930)
nuxt: Use AST-aware function key injection (#33446)
nitro,nuxt,schema: Use augments for nitro schema types (#34039)
nitro,rspack,vite,webpack: Move cors handling -> nitro builder (#34048)
nitro: Move to nitropack/runtime namespace (b06d53166)
nitro,nuxt: Move to nitropack/runtime namespace (897a2259f)

📖 Documentation

Fix useHead return type (#33857)
Add correct instructions to upgrade to latest Nuxt 3.x (#33866)
Improve grammar (#34093)
Use h2 for nuxt add command page (a0a1763d5)
Update links to module guide (c9c1282f8)
Split and improve Module Author Guides (#33803)
Split directory structure and re-order guides (v4) (#33691)
Add mcp server and llms.txt (#33371)
Add note that middleware doesn't run when rendering islands (d22cf7903)
Add note on default branch for layers (#33919)
Add mcp setup instructions for claude desktop (#33914)
Mention deno as package manager (#33875)
Clarify purpose of statusText (#32834)
Update lychee config and remove medium article link (36c19ce73)
Update module count and fix typo (#33950)
Add DeepWiki badge (#33508)
Give example of usage of defineWrappedResponseHandler (#33952)
Provide cleaner example code for vitest projects (#33960)
Update yarn create command (b30432979)
Update roadmap with a11y (7ea35137c)
Add a11y release (#34041)
Remove Nuxtr from recommendations (#34045)
Remove duplicate feature (#34058)
Provide deno package manager examples (#34070)
Make custom wrapper recipe link more prominent (#34085)
nuxt: Mention custom serializers in useState docs (#34105)
Clarify module setups in .nuxtrc example (#34107)
Add layers directory documentation (#33967)
Add a tip for appLayout (9b78698c3)
Add docs for disabling modules by passing false to its options (18500730c)
Add info about caching payloads with isr/swr (4b055548e)
Add example for async addVitePlugin (4407f6862)
Add example of passing props to layouts (401aa90ab)
Mark vite plugin as not typed (25eae7699)
Add warning about source from <NuxtIsland> (08778c98c)
Sync with main branch (e8c04aaa6)
Fix ai guide link (01c173b78)

📦 Build

Remove babel debugging plugin from jiti stub options (1ec010681)
vite: Add build entries for vite-node entrypoints (#33893)
nuxt: Tidy up subpath export types (fe92e9c17)
Use obuild except for nuxt + nitro-server packages (#34049)
schema: Fix /builder-env subpath types (1951648fa)

🏡 Chore

Add return types to debug plugins (1d4f9a3ae)
Add build:stub command for those that need it (c682b2681)
Revert change to how type augments are inserted (6a238b576)
Do not require aligned columns in tables ([d8a90b3d5](https://redirect.github.com/nuxt/nuxt/commi

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coderabbitai · 2024-08-05T22:50:22Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5bdb283c-41d3-4c42-a9e5-6a6ccba43003

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

📝 Walkthrough

Walkthrough

The upgrade from Nuxt.js version 2.15.8 to 3.12.4 marks a pivotal enhancement in the framework's architecture, transitioning to Vue 3. This change boosts performance, improves server-side rendering, and enriches the developer experience. While it opens the door to new features, it may also require code adjustments to maintain compatibility. A careful review of the application's structure and functionality is advisable to fully harness the benefits of this upgrade.

Changes

Files	Change Summary
`nuxt/package.json`	Upgraded Nuxt.js from `2.15.8` to `3.12.4`

Poem

🐇 In the garden of code where rabbits play,
A new version hops in, brightening the day.
With Vue 3's magic, oh what a delight!
So let’s leap and code, from morning to night.
Hooray for the changes, let our apps soar,
A future so bright, we can’t help but explore! 🌟

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch renovate/npm-nuxt-vulnerability

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 0

Review details

Configuration used: CodeRabbit UI
Review profile: CHILL

Commits

Files that changed from the base of the PR and between 5b83d11 and 15d2871.

Files ignored due to path filters (1)

nuxt/package-lock.json is excluded by !**/package-lock.json

Files selected for processing (1)

nuxt/package.json (1 hunks)

Additional comments not posted (1)

nuxt/package.json (1)

35-35: Approve the Nuxt version upgrade but verify compatibility and code adjustments.

The upgrade from Nuxt.js version 2.15.8 to 3.12.4 is necessary to address the security vulnerability (CVE-2024-34343) and introduces significant improvements. However, this major version upgrade may impact compatibility with other dependencies and require code adjustments. Ensure to verify compatibility and make necessary code adjustments to fully leverage the benefits of Nuxt 3.

codecov · 2026-08-21T01:41:25Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.54%. Comparing base (8a1ba81) to head (078ceb4).

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #117      +/-   ##
===========================================
+ Coverage    90.24%   90.54%   +0.29%     
===========================================
  Files           13        9       -4     
  Lines         2132     2125       -7     
  Branches       103      103              
===========================================
  Hits          1924     1924              
+ Misses         203      196       -7     
  Partials         5        5

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

renovate · 2026-08-26T21:08:14Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: nuxt/package-lock.json

npm ERR! Cannot read properties of null (reading 'edgesOut')

npm ERR! A complete log of this run can be found in:
npm ERR!     /runner/cache/others/npm/_logs/2026-08-26T21_07_46_486Z-debug-0.log

coderabbitai Bot reviewed Aug 5, 2024

View reviewed changes

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch 2 times, most recently from 9e240c5 to e135577 Compare August 13, 2025 14:54

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch from e135577 to 1afe030 Compare August 19, 2025 16:09

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch from 1afe030 to eb8cb06 Compare August 31, 2025 11:27

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch from eb8cb06 to d4d9b41 Compare September 25, 2025 16:13

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch from d4d9b41 to b970f57 Compare October 21, 2025 20:35

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch from b970f57 to 4e156c5 Compare November 10, 2025 19:03

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch from 4e156c5 to e0a61b3 Compare November 18, 2025 22:56

renovate Bot changed the title ~~chore(deps): update dependency nuxt to v3 [security]~~ chore(deps): update dependency nuxt to v3 [security] - autoclosed Nov 19, 2025

renovate Bot closed this Nov 19, 2025

renovate Bot deleted the renovate/npm-nuxt-vulnerability branch November 19, 2025 17:52

renovate Bot changed the title ~~chore(deps): update dependency nuxt to v3 [security] - autoclosed~~ chore(deps): update dependency nuxt to v3 [security] Nov 19, 2025

renovate Bot reopened this Nov 19, 2025

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch 2 times, most recently from e0a61b3 to 1b4616c Compare November 19, 2025 20:34

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch from 1b4616c to ce80d86 Compare December 3, 2025 19:47

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch from ce80d86 to 4d24ef0 Compare December 31, 2025 17:39

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch from 4d24ef0 to e69b685 Compare January 8, 2026 16:51

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch from e69b685 to 910e643 Compare January 19, 2026 16:08

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch from 910e643 to 57a9a85 Compare February 2, 2026 17:31

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch 2 times, most recently from cd57e99 to 691fd34 Compare February 17, 2026 19:06

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch from 691fd34 to b535233 Compare March 5, 2026 19:11

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch from b535233 to c265058 Compare March 13, 2026 17:36

renovate Bot changed the title ~~chore(deps): update dependency nuxt to v3 [security]~~ chore(deps): update dependency nuxt to v3 [security] - autoclosed Mar 27, 2026

renovate Bot closed this Mar 27, 2026

renovate Bot changed the title ~~chore(deps): update dependency nuxt to v3 [security] - autoclosed~~ chore(deps): update dependency nuxt to v3 [security] Mar 30, 2026

renovate Bot reopened this Mar 30, 2026

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch 2 times, most recently from 11c184f to a88dc9f Compare April 1, 2026 18:13

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch from a88dc9f to bfef0f3 Compare April 8, 2026 21:04

renovate Bot changed the title ~~chore(deps): update dependency nuxt to v3 [security]~~ chore(deps): update dependency nuxt to v3 [security] - autoclosed Apr 27, 2026

renovate Bot closed this Apr 27, 2026

renovate Bot changed the title ~~chore(deps): update dependency nuxt to v3 [security] - autoclosed~~ chore(deps): update dependency nuxt to v3 [security] Apr 27, 2026

renovate Bot reopened this Apr 27, 2026

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch 2 times, most recently from 6500997 to 304cc5f Compare April 29, 2026 14:08

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch 2 times, most recently from 4549204 to daceb68 Compare May 18, 2026 10:53

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch 2 times, most recently from 1af63d8 to ddd2f4d Compare June 1, 2026 22:58

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch from ddd2f4d to 37c4570 Compare June 11, 2026 16:52

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch 2 times, most recently from 837bbfb to 752a3e0 Compare July 17, 2026 10:59

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch 2 times, most recently from a846f98 to 199bec0 Compare July 24, 2026 18:05

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch from 199bec0 to dea72f4 Compare July 30, 2026 18:35

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch 2 times, most recently from 3244cd0 to c5be67d Compare August 14, 2026 22:16

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch from c5be67d to 3a0c944 Compare August 20, 2026 02:23

Decipher mentioned this pull request Aug 21, 2026

chore(deps): combine the passing dependency updates #150

Merged

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch from 3a0c944 to 7e4634b Compare August 21, 2026 01:40

chore(deps): update dependency nuxt to v3 [security]

078ceb4

renovate Bot force-pushed the renovate/npm-nuxt-vulnerability branch from 7e4634b to 078ceb4 Compare August 26, 2026 21:07

Navigation Menu

Uh oh!

chore(deps): update dependency nuxt to v3 [security] - #117

chore(deps): update dependency nuxt to v3 [security]#117
renovate[bot] wants to merge 1 commit into
developfrom
renovate/npm-nuxt-vulnerability

renovate Bot commented Aug 5, 2024 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 5, 2024 •

edited

Loading

Review skipped

Walkthrough

Changes

Poem

Uh oh!

coderabbitai Bot left a comment

Uh oh!

codecov Bot commented Aug 21, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Aug 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Aug 5, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

nuxt vulnerable to Cross-site Scripting in navigateTo if used after SSR

Details

Summary

Details

PoC

Impact

Recommendations

Note

Severity

References

Cross-site scripting via slot content in Nuxt's head components

Details

Impact

Affected versions

Patches

Workarounds

Credit

Severity

References

Release Notes

v3.21.7

👉 Changelog

🩹 Fixes

📖 Documentation

🏡 Chore

✅ Tests

🤖 CI

❤️ Contributors

v3.21.6

👉 Changelog

🩹 Fixes

💅 Refactors

📖 Documentation

🏡 Chore

✅ Tests

🤖 CI

❤️ Contributors

v3.21.5

👉 Changelog

🔥 Performance

🩹 Fixes

📖 Documentation

🏡 Chore

✅ Tests

❤️ Contributors

v3.21.4

v3.21.2

v3.21.1

👉 Changelog

🩹 Fixes

💅 Refactors

📖 Documentation

🏡 Chore

✅ Tests

❤️ Contributors

v3.21.0

📣 Some News

Extended v3 Support

Preparing for Nuxt 5

🗂️ Route Rule Layouts

📦 ISR/SWR Payload Extraction

🧹 Dev Mode Payload Extraction

🚫 Disable Modules from Layers

🏷️ Route Groups in Page Meta

🎨 Layout Props with setPageLayout

🔧 #server Alias

🪟 Draggable Error Overlay

⚙️ Async Plugin Constructors

🚀 Performance Improvements

🎨 Inline Styles for Webpack/Rspack

⚠️ Deprecations

statusCode → status, statusMessage → statusText

🐛 Bug Fixes

📚 Documentation

🎉 Nuxt 3.21.0

✅ Upgrading

renovate Bot commented Aug 5, 2024 •

edited

Loading

`v3.21.7`

`v3.21.6`

`v3.21.5`

`v3.21.4`

`v3.21.2`

`v3.21.1`

`v3.21.0`

🎨 Layout Props with `setPageLayout`

🔧 `#server` Alias

`statusCode` → `status`, `statusMessage` → `statusText`

coderabbitai Bot commented Aug 5, 2024 •

edited

Loading

codecov Bot commented Aug 21, 2026 •

edited

Loading