Skip to content

chore(deps): update nuxt core - #1500

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/nuxt
Open

chore(deps): update nuxt core#1500
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/nuxt

Conversation

@renovate

@renovate renovate Bot commented Jul 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@nuxt/cli (source) 3.35.2 → 3.37.0 age confidence
@nuxt/kit (source) 4.5.0 → 4.5.2 age confidence
@nuxt/module-builder 1.0.2 → 1.0.3 age confidence
@nuxt/schema (source) 4.4.7 → 4.5.2 age confidence
@nuxt/test-utils 4.0.3 → 4.1.0 age confidence
nuxt (source) 4.4.7 → 4.5.2 age confidence
vue (source) 3.5.40 → 3.5.41 age confidence

Release Notes

nuxt/cli (@​nuxt/cli)

v3.37.0

Compare Source

v3.37.0 is the next minor release.

👉 Changelog

compare changes

🚀 Enhancements
  • typecheck: add Golar support (#​1362)
  • init: recognize nub package manager (#​1360)
🤖 CI
  • migrate agentscan-action to v2 (7fc085b)
  • add agent-scan workflow to flag bot-authored PRs (18b4417)
❤️ Contributors

v3.36.1

Compare Source

v3.36.1 is a hotfix release to address a change in vite v8.1.

👉 Changelog

compare changes

🩹 Fixes
  • dev: set hmr server on server.ws (vite 8.1+) (#​1355)
❤️ Contributors

v3.36.0

Compare Source

v3.37.0 is the next minor release.

Timetable: to be announced.

👉 Changelog

compare changes

🚀 Enhancements
  • module: add module remove command (#​1306)
  • init: add non-interactive mode (#​1341)
  • init: allow installing deps with aube (#​1348)
  • typecheck: prompt to install vue-tsc and typescript (#​1316)
🩹 Fixes
  • init: use template's package manager instead of prompting (#​1330)
  • dev: reload on changes to local layer nuxt.config files (#​1345)
  • convert errors to string before logging (ee31f82)
✅ Tests
🤖 CI
  • pass package paths to release action (f123be8)
  • use uppt for trusted + staged publishing workflow (#​1338)
🎉 New Contributors
❤️ Contributors
nuxt/nuxt (@​nuxt/kit)

v4.5.2

Compare Source

4.5.2 is the next patch release.

👉 Changelog

compare changes

🔥 Performance
  • nuxt,kit: Skip rewriting unchanged generated files (#​35902)
  • kit,nuxt: Use lazy imports to improve parsing speed (#​35901)
  • vite: Skip html entry probes in bare-import resolver (#​35907)
  • nuxt: Reuse app and component scans for unchanged structures (#​35912)
🩹 Fixes
  • vite: Resolve client manifest path from resolved config (#​35883)
  • nuxt: Use client-side navigation for links inside islands (#​35806)
  • nuxt: Generate types for route params defined with definePageMeta (#​35857)
  • nuxt: Serialize island payloads for components with underscores in keys (#​35807)
  • nitro: Dedupe island renders when prerendering (#​35835)
  • nuxt: Drop prefetch hints for never-hydrated chunks (#​35812)
  • vite: Use same asset filenames for worker builds (#​35866)
  • nitro: Reject non-object island props (#​35867)
  • nuxt: Support options api in v-for islands transform (#​35877)
  • nuxt: Improve page meta extraction + performance (#​35869)
  • nuxt: Set build outputs when restoring vue cache (#​35895)
  • kit: Honour nested apply and applyToEnvironment in vite wrapper (#​35899)
  • nuxt: Re-check for preview mode after prerendered page hydration (#​35886)
  • kit,nuxt,vite: Handle missed chokidar watch events (#​35887)
  • nuxt: Settle asyncData status when bailing (#​35908)
  • kit: Clone resolved config with klona rather than klona/full (#​35914)
  • kit: Honour nested plugins' enforce in vite wrapper (#​35916)
  • nuxt: Collect build cache once build outputs are final (#​35929)
  • vite: Resolve vite env api sourcemaps in vite-node (#​35758)
  • nuxt: Don't warn about missing <NuxtPage> on nav + with slot (#​35948)
  • kit: Prepend vite environment wrapper plugin when prepend is set (#​35942)
  • nuxt: Depend on rolldown as a peer to reuse vite's copy (3fda97f60)
  • nitro: Define import.meta.test for server code (#​35987)
  • nuxt: Match route rules against decoded paths (9123ed850)
💅 Refactors
  • nuxt: Use vue-component-type-helpers instead of locally maintained helpers (#​35840)
  • nuxt: Use isReferenceIdentifier in page-meta plugin (#​35882)
📖 Documentation
  • Sync mcp server page with live tools and providers (#​35856)
  • Add server components guide and mostly-static site recipe (#​35778)
  • Minor changes (#​33479)
  • Add accessible routing guide (#​34796)
  • Update testing guide to test-utils v4.1.0 (#​35873)
  • Update .env provider reference from dotenv to c12 (#​35911)
  • Add note to avoid using defineVitestProject in e2e tests (#​35926)
  • Update roadmap (f6e6027fe)
📦 Build
  • ui-templates: Copy generated templates from resolved output dir (#​35921)
🏡 Chore
✅ Tests
🤖 CI
  • Shard the critical-path test jobs and cache playwright (#​35832)
  • Add action to notify issues resolved on release (5fffe5718)
  • Make notification script more resilient (5337bd357)
  • Do not comment on issues in other repos (400dfdc11)
  • Add explicit permissions: {} to workflows (2e1a1cbeb)
  • Rebalance windows e2e matrix (dffe13742)
  • Let contributors know prs are backported (3e416c54f)
  • Regenerate templates in autofix job (95d33637f)
❤️ Contributors

v4.5.1

Compare Source

⚠️ This is a security release. We recommend upgrading as soon as possible with npx nuxt upgrade --dedupe.

It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, cross-user payload disclosure on cached pages, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.

If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.

If you use the cache, swr or isr route rules, purge any CDN or edge cache after upgrading; a leaked _payload.json may already be cached upstream.

Full details: Nuxt Security Patch Releases and GitHub Security Advisories.

👉 Changelog

compare changes

🔥 Performance
  • nitro: Replace island teleports in a single html pass (#​35515)
  • nuxt: Add vue.optionsApi and disable it for v5+ (#​35791)
  • nuxt: Without pages, skip client plugins that require routing (#​35794)
  • nuxt: Skip payload revival plugin when ssr: false (#​35782)
🩹 Fixes
  • nitro: Read rspack dev output fs lazily for server entry (#​35740)
  • rspack,webpack: Resolve loaders and runtime deps from nuxt dirs (#​35568)
  • nuxt: Return global route for useRoute in detached effect scope (#​35659)
  • nuxt: Ignore custom name or path when reusing an existing page in pages:extend (#​35661)
  • nuxt: Render client components in nested server components (#​35669)
  • nuxt: Preserve explicit useFetch method inference (#​35671)
  • nuxt: Revalidate cached route payloads instead of using force-cache (#​35672)
  • nuxt: Correct default export detection in plugin metadata (#​35676)
  • nuxt: Clear hide/reset timeouts in set() (#​35534)
  • kit,nuxt,rspack,schema,webpack: Add .mts file extension in resolver (#​33845)
  • nuxt: Preserve trailing slash in NuxtLink href when unset (#​35501)
  • nuxt: Don't cross-pollute useAsyncData cache on reactive key change (#​35656)
  • nuxt: Filter plugin dependencies by build target (#​35682)
  • nuxt: Reload real page module on HMR of JSX render-function pages (#​35678)
  • nuxt: Resolve @unhead/vue/* from nuxt's dependency tree (#​35690)
  • kit: Surface module load errors instead of masking as missing (#​35497)
  • nuxt: Type auto-imported $fetch with nitro's $Fetch (#​35704)
  • nuxt: Don't reference app config sources in shared and node tsconfigs (#​35673)
  • vite: Resolve SSR inlined CSS module class name mismatch (#​35610)
  • nuxt: Generate layout types even when pages module is disabled (#​35717)
  • nitro: Skip resource hints for stylesheets already rendered as blocking links (#​35691)
  • kit: Dedupe layers that are both auto-scanned and explicitly extended (#​35712)
  • nuxt: Don't apply scroll behaviour after a subsequent nav (#​35719)
  • vite: Ensure server sourcemap-preserver plugin actually runs (#​35680)
  • vite: Preserve css suffix when extracting ssr inline styles (#​35714)
  • nuxt: Watch external component directories in development (#​35652)
  • nuxt: Don't exclude client entry module from style extraction (#​35720)
  • nuxt: Amend cleanup command in NUXT_B7014 error message (#​35735)
  • nuxt: Only pull in vue-router when there are island pages (#​35739)
  • vite: Suppress external warnings for internal vite-node paths (#​35744)
  • nuxt: Use scope-aware oxc parser for auto-imports (#​35743)
  • nuxt: Sync layout meta during middleware on SSR (#​35633)
  • nitro: Add alias for h3 that pins it to the version nuxt depends on (#​35774)
  • nuxt: Preserve query params in cached payload extraction (#​35696)
  • nuxt: Mirror runtime route tree in generated typed-router types (#​35788)
  • nuxt: Warn when an imports preset from cannot be resolved (#​35799)
  • kit: Avoid mutating layer configs when resolving options (#​35729)
  • nuxt: Convert inline route rules exactly or drop with a warning (#​35455)
  • nitro,nuxt,vite: Dedupe and normalise global css links in dev (#​35834)
  • vite: Register template HMR plugin on dev servers (929c6c138)
  • nuxt: Remove dev error overlay when error is cleared (#​35821)
  • rspack,webpack: Resolve bundled postcss defaults from builder (#​35823)
  • schema: Normalise slashes in app.buildAssetsDir (#​35833)
  • nitro: Bound island props and v-for to prevent unauthenticated DoS (4e35ae9ba)
  • nitro: Confine runtime payload cache to prerendering (ac9b41a36)
  • nuxt: Case-fold route rule keys to match folded lookups (ad624a75a)
  • nitro: Require loopback peer for chrome devtools workspace endpoint (0769c4f9b)
  • nuxt: Reject reserved template island prop under runtime compiler (ee6c84633)
  • nuxt: Reject top-level as prop for islands (581651ff3)
💅 Refactors
  • nuxt: Use tick based debounce for asyncData executes (#​34151)
  • kit,nuxt: Replace semver with verkit (#​35713)
  • rspack,webpack: Use DI model to split builders (#​35751)
📖 Documentation
  • Add dev container setup guide (#​35665)
  • Fix dev container setup guide (#​35666)
  • Add explanation of 200.html and 404.html SPA fallbacks (#​34483)
  • Expand payload extraction documentation (#​35648)
  • Clarify NuxtLink componentName is the internal (devtools) name (#​35658)
  • Add example for components dir pattern option (#​35663)
  • Require a single root element (#​35677)
  • Add reason for why you should never import Vue app code in nitro code (#​34481)
  • Document disabling code-splitting with codeSplitting: false (#​35683)
  • Document nuxt-client caveat for non-SFC components (#​35654)
  • Clarify favicon does not use cdnURL by default (#​35681)
  • Standardize section order and headings across docs (#​35685)
  • Clarify onPrehydrate example comment (#​35684)
  • Add useId as a known limitation of nuxt island (#​35693)
  • Recommend status over pending in data fetching (#​35694)
  • Fill gaps in API minimalVersion badges after #​34485 (#​35708, #​34485)
  • Explain dynamic asset paths (#​35695)
  • Document runtimeConfig env var casting edge cases (#​35709)
  • Clarify module dependency resolution (#​35718)
  • Add more writing guidelines (#​35662)
  • Add note with alternatives to using remote layers (#​35721)
  • Use nuxt rather than nuxi (8891e179c)
  • Document relative baseURL workarounds (#​34004)
  • Warn about runtimeCompiler security best practices (449b63ab1)
  • Warn about validating server component props (2c981cb07)
📦 Build
  • nitro: Re-export type from augments to preserve module (dac937675)
  • nuxt: Remove .ts file extension from runtime/ imports (#​35689)
  • ui-templates: Commit generated ui template files (#​35770)
🏡 Chore
  • Add extension 🤦 (d595fb3d4)
  • Move to pnpm catalogs (#​35748)
  • Update knip config, resolve issues, and run in ci (#​35742)
  • Ignore @nuxt/telemetry in knip (9824d4f10)
  • ui-templates: Pass config file path to unocss (34e7a810d)
  • Allow regenerating lockfile in release script (c31389df3)
  • nuxt: Bump @nuxt/devtools to v3.3.1 (#​35815)
  • Ensure types are setup before unit tests (784d8f700)
  • Simplify knip configuration (#​35827)
✅ Tests
  • Reproduce duplicate CSS in shared chunks (#​35649)
  • Prepare fixtures automatically before fixture and e2e runs (e8b3e6411)
  • Improve and refactor basic fixture (#​35687)
  • Slim down client-only, chunk-error and axis-independent suites (#​35706)
  • Do not run type checking when benchmarking nuxt build (6355f3bc9)
  • kit: Scope loadNuxt temp dir so it doesn't delete sibling fixtures (37301dd51)
  • Guard against transient undefined _route in gotoPath (ca92d082b)
  • Retry fixture prepare on transient ENOTEMPTY (3a6b59f96)
  • Raise route-HMR polling timeout to reduce e2e flakiness (01dc27b7e)
  • Update bundle size snapshot (30d24817c)
🤖 CI
  • Rebalance shards and drop non-vite windows fixtures (#​35700)
  • Warm windows dependency cache on main (#​35730)
  • Run knip in default and production modes (#​35745)
  • Run knip on pull requests (d620aa972)
  • Prepare tests (c7bf7f738)
  • Also prepare tests in knip job (58f68bd64)
  • Check internal docs links on pull requests and all links weekly (#​35767)
❤️ Contributors
nuxt/module-builder (@​nuxt/module-builder)

v1.0.3

Compare Source

v1.0.3 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes
  • update command defaults and descriptions (#​677)
📦 Build
🏡 Chore
  • migrate to pnpm v11 (#​738)
  • remove shamefully-hoist (#​580)
  • migrate resolutions/pnpm.overrides to pnpm-workspace.yaml (cfb45fb)
  • migrate npm badges and links to npmx.dev (afcf2fa)
  • revert pnpm trust policy and restore provenance action (aeb1d38)
  • update pnpm to 10.21 and enable trust policy (92eb2af)
✅ Tests
  • accept nuxt/app specifier for NuxtError in snapshot (809c89f)
  • update v4.5 error type as well (9412c91)
  • accept either #app or nuxt/app in generated declarations (#​727)
🤖 CI
  • use uppt release workflow (604d5b3)
  • add agent-scan workflow to flag bot-authored PRs (4442a14)
  • rename workflow (f7be1a6)
  • avoid checkout in reproduction (57e7ce9)
  • pin github actions to full-length commit shas (c3c8e72)
  • add provenance action to check for downgrades in provenance (d87d217)
  • run tests on node 20 (54c5f13)
🎉 New Contributors
❤️ Contributors
nuxt/test-utils (@​nuxt/test-utils)

v4.1.0

Compare Source

4.1.0 is the next minor release.

👉 Changelog

compare changes

🚀 Enhancements
  • e2e: Silence server logs and allow customising log level (#​1735)
  • runtime: Improve app.root and app.teleports html tag setup (#​1726)
🩹 Fixes
  • e2e: Add warning message for e2e in nuxt vitest setup (#​1691)
  • runtime-utils: Ensure RouterLink stub works with pages: false (#​1687)
  • config: Patch ssr.resolve.conditions to remove import (#​1732)
  • config: Browser setup in defineVitestProject (#​1724)
  • config: Inline config for useRuntimeConfig() composable (#​1737)
  • config: Nested browser-mode Nuxt Vitest projects with viteEnvironmentApi (#​1708)
📦 Build
🏡 Chore
  • Drop pkg.pr.new nitro resolution (#​1681)
  • Migrate to pnpm v11 (#​1701)
  • Move h3-next to optional dependencies (#​1733)
✅ Tests
  • Add test for autoImport: false (#​1688)
🤖 CI
  • Add agent-scan workflow to flag bot-authored PRs (13dd49cde)
  • Migrate agentscan-action to v2 (08f8ee220)
❤️ Contributors
vuejs/core (vue)

v3.5.41

Compare Source

Bug Fixes

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from danielroe as a code owner July 18, 2026 23:40
@netlify

netlify Bot commented Jul 18, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for nuxt-sanity-module ready!

Name Link
🔨 Latest commit e136203
🔍 Latest deploy log https://app.netlify.com/projects/nuxt-sanity-module/deploys/6a77851b8a123f00076a4eb4
😎 Deploy Preview https://deploy-preview-1500--nuxt-sanity-module.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@pkg-pr-new

pkg-pr-new Bot commented Jul 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/@nuxtjs/sanity@1500

commit: 39a517d

@renovate
renovate Bot force-pushed the renovate/nuxt branch from 57ce361 to 411eff2 Compare July 19, 2026 20:19
@renovate
renovate Bot force-pushed the renovate/nuxt branch from 411eff2 to 3d2bb49 Compare August 8, 2026 19:00
@danielroe
danielroe added this pull request to the merge queue Aug 8, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to a conflict with the base branch Aug 8, 2026
@renovate
renovate Bot force-pushed the renovate/nuxt branch from 3d2bb49 to e136203 Compare August 8, 2026 19:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@danielroe danielroe danielroe approved these changes

Assignees

No one assigned

Labels

chore dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@danielroe