Skip to content

chore: Update all non-major dependencies - #258

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore: Update all non-major dependencies#258
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence Type Update
@graphql-tools/graphql-tag-pluck (source) ^8.3.33 → ^8.3.35 age adoption passing confidence devDependencies patch
@iconify-json/lucide ^1.2.117 → ^1.2.121 age adoption passing confidence dependencies patch
@​nuxt/icon ^2.3.1 → ^2.4.1 age adoption passing confidence dependencies minor
@nuxt/image (source) ^2.0.0 → ^2.1.0 age adoption passing confidence dependencies minor
@nuxt/kit (source) ^4.4.8 → ^4.5.1 age adoption passing confidence dependencies minor
@nuxt/module-builder ^1.0.2 → ^1.0.3 age adoption passing confidence devDependencies patch
@nuxt/schema (source) ^4.4.8 → ^4.5.1 age adoption passing confidence devDependencies minor
@nuxt/test-utils ^4.0.3 → ^4.1.0 age adoption passing confidence devDependencies minor
@nuxt/ui (source) ^4.9.0 → ^4.10.0 age adoption passing confidence dependencies patch
@nuxtjs/i18n (source) ^10.4.1 → ^10.6.0 age adoption passing confidence dependencies minor
actions/checkout v7.0.0 → v7.0.1 age adoption passing confidence action patch
docus ^5.12.2 → ^5.12.3 age adoption passing confidence dependencies patch
eslint (source) ^10.7.0 → ^10.8.0 age adoption passing confidence devDependencies minor
eslint (source) ^10.6.0 → ^10.8.0 age adoption passing confidence devDependencies minor
giget ^3.3.0 → ^3.3.1 age adoption passing confidence dependencies patch
happy-dom ^20.10.6 → ^20.11.1 age adoption passing confidence devDependencies minor
knip (source) ^6.26.0 → ^6.31.0 age adoption passing confidence devDependencies minor
minimatch ^10.2.5 → ^10.2.6 age adoption passing confidence dependencies patch
node 24.18.0 → 24.19.0 age adoption passing confidence uses-with minor
nuxt (source) ^4.4.8 → ^4.5.1 age adoption passing confidence dependencies minor
nuxt (source) ^3.21.8 → ^3.21.10 age adoption passing confidence dependencies patch
nuxt (source) ^4.4.8 → ^4.5.1 age adoption passing confidence devDependencies minor
pnpm (source) 11.5.3 → 11.20.0 age adoption passing confidence packageManager minor
pnpm/action-setup v6.0.9 → v6.0.10 age adoption passing confidence action patch
reka-ui ^2.10.0 → ^2.10.1 age adoption passing confidence dependencies patch
tailwindcss (source) ^4.3.1 → ^4.3.3 age adoption passing confidence dependencies patch
vite (source) ^8.1.4 → ^8.2.0 age adoption passing confidence devDependencies minor
vue (source) ^3.5.39 → ^3.5.40 age adoption passing confidence dependencies patch
vue-tsc (source) ^3.3.7 → ^3.3.9 age adoption passing confidence devDependencies patch

Release Notes

ardatan/graphql-tools (@​graphql-tools/graphql-tag-pluck)

v8.3.35

Compare Source

Patch Changes

v8.3.34

Compare Source

Patch Changes
nuxt/image (@​nuxt/image)

v2.1.0

Compare Source

v2.1.0 is the next minor release.

👀 Highlights

Nuxt Image 2.1 ships eight new image providers, a major upgrade to our image processing engine, and a bunch of fixes across existing providers.

🖼️ IPX v4

Under the hood, we've upgraded to IPX v4 which brings significant improvements:

  • Smaller bundles: IPX is now ESM-only with reduced dependency size
  • Stronger SVG security: SVG sanitization now always runs, regardless of optimization settings. This fixes a potential XSS vector where svgo: false would return untouched SVGs. The sanitizer now removes SMIL attribute injection, foreign content (<foreignObject>, <iframe>, etc.), and unsafe URIs across all elements
  • New image modifiers: opacity, brightness, saturation, hue, lightness, autoorient, dilate, erode, clahe, and linear
  • Better error messages: Invalid modifier arguments now return 400 errors with clear messages instead of cryptic 500s
  • Custom URL parsing: IPX now supports custom URL formats via the parseURL option
🌐 New Providers

This release adds support for eight new image optimization services:

🔧 Provider Improvements
  • Directus: Added support for sharp transforms and a key modifier for named presets (#​2207)
  • Sanity: Support for absolute URLs with automatic project/dataset extraction (#​2274), and a configurable baseURL for custom CDN setups (#​2273)
  • AWS Amplify & Vercel: minimumCacheTTL is now configurable (#​2278)
📦 Type Exports

NuxtImgProps and NuxtPictureProps are now exported from the runtime, making it easier to type your own components that wrap <NuxtImg> or <NuxtPicture> (#​2115).

import type { NuxtImgProps, NuxtPictureProps } from '#image'

👉 Changelog

compare changes

🚀 Enhancements
  • deps: migrate to ipx v4 (#​2094)
  • provider: add EdgeOne Pages provider (#​2173)
  • imgproxy: add provider (#​2117)
  • directus: add sharp transforms & key modifier (#​2207)
  • sanity: support absolute URLs with project and dataset extraction (#​2274)
  • awsAmplify,vercel: make minimumCacheTTL configurable (#​2278)
  • sanity: add configurable baseURL option to Sanity provider (#​2273)
  • runtime: export Picture and Image props types (#​2115)
  • umbraco: add image provider (#​2165)
  • flyimg: add Flyimg built-in provider (#​2125)
  • cloudflareimages: add new provider (#​2100)
  • builderio: add Builder.io Image API provider (#​2050)
  • picsum: add Lorem Picsum placeholder image provider (#​2106)
  • supabase: add image provider (#​2027)
🩹 Fixes
  • flyimg: encode all # characters in color values (137ee63)
  • remove duplicated provider key in generated image options (#​2279)
  • nuxt-picture: align preload link type with unhead v3 (#​2254)
  • github: set max size of 460 (7e561f6)
  • umbraco: shallow clone modifiers before modifying (237e480)
  • cloudflare: add baseURL for urls with no operations (#​2162)
  • nuxt-img: set imagesrcset preload when densities are set w/o sizes (#​2176)
  • fastly: handle absolute URLs and merge preexisting query params (#​2140)
  • ipx: merge user-defined runtimeConfig.ipx with defaults (#​2134)
  • directus: add withoutEnlargement modifier type (#​2133)
  • shopify: merge preexisting query params with modifiers (#​2135)
  • reduce max-width breakpoint values by 1px (#​2132)
  • netlifyImageCdn,netlifyLargeMedia: set netlify remote_images config (#​2086)
  • deduplicate formats (#​2038)
  • sanitise custom provider import names (#​2092)
  • guard access from layer.config.image (23b8cef)
  • bunny: merge query params with existing image src (#​2054)
  • do not shadow custom provider types with builtins (#​2016)
  • nuxt-picture: allow data-* in imgAttrs (#​2017)
  • resolve public/ dir in relation to rootDir (3e07761)
📖 Documentation
  • sanity: document baseURL option (6f59ab1)
  • shopify: update NuxtImg syntax to use v-bind for modifiers (#​2277)
  • update list of auto-detected providers (#​2147)
  • add sharp cross-platform installation section (#​2142)
  • add preload example for NuxtImg (#​2124)
  • exempt patterns from cf _routes.json (#​2136)
  • update placeholder attributes in <NuxtImg /> example (#​2074)
  • add nuxt.care health badge (93de8a9)
  • update docus and add mcp name (#​2080)
  • reference from Vercel's Edge Network to Vercel's CDN for image optimization. (2deacc0)
  • fix Nuxt badge icon (#​2049)
  • update installation warning (#​2061)
  • fix storyblok links (#​2046)
  • add deno example (#​2012)
📦 Build
  • deps: bump serialize-javascript from 7.0.4 to 7.0.5 (#​2249)
  • deps: bump js-cookie from 3.0.5 to 3.0.7 (#​2248)
  • deps: bump ws from 8.17.1 to 8.20.1 (#​2246)
  • deps: bump h3 from 1.15.6 to 1.15.9 (#​2177)
  • deps: bump h3 from 1.15.4 to 1.15.5 (#​2085)
🏡 Chore
  • run module prepare in prepack (97d3758)
  • move consola to dev dependencies (#​2275)
  • migrate to pnpm v11 (#​2236)
  • migrate resolutions to pnpm-workspace.yaml (9b80ce6)
  • migrate npm badges and links to npmx.dev (fd87f7d)
  • remove unused slot-related code from <NuxtPicture> (#​2145)
  • update lint scripts in package.json (#​2139)
  • remove deprecated github silent config (#​2026)
  • revert pnpm trust policy and restore provenance action (13b88c1)
  • update pnpm to 10.21 and enable trust policy (03b5ef4)
🤖 CI
  • add workflow to comment on issues resolved in the latest release (e529f37)
  • improve workflows (#​2288)
  • migrate to uppt (#​2286)
  • migrate agentscan-action to v2 (2f8b332)
  • add agent-scan workflow to flag bot-authored PRs (23ee710)
  • add merge group config (#​2137)
  • rename workflow (777239c)
  • avoid checkout for reproduction comment (a200dae)
  • pin github actions to full-length commit shas (f60d0f7)
  • unpin workflow (d1cb12b)
  • try pinning (09e5efb)
  • update var (402c729)
  • use new shared dependency review workflow (906111c)
🎉 New Contributors
❤️ Contributors
nuxt/nuxt (@​nuxt/kit)

v4.5.1

Compare Source

⚠️ This is a security release. We recommend upgrading as soon as possible with npx nuxt upgrade --dedupe.

It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, cross-user payload disclosure on cached pages, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.

If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.

If you use the cache, swr or isr route rules, purge any CDN or edge cache after upgrading; a leaked _payload.json may already be cached upstream.

Full details: Nuxt Security Patch Releases and GitHub Security Advisories.

👉 Changelog

compare changes

🔥 Performance
  • nitro: Replace island teleports in a single html pass (#​35515)
  • nuxt: Add vue.optionsApi and disable it for v5+ (#​35791)
  • nuxt: Without pages, skip client plugins that require routing (#​35794)
  • nuxt: Skip payload revival plugin when ssr: false (#​35782)
🩹 Fixes
  • nitro: Read rspack dev output fs lazily for server entry (#​35740)
  • rspack,webpack: Resolve loaders and runtime deps from nuxt dirs (#​35568)
  • nuxt: Return global route for useRoute in detached effect scope (#​35659)
  • nuxt: Ignore custom name or path when reusing an existing page in pages:extend (#​35661)
  • nuxt: Render client components in nested server components (#​35669)
  • nuxt: Preserve explicit useFetch method inference (#​35671)
  • nuxt: Revalidate cached route payloads instead of using force-cache (#​35672)
  • nuxt: Correct default export detection in plugin metadata (#​35676)
  • nuxt: Clear hide/reset timeouts in set() (#​35534)
  • kit,nuxt,rspack,schema,webpack: Add .mts file extension in resolver (#​33845)
  • nuxt: Preserve trailing slash in NuxtLink href when unset (#​35501)
  • nuxt: Don't cross-pollute useAsyncData cache on reactive key change (#​35656)
  • nuxt: Filter plugin dependencies by build target (#​35682)
  • nuxt: Reload real page module on HMR of JSX render-function pages (#​35678)
  • nuxt: Resolve @unhead/vue/* from nuxt's dependency tree (#​35690)
  • kit: Surface module load errors instead of masking as missing (#​35497)
  • nuxt: Type auto-imported $fetch with nitro's $Fetch (#​35704)
  • nuxt: Don't reference app config sources in shared and node tsconfigs (#​35673)
  • vite: Resolve SSR inlined CSS module class name mismatch (#​35610)
  • nuxt: Generate layout types even when pages module is disabled (#​35717)
  • nitro: Skip resource hints for stylesheets already rendered as blocking links (#​35691)
  • kit: Dedupe layers that are both auto-scanned and explicitly extended (#​35712)
  • nuxt: Don't apply scroll behaviour after a subsequent nav (#​35719)
  • vite: Ensure server sourcemap-preserver plugin actually runs (#​35680)
  • vite: Preserve css suffix when extracting ssr inline styles (#​35714)
  • nuxt: Watch external component directories in development (#​35652)
  • nuxt: Don't exclude client entry module from style extraction (#​35720)
  • nuxt: Amend cleanup command in NUXT_B7014 error message (#​35735)
  • nuxt: Only pull in vue-router when there are island pages (#​35739)
  • vite: Suppress external warnings for internal vite-node paths (#​35744)
  • nuxt: Use scope-aware oxc parser for auto-imports (#​35743)
  • nuxt: Sync layout meta during middleware on SSR (#​35633)
  • nitro: Add alias for h3 that pins it to the version nuxt depends on (#​35774)
  • nuxt: Preserve query params in cached payload extraction (#​35696)
  • nuxt: Mirror runtime route tree in generated typed-router types (#​35788)
  • nuxt: Warn when an imports preset from cannot be resolved (#​35799)
  • kit: Avoid mutating layer configs when resolving options (#​35729)
  • nuxt: Convert inline route rules exactly or drop with a warning (#​35455)
  • nitro,nuxt,vite: Dedupe and normalise global css links in dev (#​35834)
  • vite: Register template HMR plugin on dev servers (929c6c138)
  • nuxt: Remove dev error overlay when error is cleared (#​35821)
  • rspack,webpack: Resolve bundled postcss defaults from builder (#​35823)
  • schema: Normalise slashes in app.buildAssetsDir (#​35833)
  • nitro: Bound island props and v-for to prevent unauthenticated DoS (4e35ae9ba)
  • nitro: Confine runtime payload cache to prerendering (ac9b41a36)
  • nuxt: Case-fold route rule keys to match folded lookups (ad624a75a)
  • nitro: Require loopback peer for chrome devtools workspace endpoint (0769c4f9b)
  • nuxt: Reject reserved template island prop under runtime compiler (ee6c84633)
  • nuxt: Reject top-level as prop for islands (581651ff3)
💅 Refactors
  • nuxt: Use tick based debounce for asyncData executes (#​34151)
  • kit,nuxt: Replace semver with verkit (#​35713)
  • rspack,webpack: Use DI model to split builders (#​35751)
📖 Documentation
  • Add dev container setup guide (#​35665)
  • Fix dev container setup guide (#​35666)
  • Add explanation of 200.html and 404.html SPA fallbacks (#​34483)
  • Expand payload extraction documentation (#​35648)
  • Clarify NuxtLink componentName is the internal (devtools) name (#​35658)
  • Add example for components dir pattern option (#​35663)
  • Require a single root element (#​35677)
  • Add reason for why you should never import Vue app code in nitro code (#​34481)
  • Document disabling code-splitting with codeSplitting: false (#​35683)
  • Document nuxt-client caveat for non-SFC components (#​35654)
  • Clarify favicon does not use cdnURL by default (#​35681)
  • Standardize section order and headings across docs (#​35685)
  • Clarify onPrehydrate example comment (#​35684)
  • Add useId as a known limitation of nuxt island (#​35693)
  • Recommend status over pending in data fetching (#​35694)
  • Fill gaps in API minimalVersion badges after #​34485 (#​35708, #​34485)
  • Explain dynamic asset paths (#​35695)
  • Document runtimeConfig env var casting edge cases (#​35709)
  • Clarify module dependency resolution (#​35718)
  • Add more writing guidelines (#​35662)
  • Add note with alternatives to using remote layers (#​35721)
  • Use nuxt rather than nuxi (8891e179c)
  • Document relative baseURL workarounds (#​34004)
  • Warn about runtimeCompiler security best practices (449b63ab1)
  • Warn about validating server component props (2c981cb07)
📦 Build
  • nitro: Re-export type from augments to preserve module (dac937675)
  • nuxt: Remove .ts file extension from runtime/ imports (#​35689)
  • ui-templates: Commit generated ui template files (#​35770)
🏡 Chore
  • Add extension 🤦 (d595fb3d4)
  • Move to pnpm catalogs (#​35748)
  • Update knip config, resolve issues, and run in ci (#​35742)
  • Ignore @nuxt/telemetry in knip (9824d4f10)
  • ui-templates: Pass config file path to unocss (34e7a810d)
  • Allow regenerating lockfile in release script (c31389df3)
  • nuxt: Bump @nuxt/devtools to v3.3.1 (#​35815)
  • Ensure types are setup before unit tests (784d8f700)
  • Simplify knip configuration (#​35827)
✅ Tests
  • Reproduce duplicate CSS in shared chunks (#​35649)
  • Prepare fixtures automatically before fixture and e2e runs (e8b3e6411)
  • Improve and refactor basic fixture (#​35687)
  • Slim down client-only, chunk-error and axis-independent suites (#​35706)
  • Do not run type checking when benchmarking nuxt build (6355f3bc9)
  • kit: Scope loadNuxt temp dir so it doesn't delete sibling fixtures (37301dd51)
  • Guard against transient undefined _route in gotoPath (ca92d082b)
  • Retry fixture prepare on transient ENOTEMPTY (3a6b59f96)
  • Raise route-HMR polling timeout to reduce e2e flakiness (01dc27b7e)
  • Update bundle size snapshot (30d24817c)
🤖 CI
  • Rebalance shards and drop non-vite windows fixtures (#​35700)
  • Warm windows dependency cache on main (#​35730)
  • Run knip in default and production modes (#​35745)
  • Run knip on pull requests (d620aa972)
  • Prepare tests (c7bf7f738)
  • Also prepare tests in knip job (58f68bd64)
  • Check internal docs links on pull requests and all links weekly (#​35767)
❤️ Contributors

v4.5.0

Compare Source

4.5.0 is the next minor release.

📣 Some News
Preparing for Nuxt 5

A good chunk of this release is (hopefully) invisible plumbing for Nuxt 5. We've moved onto the latest major versions of several core dependencies (unhead v3, unctx v3, and Vite 8), switched the framework's own build over to tsdown, and introduced a stable nuxt/* build output contract with dev exports so that type-checking in the Nuxt monorepo works without a build step (#​35463, #​35605).

Much of this is working to shrink the gap between v4 and v5 internally, so that the migration will be as boring as possible.

[!TIP]
If you want to test some of the breaking changes of Nuxt v5, you can already opt in with future.compatibilityVersion: 5. Keep an eye on the Upgrade Guide for details as they land.

With the release of Nuxt v4.5, our focus as a team will turn to stabilising Nuxt v5 and creating compatibility utilities to make the upgrade as smooth as possible.

Nuxt 3 End-of-Life

Nuxt 3 reaches end-of-life on July 31, 2026, so this is one of the last few 3.x releases we'll ship. If you're still on v3, now is a great time to move across. Most people told us the v3 to v4 upgrade was smooth, and we've kept the upgrade guide up to date.

Alongside v4.5.0 we're publishing a maintenance patch for the 3.x line (v3.21.9) with the compatible bug fixes and smaller improvements from this release backported. The headline items here (Vite 8, Rspack 2, unhead v3, unctx v3) are major upgrades and stay v4-only, so 3.x remains stable as it approaches end-of-life.

👀 Highlights

Nuxt 4.5 is a big one. This release ships three major upgrades to the build layer (Vite 8, Rspack 2, and a brand new Rsbuild-powered pipeline for the Rspack builder), an experimental SSR streaming mode, a handful of new composables and conventions, and a lot of groundwork that brings us closer to Nuxt 5.

There's a lot here, so grab a coffee. ☕️

⚡️ Vite 8

Nuxt now runs on Vite 8 (#​34256). This brings faster cold starts, the latest Rolldown-powered internals, and many upstream improvements from the Vite team.

For most apps this is a transparent upgrade. If you have custom Vite plugins or config, it's worth skimming the Vite migration guide to check for anything that affects you.

[!WARNING]
Vite 8 is a major version bump. If you depend on Vite directly (custom plugins, vite.config tweaks, or ecosystem plugins that pin a Vite version), make sure those are compatible before upgrading in production.

🦀 Rspack 2 and Rsbuild

If you use the Rspack builder, this release is a substantial upgrade. We've moved to Rspack 2 (#​34929), which is faster and lighter, and rebuilt the builder on top of @rsbuild/core (#​35489).

The public surface stays the same. You still opt in with builder: 'rspack' and the existing rspack:* hooks continue to work:

// nuxt.config.ts
export default defineNuxtConfig({
  builder: 'rspack',
})

Under the hood, though, a lot has changed for the better:

  • The dev server now runs in middleware mode via Rsbuild, replacing webpack-dev-middleware and webpack-hot-middleware (#​35575).
  • We use an Rspack-specific Vue loader for correct SSR scoped-style ids and stricter ESM resolution (#​35566).

[!NOTE]
This is the foundation for first-class Rsbuild support. We kept the builder named rspack for now so nothing brea

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 7f832f4 to e5b757e Compare August 3, 2026 17:56
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from e5b757e to 609f8ba Compare August 4, 2026 03:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants