chore: Update docs dependencies - #263
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
force-pushed
the
renovate/docs-dependencies
branch
from
August 11, 2026 17:19
d306e73 to
1d27a3c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^3.15.0β^3.15.2^2.3.1β^2.4.1^4.4.8β^4.5.2^4.9.0β^4.10.0^13.0.2β^13.0.3^5.12.2β^5.12.3^4.4.8β^4.5.2^2.10.0β^2.10.1^4.3.1β^4.3.3Release Notes
nuxt/content (@βnuxt/content)
v3.15.2Compare Source
Bug Fixes
v3.15.1Compare Source
Bug Fixes
nuxt/nuxt (@βnuxt/kit)
v4.5.2Compare Source
π Changelog
compare changes
π₯ Performance
π©Ή Fixes
v-forislands transform (#β35877)applyandapplyToEnvironmentin vite wrapper (#β35899)enforcein vite wrapper (#β35916)vite-node(#β35758)<NuxtPage>on nav + with slot (#β35948)prependis set (#β35942)import.meta.testfor server code (#β35987)π Refactors
vue-component-type-helpersinstead of locally maintained helpers (#β35840)isReferenceIdentifierin page-meta plugin (#β35882)π Documentation
defineVitestProjectin e2e tests (#β35926)π¦ Build
π‘ Chore
@nuxt/devtoolsto v3.4.0 (#β35892)β Tests
toFsUrl(a5ad667f7)π€ CI
permissions: {}to workflows (2e1a1cbeb)β€οΈ Contributors
v4.5.1Compare Source
It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, cross-user payload disclosure on cached pages, and dev server path disclosure. Refreshing your lockfile also pulls in
@nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.
If you use the
cache,swrorisrroute rules, purge any CDN or edge cache after upgrading; a leaked_payload.jsonmay already be cached upstream.Full details: Nuxt Security Patch Releases and GitHub Security Advisories.
π Changelog
compare changes
π₯ Performance
vue.optionsApiand disable it for v5+ (#β35791)ssr: false(#β35782)π©Ή Fixes
useRoutein detached effect scope (#β35659)nameorpathwhen reusing an existing page inpages:extend(#β35661)useFetchmethod inference (#β35671)force-cache(#β35672).mtsfile extension in resolver (#β33845)@unhead/vue/*from nuxt's dependency tree (#β35690)$fetchwith nitro's$Fetch(#β35704)vue-routerwhen there are island pages (#β35739)h3that pins it to the version nuxt depends on (#β35774)fromcannot be resolved (#β35799)app.buildAssetsDir(#β35833)templateisland prop under runtime compiler (ee6c84633)asprop for islands (581651ff3)π Refactors
semverwithverkit(#β35713)π Documentation
codeSplitting: false(#β35683)onPrehydrateexample comment (#β35684)runtimeConfigenv var casting edge cases (#β35709)nuxtrather thannuxi(8891e179c)runtimeCompilersecurity best practices (449b63ab1)π¦ Build
.tsfile extension fromruntime/imports (#β35689)π‘ Chore
@nuxt/telemetryin knip (9824d4f10)@nuxt/devtoolsto v3.3.1 (#β35815)β Tests
_routein gotoPath (ca92d082b)π€ CI
knipjob (58f68bd64)β€οΈ Contributors
v4.5.0Compare Source
π£ Some News
Preparing for Nuxt 5
A good chunk of this release is (hopefully) invisible plumbing for Nuxt 5. We've moved onto the latest major versions of several core dependencies (
unheadv3,unctxv3, and Vite 8), switched the framework's own build over totsdown, and introduced a stablenuxt/*build output contract with dev exports so that type-checking in the Nuxt monorepo works without a build step (#β35463, #β35605).Much of this is working to shrink the gap between v4 and v5 internally, so that the migration will be as boring as possible.
With the release of Nuxt v4.5, our focus as a team will turn to stabilising Nuxt v5 and creating compatibility utilities to make the upgrade as smooth as possible.
Nuxt 3 End-of-Life
Nuxt 3 reaches end-of-life on July 31, 2026, so this is one of the last few 3.x releases we'll ship. If you're still on v3, now is a great time to move across. Most people told us the v3 to v4 upgrade was smooth, and we've kept the upgrade guide up to date.
Alongside v4.5.0 we're publishing a maintenance patch for the 3.x line (v3.21.9) with the compatible bug fixes and smaller improvements from this release backported. The headline items here (Vite 8, Rspack 2,
unheadv3,unctxv3) are major upgrades and stay v4-only, so 3.x remains stable as it approaches end-of-life.π Highlights
Nuxt 4.5 is a big one. This release ships three major upgrades to the build layer (Vite 8, Rspack 2, and a brand new Rsbuild-powered pipeline for the Rspack builder), an experimental SSR streaming mode, a handful of new composables and conventions, and a lot of groundwork that brings us closer to Nuxt 5.
There's a lot here, so grab a coffee. βοΈ
β‘οΈ Vite 8
Nuxt now runs on Vite 8 (#β34256). This brings faster cold starts, the latest Rolldown-powered internals, and many upstream improvements from the Vite team.
For most apps this is a transparent upgrade. If you have custom Vite plugins or config, it's worth skimming the Vite migration guide to check for anything that affects you.
π¦ Rspack 2 and Rsbuild
If you use the Rspack builder, this release is a substantial upgrade. We've moved to Rspack 2 (#β34929), which is faster and lighter, and rebuilt the builder on top of
@rsbuild/core(#β35489).The public surface stays the same. You still opt in with
builder: 'rspack'and the existingrspack:*hooks continue to work:Under the hood, though, a lot has changed for the better:
webpack-dev-middlewareandwebpack-hot-middleware(#β35575).π Experimental SSR Streaming
This is one I'm particularly excited about. You can now enable SSR streaming to dramatically improve Time to First Byte (#β34411). Instead of buffering the whole rendered page and sending it in one go, Nuxt flushes the HTML shell (your
<head>, styles, preload hints, and entry scripts) immediately, then streams the body as Vue renders it.Streaming is automatically disabled for bots and crawlers so search engines still receive fully-rendered HTML. You can tune which user agents count as crawlers, and you can opt individual routes out:
There's one thing worth understanding before you turn it on. Because streaming commits the HTTP status and headers with the very first byte, anything that mutates the response after rendering has begun (a
setResponseStatus()in a<script setup>, a cookie write during middleware, and so on) can't reach the client. Nuxt handles the common cases for you: routes withredirect,cache,isr,swr,noScripts, orssr: falserules automatically fall back to the buffered renderer, and in development we log a warning naming any dropped mutations so nothing fails silently.π SSR streaming documentation
π©Ί Stable Error Codes
This one I'm really happy about. Nuxt now has a stable error code system (#β35429). Warnings and errors raised during build and at runtime now carry a stable code (like
NUXT_E1001orNUXT_B5001), a short explanation of why it happened, and a concrete fix to try.Every code is greppable and bookmarkable, and the ones that need more than a one-line fix link straight to a dedicated docs page. For example, the classic "a composable was called outside a Nuxt context" now surfaces as
NUXT_E1001with the why/fix inline and a docs page explaining the context rules and how to userunWithContext().To keep production output lean, the verbose why/fix text is stripped from production builds, leaving just the stable code.
This is the foundation for much better error messages across Nuxt, and we'll keep migrating existing warnings and errors onto it over the coming releases. If you've ever squinted at a cryptic Nuxt message, this is for you.
π¨
useLayoutComposableThere's a new
useLayoutcomposable for reading the layout that's been resolved for the current route (#β35623). Previously there was no clean, reactive way to ask "which layout is this page using?" from within a component.It returns a read-only computed ref, so it stays in sync as you navigate or as route rules and
definePageMetachange the resolved layout.π
useLayoutdocumentationπͺ Named Views
Nuxt now supports named views through a filename convention (#β35123). If a parent page renders more than one
<NuxtPage>outlet, you can give each outlet a name and provide a sibling page file for it using thename@view.vueconvention:Navigating to
/parent/childrenderschild.vueinto the default outlet andchild@sidebar.vueinto thesidebaroutlet. This has actually been possible in Vue Router for a long time; this release wires it up to Nuxt's file-based routing.π Named views documentation
π¦
enabledOption foruseFetchanduseAsyncDataYou can now gate data fetching with a reactive
enabledoption (#β33260). Whileenabledisfalse, every execution is blocked (the initial fetch,execute/refresh, and watch triggers), and if you flip it fromtruetofalsemid-flight, the in-flight request is cancelled without clearing your existingdata.This is perfect for dependent or conditional queries, where you don't want to fire a request until some precondition is met. It pairs naturally with a getter or a ref, so it stays reactive.
π
useAsyncDatadocumentationπ
NuxtLinkPrefetch Control for Custom SlotsWhen you use
<NuxtLink>with thecustomprop, Nuxt no longer attaches prefetch handlers for you, because it can't know how you've structured your markup. To make that ergonomic, the slot now exposes everything you need to wire prefetching up yourself (#β34539):You get
prefetchto trigger it,prefetchedto know whether it's already happened (great for a prefetched class), andshouldPrefetchto respect the user's connection and config.π
NuxtLinkdocumentationβ‘οΈ Forwarded Preload Hints on Prefetch
Here's another one we'd love you to try. When you prefetch a link to a route with payload extraction, Nuxt already primes the destination's data and chunks. With the new opt-in
experimental.prefetchPreloadTags(#β35144), it also forwards the destination's<link rel="preload">andmodulepreloadhints (whatever the page sets viauseHead, or via modules like@nuxt/image's<NuxtImg preload>) into the current document, downgraded torel="prefetch"so they don't compete with the resources the user is looking at right now.The practical effect is that heavy above-the-fold assets on the next page (a hero image, a critical script) start downloading while the user is still on the current one, so the navigation feels instant. It's off by default while we gather feedback, so please give it a spin and tell us how it behaves on your app.
π
import.meta.envNameThe resolved Nuxt environment name is now available at runtime as
import.meta.envNamefor both Vite and webpack/Rspack builds (#β34844). This is the value set by--envName(or the resolved default), so you can branch on it in your app code:π
import.metadocumentationπ Tracing Channels for SSR Events
Nuxt now publishes diagnostics-channel traces for its server-side subsystems (#β35191). It's unopinionated: we emit
nuxt.render,nuxt.island,nuxt.data, andnuxt.pluginchannels following the untracing naming convention, and you can build OpenTelemetry (or anything else) on top. It works in Node, Deno, Bun, and Cloudflare Workers.You can also enable it granularly. In Nuxt v5, there will be additional Nitro-level channels:
π¦ Dependency Upgrades
unheadv3Nuxt's head management now runs on
unheadv3 (#β34793). It's smaller, uses a synchronous engine internally, and ships better type-safety foruseHeadout of the box. This also unblocks SSR streaming.unctxv3We've moved to
unctxv3 (#β35541), which resolves a class of long-standing async context issues (#β33644). This is part of the composable-context reliability work that continues into v5.And more
We've also updated
magic-stringto v1, Babel to v8, and pulled in the latest Rolldown across the board. Runningnuxt upgrade --dedupe(see below) is the easiest way to pull these through cleanly.π οΈ Nuxt CLI
This release bundles some improvements from
@nuxt/cliv3.36 and v3.37:nuxt module removeto uninstall a module and clean up its config (nuxt/cli#1306), the natural companion tonuxt module add.Non-interactive
nuxt initfor scripting and CI (nuxt/cli#1341), plus it now respects the template's own package manager instead of prompting (nuxt/cli#1330).Type-check onboarding:
nuxt typechecknow offers to installvue-tscandtypescriptfor you if they're missing (nuxt/cli#1316).Golar support for type-checking:
nuxt typecheckcan now use Golar as an alternative tovue-tsc(nuxt/cli#1362). It's picked up automatically if it's installed (or agolar.config.*file exists), and you can force a checker with--checker=vue-tscor--checker=golar:Layer-aware dev server: the dev server now reloads on changes to local layer
nuxt.configfiles (nuxt/cli#1345).π§© TypeScript Plugin and Named Layout Slots
Nuxt's experimental TypeScript plugin is powered by
@dxup/nuxt, and this release bundles a newer version of it. If you haven't tried it, turning onexperimental.typescriptPlugingives you a set of editor niceties: renaming an auto-imported component updates every usage, plus go-to-definition for glob imports, Nitro routes,definePageMeta,runtimeConfig, and typed route names.New in the bundled version is an opt-in runtime feature: named layout slots (KazariEX/dxup#20). You can write a top-level named-slot template in a page and have it forwarded into the matching named slot of the active layout. That lets a page inject content into its layout's slots, which file-based layouts don't otherwise allow.
Enable it alongside the plugin:
Then a layout can expose named slots:
And any page using that layout can fill them:
π
typescriptPlugindocumentationπ₯ Performance and Reliability
As always, a lot of work has gone into making Nuxt faster and steadier.
One you can opt into today is the shared file watcher (#β35143). Vite already runs a chokidar-based watcher, so Nuxt can piggy-back on it instead of spinning up a second one, using less memory and fewer file handles. This becomes the default with
compatibilityVersion: 5, but you can turn it on now and let us know how it goes:There are also some other good performance improvements that don't need to be opted into:
getIslandHashandhashKeynow exposed (#β35583).A couple of other nice quality-of-life fixes:
$fetchis now auto-imported in user code, which fixes edge cases with top-level$fetch.createunder Rolldown's output format (#β35581).HTTP_PROXY/HTTPS_PROXYenvironment variables in the builder environment (#β35183).defineNuxtComponentin JSX (#β35620).As mentioned above, this release includes three major dependency bumps. For most apps they're transparent, but they're worth a moment of attention:
builder: 'rspack', the internals are now Rsbuild-based, so custom Rspack config may need review.unheadv3: possible breaking type changes from stricteruseHeadtyping.β¬οΈ Upgrading
Our recommendation for upgrading is to run:
npx nuxt upgrade --dedupe # or, if you are staying on the 3.x line npx nuxt@latest upgrade --dedupe --channel=v3This will deduplicate your lockfile and help ensure you pull in updates from the other dependencies Nuxt relies on, particularly across the unjs ecosystem (which matters more than usual this release, given the major bumps).
Thank you to all of the many contributors to this release. This was a big one, and it wouldn't happen without you. π
π Changelog
compare changes
π Enhancements
import.meta(#β34844)allowImportingTsExtensions(87c214b34)nuxt/*build output contract (#β35463)NuxtLinkprefetch props for custom slot (#β34539)enabledoption to AsyncData (#β33260)getIslandHash+hashKey+ improve hash for keys (#β35583)useLayoutcomposable for accessing the resolved route layout (#β35623)enabledoption inuseFetch(#β35627)Configuration
π Schedule: (UTC)
* 0-3 * * 1)π¦ Automerge: Enabled.
β» Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
π» Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.