chore(deps): update nuxt & vue dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@nuxt/eslint-config (source)	^1.15.2 → ^1.16.0
@nuxt/kit (source)	^4.4.4 → ^4.4.8
@nuxt/schema (source)	^4.4.4 → ^4.4.8
@nuxt/scripts (source)	^1.0.5 → ^1.2.1
nuxt (source)	^4.4.4 → ^4.4.8
nuxt (source)	^4.4.2 → ^4.4.8
vue (source)	^3.5.30 → ^3.5.38
vue-router (source)	^5.0.4 → ^5.1.0

---

Release Notes

nuxt/eslint (@​nuxt/eslint-config)

v1.16.0

Compare Source

   🚀 Features

• Update deps  -  by @​antfu (008ad)

    View changes on GitHub

nuxt/nuxt (@​nuxt/kit)

v4.4.8

Compare Source

4.4.8 is a hotfix release to address an issue running the dev server on MacOS.

👉 Changelog

compare changes

🩹 Fixes

• vite: Shorter socket name for macOs with tmp fallback (#​35265)
• kit: Respect type option in findPath (#​35272)
• deps: Update nuxt/scripts presets (905621594)
• nuxt: Revert unhead dependency back to v2 (e6d578fea)

📖 Documentation

• Fix many typos (#​35266)
• Explain static fallback pages (#​35277)
• Change null to undefined in data-fetching docs to match actual types (#​35301)
• Fix broken internal links, useAsyncData watch type, and NuxtError type (#​35303)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Ali Mahmmoud (@​AliMahmoudDev)
• Quentin Macq (@​quentinmcq)
• Pranav Rajeshirke (@​Pranav188)
• Eduardo San Martin Morote (@​posva)

v4.4.7

Compare Source

4.4.7 is a security hotfix release.

👉 make sure to check https://github.com/nuxt/nuxt/security/advisories to view open advisories resolved by this release.

👉 Changelog

compare changes

🩹 Fixes

• nitro: Assign noSSR before deciding payload extraction (#​35108)
• vite: Avoid filtering out dirs with shared prefix from allowDirs (#​35112)
• nuxt: Use resolve from pathe for buildCache path boundary check (#​35111)
• nuxt: Prevent sibling-directory traversal in test component wrapper (#​35110)
• nitro: Pass event data to isValid in dev clipboard-copy listener (#​35109)
• nuxt: Validate protocols in reloadNuxtApp path before reload (#​35115)
• vite: Prefix public asset virtuals with null byte (9e303b438)
• nuxt: Re-run getCachedData after initial fetch (#​35122)
• nuxt: Propagate useFetch/useAsyncData factory types (#​35133)
• vite: Close vite dev server on nuxt close (a10a68abc)
• kit,nuxt: Handle cancelling prompts to install packages (e84813229)
• kit: Avoid excluding node-context files in legacy tsconfig (#​35152)
• nuxt: Handle missing payload in chunkError listener (#​35155)
• nuxt: Await in-lifght template generation when closing nuxt (#​35181)
• nuxt: Clarify page and layout usage warnings (#​35184)
• webpack: Surface compilation errors when stats.toString is empty (073b07851)
• nuxt: Reject prototype-chain keys in the island registry (#​35205)
• nuxt: Apply isScriptProtocol guard to navigateTo open option (#​35206)
• nuxt: Prevent server-only page island from recursing via <NuxtPage> (#​35198)
• rspack,webpack: Require loopback host when missing same-origin signals (#​35200)
• nitro: Gate chrome devtools workspace endpoint to local requests (#​35201)
• nuxt: Escape props in <NuxtClientFallback> ssr output (#​35199)
• kit: Improve TS extension stripping/substitutions (#​35233)
• nuxt: Preserve .d.mts/.d.cts in resolveTypePaths (#​35235)
• nuxt: Escape <NoScript> slot content (4b054e9d9)
• nuxt: Match route rules case-insensitively to mirror vue-router (07e39cd6f)
• nuxt: Reject script-capable protocols in <NuxtLink> href (0103ce06f)
• nuxt: Block path-normalization open redirect in navigateTo (2cce6fb02)
• nuxt: Reject cross-origin paths in reloadNuxtApp (e447a793c)
• vite: Bind vite-node IPC to a permissioned filesystem socket (1f9f4767a)

💅 Refactors

• kit,nuxt,vite: Use es2023 array methods (#​34980)
• nuxt: Replace runInNewContext with AST walker (d72a89ef4)

📖 Documentation

• Document vite client and server options (#​35090)
• Add dedicated module dependencies page (#​35171)
• Add nodeTsConfig and sharedTsConfig options (#​35231)
• Edit for clarity and grammar (#​35214)

🏡 Chore

• Use execFileSync for safety in release scripts (1d7baaf01)
• Assert there is always a tag (e98c47c3c)
• Add autofix action tag in comment (ffa5c0098)
• Fix type in test (a549652e2)
• Update renovate minimum release age (d12d5e58a)
• Fix lychee dynamic composable exclude (#​35119)
• Update lockfile (91186dc51)
• Lint (dbc58965c)

✅ Tests

• Update test for js payload rendering (bdcb81536)
• Cover add regression test for hmr in sibling local layers (#​35125)
• Improve reliability of hmr test (1d709b3cc)

🤖 CI

• Always run all tests for 4.x/3.x (0dc4665cf)
• Migrate from tibdex (ded29dc0f)
• Add zizmor github actions check (#​35089)
• Update to agentscan v1.8.0 (#​35120)
• Automatically close PRs from automated accounts (#​35161)
• Disable provenance-change enforcement in dependency-review (a2cf43e68)

❤️ Contributors

• Daniel Roe (@​danielroe)
• David Stack (@​davidstackio)
• David De Sloovere (@​DavidDeSloovere)
• anton-gor-dev (@​anton-gor-dev)
• Noah3521 (@​Noah3521)
• Shahar Aviram (@​ShaharAviram1)
• Matej Černý (@​cernymatej)
• Mohit Kumar (@​mohitkum4r)
• Matteo Gabriele (@​MatteoGabriele)
• Julien Huang (@​huang-julien)
• Damian Głowala (@​DamianGlowala)

v4.4.6

Compare Source

4.4.6 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes

• vite: Use spa entry for vite-node fallback (#​35037)
• vite: Invalidate SSR module cache when modules are invalidated via plugin hooks (a86657a0e)
• nuxt: Match deduplicated resolveComponent calls in jsx blocks (#​35028)
• nuxt: Prefer our own builder/server deps (#​35029)
• nuxt: Update useFetch key even with watch: false (#​35002)
• nitro: Mark @babel/plugin-syntax-typescript as optional peer dep (#​35041)
• nitro: Add json extension to payload cache items (#​35043)
• nuxt: Handle errors fetching app manifest (#​35050)
• nuxt: Encode html-significant characters in external redirect body (#​35052)
• nuxt: Preserve setPageLayout props on same-path navigation (#​35055)
• vite: Don't strip buildAssetsDir from vite-node SSR ids (#​35040)
• nuxt: Mark useLoadingIndicator properties as readonly (#​35062)
• vite: Strip queries in css inline styles map (#​35067)
• nitro: Validate island request hash matches props (#​35077)
• nitro: Use regexp to strip query (163e18d4b)
• nitro: Use statusCode for nitro v2 compatibility (952f6841e)
• nitro-server: Re-export h3 named symbols statically (cd99001c8)
• nuxt: Render component-less parent routes during client-side nav (#​35036)
• kit: Respect tsConfig.exclude in legacy tsconfig.json (#​35079)
• nuxt: Run middleware for page islands (#​35092)

💅 Refactors

• rspack,webpack: Extract same-origin check for dev middleware (#​35051)

📖 Documentation

• Remove CSB, set node 22 and use steps for clarity (#​35066)

🏡 Chore

• One more type, one more (50dcf15bb)
• Remove unneeded (?) overrides (6997093af)
• Use explicit versions for fixture dependencies (294a734d4)
• Ignore link-like syntax in code (2584a549c)
• Narrow engines.node in test (5bb17fb47)
• Remove unused import (a52d78626)

✅ Tests

• Relax relative time assertion (c3dcd16f9)
• Add type (732d844ad)
• Drop h3 v2 types (8286e5fcd)

🤖 CI

• Clean up agent-scan workflow (ab8317547)
• Continue autofix workflow when test:engines fails (3025e561e)
• Improve workflows (#​35088)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Tim (@​timhn-bm)
• Julien Huang (@​huang-julien)
• Damian Głowala (@​DamianGlowala)
• Sébastien Chopin (@​atinux)
• Adrien Foulon (@​Tofandel)
• Sami El Achi (@​samiashi)

v4.4.5

Compare Source

4.4.5 is the next patch release.

👉 Changelog

compare changes

🔥 Performance

• kit: Cache layer roots and short-circuit isIgnored relative (#​35015)

🩹 Fixes

• vite: Resolve vite clientServer with ssr: false (#​34959)
• nitro: Correct payload route rule for / + override ssr: true (#​34990)
• nitro: Break recursive rendering deadlocks during prerender (#​34939)
• vite: Drop redundant css link when entry styles are inlined (#​34950)
• vite: Sort optimizeDeps.include in pre-bundle hint (#​34976)
• nuxt: Only force suspense remount after first resolve (#​34949)
• kit: Read .env before resolving nuxt schema (#​34958)
• nitro: Preserve serverHandlers array after nitro:config (#​34985)
• nuxt: Cast partial nitro handlers when prepending to server arrays (61dcde4db)
• vite: Only consider CSS inlined when styles are actually emitted (#​35006)
• nuxt: Dedupe getCachedData for concurrent callers sharing a key (#​34999)
• nuxt: Respect factory fetch/baseURL options in server useFetch (#​35003)
• nuxt: Handle string presets in auto-imports (#​35013)
• nuxt: Correct island transform for server pages and 'deep' mode (#​35005)
• vite: Inline css for non-island children of server components (#​35001)
• nuxt: Defer head DOM updates until page transition finishes (#​35016)
• nuxt: Explicitly freeze head during island plugin phase (#​35010)
• vite: Inline css imported from non-vue js modules (#​35020)

📖 Documentation

• Add warning about routing in server components (#​34994)

🏡 Chore

• Fix lockfile (c3ee07801)
• Pin jiti (c8102228f)
• Lint (39422b6d2)
• Pin @vue/compiler-sfc (cd404a14c)
• Ignore pnpm cyclic workspace deps warn (#​34998)
• Remove jiti from build steps (#​35004)

✅ Tests

• Extract server components fixture + add some failing tests (#​34995)
• Isolate buildDir per matrix project for shared fixtures (#​35007)
• Remove tests for 5.x runtimeBaseURL fature (816c25487)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Harlan Wilton (@​harlan-zw)
• Jonazzzz (@​Bombastickj)
• Damian Głowala (@​DamianGlowala)
• Florian Heuberger (@​Flo0806)

nuxt/scripts (@​nuxt/scripts)

v1.2.1

Compare Source

   🐞 Bug Fixes

• Provide SpeedCurve snippet fallback  -  by @​sjh9714 in #​811 (c1322)

    View changes on GitHub

v1.2.0

Compare Source

   🚀 Features

• SpeedCurve LUX  -  by @​zizzfizzix and @​harlan-zw in #​782 (82696)
• globals: Runtime disable + scripts:globals hook  -  by @​harlan-zw in #​808 (62b04)

   🐞 Bug Fixes

• deps: Add support for unhead v3  -  by @​danielroe and @​harlan-zw in #​795 (fefd9)
• google-maps: Deprecate heatmap component  -  by @​harlan-zw in #​809 (c92ac)
• google-maps,gravatar: A11y misc fixes  -  by @​harlan-zw in #​802 (bb42b)
• instagram-embed: Use facebookexternalhit UA & don't cache empty shells  -  by @​harlan-zw in #​806 (87b13)
• proxy: Strip hop-by-hop request headers (RFC 7230)  -  by @​harlan-zw in #​804 (da57b)
• speedcurve: Vendor LUX snippet and group schema options  -  by @​harlan-zw in #​805 (ac0ad)
• stripe: Allow selecting Stripe.js SDK version  -  by @​harlan-zw in #​799 (ae8d2)
• vimeo: A11y keyboard and video placeholder alt text  -  by @​harlan-zw in #​803 (33a11)
• youtube-player: A11y keyboard-accessible  -  by @​harlan-zw in #​798 (8b4e9)

    View changes on GitHub

v1.1.1

Compare Source

   🐞 Bug Fixes

• security:
  • Allow opting out of proxy page token in SSR payload  -  by @​harlan-zw in #​789 (4738a)
  • Allow disabling proxy signing with security: false  -  by @​harlan-zw in #​790 (dc11a)
• tiktok-pixel:
  • Use TikTok's array snippet protocol  -  by @​harlan-zw in #​786 (f46cc)

    View changes on GitHub

v1.1.0

Compare Source

   🚀 Features

• LinkedIn Insight Tag  -  by @​zizzfizzix in #​741 (fb922)
• Ahrefs Web Analytics  -  by @​harlan-zw in #​751 (ceb4b)
• Usercentrics CMP  -  by @​harlan-zw in #​749 (d2114)
• Calendly  -  by @​harlan-zw in #​750 (e8524)
• Build-time debug flag with script-lifecycle tracing  -  by @​harlan-zw in #​760 (f6c25)
• Warn on misconfigured NUXT_PUBLIC_SCRIPTS_* env vars  -  by @​harlan-zw in #​778 (05d32)
• Env-var overrides for scripts.globals (single-build, multi-deploy)  -  by @​harlan-zw in #​780 (88869)
• gtm,ga: Consent.default() + strict GCMv2 validation  -  by @​harlan-zw in #​772 (6f74a)
• tiktokPixel: Production hardening - region, CAPI dedup, advanced matching  -  by @​harlan-zw in #​776 (c5b69)

   🐞 Bug Fixes

• Add --pnpm flag to pkg-pr-new publish command in nightly workflow  -  by @​DamianGlowala and Damian Głowala in #​755 (53810)
• Validate required registry fields after runtime merge  -  by @​tsukiyama-3 and @​harlan-zw in #​762 (61293)
• assets:
  • Set js content-type on dev bundled asset handler  -  by @​harlan-zw in #​748 (6ddc9)
• google-maps:
  • Avoid recentering on inline options  -  by @​harlan-zw in #​747 (65c3b)
• googleTagManager:
  • Push consent as arguments to dataLayer  -  by @​buffalom and motion-work in #​771 (fc398)
• plausible:
  • Honor scriptInput.src in bundle.resolve for self-hosted  -  by @​harlan-zw in #​775 (fb50b)
• proxy:
  • Allow region1.google-analytics.com  -  by @​captnCC in #​753 (58f81)
  • Surface upstream error cause and distinguish timeouts  -  by @​harlan-zw in #​757 (0cb62)
• tiktokPixel:
  • Missing types  -  by @​harlan-zw in #​773 (f73a0)

    View changes on GitHub

v1.0.6

Compare Source

   🐞 Bug Fixes

• google-analytics, google-tag-manager: Per-region consent defaults  -  by @​zizzfizzix in #​739 (ada74)
• google-maps: Avoid recentering google maps on inline options  -  by @​harlan-zw in #​740 (ab1d5)

    View changes on GitHub

vuejs/core (vue)

v3.5.38

Compare Source

v3.5.37

Compare Source

v3.5.36

Compare Source

Bug Fixes

• compiler-core: avoid crash on CDATA at the document root (#​14916) (0ea17e2)
• compiler-core: prefix dynamic keys on v-memo elements (#​14922) (68e978e), closes #​14920
• compiler-sfc: handle vue-ignore on leading intersection/union type (#​14950) (0dcd225), closes #​12254
• compiler-sfc: respect var hoisting in props destructure (48ad452)
• reactivity: preserve watch callback return value when wrapped for once: true (#​14902) (450a8a8)
• runtime-core: add dev warning for silent catch in compat mode and fix test description typo (#​14891) (db3e117)
• runtime-core: force model update when reverted before sync (#​14897) (7f76378), closes #​13524
• runtime-core: skip async component callbacks after unmount (#​14911) (5300ead)
• transition: avoid move transition for hidden v-show group children (#​14895) (c11f6ee), closes #​14894
• watch: trigger immediate callback for empty sources (#​14914) (1f2ca7e), closes #​14898

v3.5.35

Compare Source

Bug Fixes

• compiler-core: avoid double processing v-for keys with v-memo (#​14861) (34a0ded), closes #​14859
• compiler-sfc: resolve top-level exports from files registered as global types (#​14805) (3d077f2), closes nuxt/nuxt#33694
• runtime-core: avoid repeated hydration mismatch checks (#​14857) (170fc95), closes #​14855
• runtime-core: skip idle persisted transition hooks in keep-alive moves (#​14865) (80fc139), closes #​14031
• server-renderer: propagate sync errors from ssrRenderSuspense (#​14804) (4760997), closes nuxt/nuxt#28162
• teleport: skip child unmount when pending mount discarded (#​14876) (#​14877) (584beb1)

Performance Improvements

• reactivity: skip type checks for cached proxies (#​14860) (5734fe9)
• runtime-dom: optimize array event handler dispatch (#​14828) (bb18dc8)
• server-renderer: avoid materializing iterables in ssrRenderList (#​14821) (1b7a2cc)

v3.5.34

Compare Source

Bug Fixes

• compiler-sfc: infer Vue ref wrapper types when source is unresolvable (#​14758) (7f46fd4), closes #​14729
• compiler-sfc: preserve hash hrefs on <image> elements (#​14756) (090b2e3)
• compiler-sfc: resolve type re-exports inside declare global (#​14766) (acfffe3)
• reactivity: prevent orphan effect when created in a stopped scope (#​14778) (c8e2d4a), closes #​14777
• runtime-core: avoid symbol coercion during props validation (#​8539) (23d4fb5), closes #​8487
• suspense: avoid DOM leak with out-in transition in v-if fragment (#​14762) (9667e0d), closes #​14761

vuejs/router (vue-router)

v5.1.0

Compare Source

   🚀 Features

• Typed definePage params.path  -  by @​posva in #​2716 (d65de)
• Strict type for definePage param default  -  by @​posva (0ae10)
• Support raw param parsers  -  by @​posva (eadec)
• Force array type raw param parsers  -  by @​posva (7a68b)
• Allow overriding the global Router type  -  by @​posva (1cd93)
• Emit runtime warning for invalid format in query params  -  by @​posva (8259a)
• Override useRouter() return with experimental types config  -  by @​posva (39a34)
• Allow string as a param parser for convenience  -  by @​posva (be37b)

   🐞 Bug Fixes

• Fix auto import fixes and make experimental esm only  -  by @​posva (db3a6)
• Deterministic param parser types order  -  by @​posva (bf0fc)
• Avoid importing unused param parsers  -  by @​posva (41c00)
• Filter invalid query params without failing to match  -  by @​posva (db717)
• Detect not set format  -  by @​posva (aa89e)
• Allow undefined values for params in query  -  by @​posva (4726e)
• experimental: Repeatable params in subsegments  -  by @​posva (84664)
• types: Add vite as optional peer dependency  -  by @​ForgottenR, @​posva and shihuijie in #​2712 (facbf)

    View changes on GitHub

v5.0.7

Compare Source

   🚀 Features

• Upgrade to babel 8  -  by @​posva (8d3e6)
• Make defineParamParser() more intuitive  -  by @​posva (8715b)
• Upgrade @vue/devtools-api  -  by @​posva (87c3a)
• matcher: Hint at params: {} workaround in discarded params warning  -  by @​posva and shanliuling in #​2689 (c2b13)
• param-parsers: Add include/exclude options  -  by @​posva (91cde)

   🐞 Bug Fixes

• matcher:
  • Finalize param token before processing escaped colon  -  by @​babu-ch and @​posva in #​2654 (20521)
• query:
  • Use Object.create(null) to prevent prototype pollution  -  by @​wdskuki, wdsmini and @​posva in #​2661 (be88c)
• resolve:
  • Omit empty optional params from resolved params  -  by @​babu-ch and @​posva in #​2434 (1ef09)
• types:
  • Wire RouteNamedMap via generated routes.d.ts  -  by @​posva in #​2700 (aef99)
• unplugin:
  • Avoid generating empty routes  -  by @​FrontEndDog and @​posva in #​2642 (10a8b)
  • Apply definePage path-param parser overrides  -  by @​posva in #​2699 (c8074)
• volar:
  • Drop runtime @vue/language-core import  -  by @​danielroe in #​2710 (8af50)

    View changes on GitHub

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.