chore(deps): update nuxt framework

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@nuxt/kit (source)	^4.5.0 → ^4.5.2
@nuxt/schema (source)	^4.5.0 → ^4.5.2
nuxt (source)	5.0.0-29745766.482f3357 → 5.0.0-29771183.e0c51e57

---

Release Notes

nuxt/nuxt (@​nuxt/kit)

v4.5.2

Compare Source

4.5.2 is the next patch release.

👉 Changelog

compare changes

🔥 Performance

• nuxt,kit: Skip rewriting unchanged generated files (#​35902)
• kit,nuxt: Use lazy imports to improve parsing speed (#​35901)
• vite: Skip html entry probes in bare-import resolver (#​35907)
• nuxt: Reuse app and component scans for unchanged structures (#​35912)

🩹 Fixes

• vite: Resolve client manifest path from resolved config (#​35883)
• nuxt: Use client-side navigation for links inside islands (#​35806)
• nuxt: Generate types for route params defined with definePageMeta (#​35857)
• nuxt: Serialize island payloads for components with underscores in keys (#​35807)
• nitro: Dedupe island renders when prerendering (#​35835)
• nuxt: Drop prefetch hints for never-hydrated chunks (#​35812)
• vite: Use same asset filenames for worker builds (#​35866)
• nitro: Reject non-object island props (#​35867)
• nuxt: Support options api in v-for islands transform (#​35877)
• nuxt: Improve page meta extraction + performance (#​35869)
• nuxt: Set build outputs when restoring vue cache (#​35895)
• kit: Honour nested apply and applyToEnvironment in vite wrapper (#​35899)
• nuxt: Re-check for preview mode after prerendered page hydration (#​35886)
• kit,nuxt,vite: Handle missed chokidar watch events (#​35887)
• nuxt: Settle asyncData status when bailing (#​35908)
• kit: Clone resolved config with klona rather than klona/full (#​35914)
• kit: Honour nested plugins' enforce in vite wrapper (#​35916)
• nuxt: Collect build cache once build outputs are final (#​35929)
• vite: Resolve vite env api sourcemaps in vite-node (#​35758)
• nuxt: Don't warn about missing <NuxtPage> on nav + with slot (#​35948)
• kit: Prepend vite environment wrapper plugin when prepend is set (#​35942)
• nuxt: Depend on rolldown as a peer to reuse vite's copy (3fda97f60)
• nitro: Define import.meta.test for server code (#​35987)
• nuxt: Match route rules against decoded paths (9123ed850)

💅 Refactors

• nuxt: Use vue-component-type-helpers instead of locally maintained helpers (#​35840)
• nuxt: Use isReferenceIdentifier in page-meta plugin (#​35882)

📖 Documentation

• Sync mcp server page with live tools and providers (#​35856)
• Add server components guide and mostly-static site recipe (#​35778)
• Minor changes (#​33479)
• Add accessible routing guide (#​34796)
• Update testing guide to test-utils v4.1.0 (#​35873)
• Update .env provider reference from dotenv to c12 (#​35911)
• Add note to avoid using defineVitestProject in e2e tests (#​35926)
• Update roadmap (f6e6027fe)

📦 Build

• ui-templates: Copy generated templates from resolved output dir (#​35921)

🏡 Chore

• nuxt: Bump @nuxt/devtools to v3.4.0 (#​35892)
• Fix lint (1951a2489)
• Throw error with cause in script (a90608d5c)
• Lint notification script 🤦 (429a96b24)
• Ignore safe pull_request_target (035a3a3d4)
• Reorder ignore (3baf6fedd)
• Bump nuxt rolldown peer dep to match unctx (2c38086f5)

✅ Tests

• Skip webpack dev tests for island v-for transform (73030e55a)
• Add regression test for #​35893 (#​35893)
• vite: Cover windows drive letters in toFsUrl (a5ad667f7)

🤖 CI

• Shard the critical-path test jobs and cache playwright (#​35832)
• Add action to notify issues resolved on release (5fffe5718)
• Make notification script more resilient (5337bd357)
• Do not comment on issues in other repos (400dfdc11)
• Add explicit permissions: {} to workflows (2e1a1cbeb)
• Rebalance windows e2e matrix (dffe13742)
• Let contributors know prs are backported (3e416c54f)
• Regenerate templates in autofix job (95d33637f)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Matej Černý (@​cernymatej)
• Aubakirov Asker (@​Askerka00)
• Yoshihiro Yamaguchi (@​yamachi4416)
• Samuel Burkhard (@​samydoesit)
• Kenneth Sills (@​Kenneth-Sills)
• Spunkie (@​Spunkie)
• Bochkarev Ivan (@​Ibochkarev)
• Amulet Iris (@​KazariAI)
• Yash Bavadiya (@​xevrion)
• Alexander Lichter (@​TheAlexLichter)
• Mehraz Morshed (@​mehrazmorshed)
• mcrapts (@​mcrapts)
• Benjamin Canac (@​benjamincanac)
• Anthony Fu (@​antfu)

v4.5.1

Compare Source

⚠️ This is a security release. We recommend upgrading as soon as possible with npx nuxt upgrade --dedupe.

It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, cross-user payload disclosure on cached pages, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.

If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.

If you use the cache, swr or isr route rules, purge any CDN or edge cache after upgrading; a leaked _payload.json may already be cached upstream.

Full details: Nuxt Security Patch Releases and GitHub Security Advisories.

👉 Changelog

compare changes

🔥 Performance

• nitro: Replace island teleports in a single html pass (#​35515)
• nuxt: Add vue.optionsApi and disable it for v5+ (#​35791)
• nuxt: Without pages, skip client plugins that require routing (#​35794)
• nuxt: Skip payload revival plugin when ssr: false (#​35782)

🩹 Fixes

• nitro: Read rspack dev output fs lazily for server entry (#​35740)
• rspack,webpack: Resolve loaders and runtime deps from nuxt dirs (#​35568)
• nuxt: Return global route for useRoute in detached effect scope (#​35659)
• nuxt: Ignore custom name or path when reusing an existing page in pages:extend (#​35661)
• nuxt: Render client components in nested server components (#​35669)
• nuxt: Preserve explicit useFetch method inference (#​35671)
• nuxt: Revalidate cached route payloads instead of using force-cache (#​35672)
• nuxt: Correct default export detection in plugin metadata (#​35676)
• nuxt: Clear hide/reset timeouts in set() (#​35534)
• kit,nuxt,rspack,schema,webpack: Add .mts file extension in resolver (#​33845)
• nuxt: Preserve trailing slash in NuxtLink href when unset (#​35501)
• nuxt: Don't cross-pollute useAsyncData cache on reactive key change (#​35656)
• nuxt: Filter plugin dependencies by build target (#​35682)
• nuxt: Reload real page module on HMR of JSX render-function pages (#​35678)
• nuxt: Resolve @unhead/vue/* from nuxt's dependency tree (#​35690)
• kit: Surface module load errors instead of masking as missing (#​35497)
• nuxt: Type auto-imported $fetch with nitro's $Fetch (#​35704)
• nuxt: Don't reference app config sources in shared and node tsconfigs (#​35673)
• vite: Resolve SSR inlined CSS module class name mismatch (#​35610)
• nuxt: Generate layout types even when pages module is disabled (#​35717)
• nitro: Skip resource hints for stylesheets already rendered as blocking links (#​35691)
• kit: Dedupe layers that are both auto-scanned and explicitly extended (#​35712)
• nuxt: Don't apply scroll behaviour after a subsequent nav (#​35719)
• vite: Ensure server sourcemap-preserver plugin actually runs (#​35680)
• vite: Preserve css suffix when extracting ssr inline styles (#​35714)
• nuxt: Watch external component directories in development (#​35652)
• nuxt: Don't exclude client entry module from style extraction (#​35720)
• nuxt: Amend cleanup command in NUXT_B7014 error message (#​35735)
• nuxt: Only pull in vue-router when there are island pages (#​35739)
• vite: Suppress external warnings for internal vite-node paths (#​35744)
• nuxt: Use scope-aware oxc parser for auto-imports (#​35743)
• nuxt: Sync layout meta during middleware on SSR (#​35633)
• nitro: Add alias for h3 that pins it to the version nuxt depends on (#​35774)
• nuxt: Preserve query params in cached payload extraction (#​35696)
• nuxt: Mirror runtime route tree in generated typed-router types (#​35788)
• nuxt: Warn when an imports preset from cannot be resolved (#​35799)
• kit: Avoid mutating layer configs when resolving options (#​35729)
• nuxt: Convert inline route rules exactly or drop with a warning (#​35455)
• nitro,nuxt,vite: Dedupe and normalise global css links in dev (#​35834)
• vite: Register template HMR plugin on dev servers (929c6c138)
• nuxt: Remove dev error overlay when error is cleared (#​35821)
• rspack,webpack: Resolve bundled postcss defaults from builder (#​35823)
• schema: Normalise slashes in app.buildAssetsDir (#​35833)
• nitro: Bound island props and v-for to prevent unauthenticated DoS (4e35ae9ba)
• nitro: Confine runtime payload cache to prerendering (ac9b41a36)
• nuxt: Case-fold route rule keys to match folded lookups (ad624a75a)
• nitro: Require loopback peer for chrome devtools workspace endpoint (0769c4f9b)
• nuxt: Reject reserved template island prop under runtime compiler (ee6c84633)
• nuxt: Reject top-level as prop for islands (581651ff3)

💅 Refactors

• nuxt: Use tick based debounce for asyncData executes (#​34151)
• kit,nuxt: Replace semver with verkit (#​35713)
• rspack,webpack: Use DI model to split builders (#​35751)

📖 Documentation

• Add dev container setup guide (#​35665)
• Fix dev container setup guide (#​35666)
• Add explanation of 200.html and 404.html SPA fallbacks (#​34483)
• Expand payload extraction documentation (#​35648)
• Clarify NuxtLink componentName is the internal (devtools) name (#​35658)
• Add example for components dir pattern option (#​35663)
• Require a single root element (#​35677)
• Add reason for why you should never import Vue app code in nitro code (#​34481)
• Document disabling code-splitting with codeSplitting: false (#​35683)
• Document nuxt-client caveat for non-SFC components (#​35654)
• Clarify favicon does not use cdnURL by default (#​35681)
• Standardize section order and headings across docs (#​35685)
• Clarify onPrehydrate example comment (#​35684)
• Add useId as a known limitation of nuxt island (#​35693)
• Recommend status over pending in data fetching (#​35694)
• Fill gaps in API minimalVersion badges after #​34485 (#​35708, #​34485)
• Explain dynamic asset paths (#​35695)
• Document runtimeConfig env var casting edge cases (#​35709)
• Clarify module dependency resolution (#​35718)
• Add more writing guidelines (#​35662)
• Add note with alternatives to using remote layers (#​35721)
• Use nuxt rather than nuxi (8891e179c)
• Document relative baseURL workarounds (#​34004)
• Warn about runtimeCompiler security best practices (449b63ab1)
• Warn about validating server component props (2c981cb07)

📦 Build

• nitro: Re-export type from augments to preserve module (dac937675)
• nuxt: Remove .ts file extension from runtime/ imports (#​35689)
• ui-templates: Commit generated ui template files (#​35770)

🏡 Chore

• Add extension 🤦 (d595fb3d4)
• Move to pnpm catalogs (#​35748)
• Update knip config, resolve issues, and run in ci (#​35742)
• Ignore @nuxt/telemetry in knip (9824d4f10)
• ui-templates: Pass config file path to unocss (34e7a810d)
• Allow regenerating lockfile in release script (c31389df3)
• nuxt: Bump @nuxt/devtools to v3.3.1 (#​35815)
• Ensure types are setup before unit tests (784d8f700)
• Simplify knip configuration (#​35827)

✅ Tests

• Reproduce duplicate CSS in shared chunks (#​35649)
• Prepare fixtures automatically before fixture and e2e runs (e8b3e6411)
• Improve and refactor basic fixture (#​35687)
• Slim down client-only, chunk-error and axis-independent suites (#​35706)
• Do not run type checking when benchmarking nuxt build (6355f3bc9)
• kit: Scope loadNuxt temp dir so it doesn't delete sibling fixtures (37301dd51)
• Guard against transient undefined _route in gotoPath (ca92d082b)
• Retry fixture prepare on transient ENOTEMPTY (3a6b59f96)
• Raise route-HMR polling timeout to reduce e2e flakiness (01dc27b7e)
• Update bundle size snapshot (30d24817c)

🤖 CI

• Rebalance shards and drop non-vite windows fixtures (#​35700)
• Warm windows dependency cache on main (#​35730)
• Run knip in default and production modes (#​35745)
• Run knip on pull requests (d620aa972)
• Prepare tests (c7bf7f738)
• Also prepare tests in knip job (58f68bd64)
• Check internal docs links on pull requests and all links weekly (#​35767)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Lars Kappert (@​webpro)
• Matej Černý (@​cernymatej)
• Anthony Fu (@​antfu)
• Harlan Wilton (@​harlan-zw)
• Florian Heuberger (@​Flo0806)
• Anoesj Sadraee (@​Anoesj)
• Ryota Watanabe (@​wattanx)
• Alexander Lichter (@​TheAlexLichter)
• Nestor Vera (@​hacknug)
• Mateleo (@​Mateleo)
• Kevin Deng (@​sxzz)
• Robin (@​OrbisK)
• Bochkarev Ivan (@​Ibochkarev)
• Quentin Macq (@​quentinmcq)
• Julien Huang (@​huang-julien)
• Max (@​onmax)
• Luke Nelson (@​luc122c)
• Darlan José Batista do Prado (@​DarlanPrado)
• kealan (@​KealanAU)
• Sushant (@​sushantguri)
• raminjafary (@​raminjafary)
• Aubakirov Asker (@​Askerka00)
• lutejka (@​lutejka)
• Amulet Iris (@​KazariAI)
• bdbch (@​bdbch)
• Elecmonkey (@​elecmonkey)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Every minute (* * * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vite@​8.1.5 ⏵ 8.2.1	+1		+1	-1
	@​nuxt/​schema@​4.5.2
	@​nuxt/​kit@​4.5.2

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[pkg-pr-new]

npm i https://pkg.pr.new/@nuxt/icon@509

commit: f4d7216