chore(deps): update nuxt core

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@nuxt/kit (source)	4.5.0 → 4.5.1
@nuxt/module-builder	1.0.2 → 1.0.3
@nuxt/test-utils	4.0.3 → 4.1.0
nuxt (source)	4.5.0 → 4.5.1

---

Release Notes

nuxt/nuxt (@​nuxt/kit)

v4.5.1

Compare Source

⚠️ This is a security release. We recommend upgrading as soon as possible with npx nuxt upgrade --dedupe.

It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, cross-user payload disclosure on cached pages, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.

If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.

If you use the cache, swr or isr route rules, purge any CDN or edge cache after upgrading; a leaked _payload.json may already be cached upstream.

Full details: Nuxt Security Patch Releases and GitHub Security Advisories.

👉 Changelog

compare changes

🔥 Performance

• nitro: Replace island teleports in a single html pass (#​35515)
• nuxt: Add vue.optionsApi and disable it for v5+ (#​35791)
• nuxt: Without pages, skip client plugins that require routing (#​35794)
• nuxt: Skip payload revival plugin when ssr: false (#​35782)

🩹 Fixes

• nitro: Read rspack dev output fs lazily for server entry (#​35740)
• rspack,webpack: Resolve loaders and runtime deps from nuxt dirs (#​35568)
• nuxt: Return global route for useRoute in detached effect scope (#​35659)
• nuxt: Ignore custom name or path when reusing an existing page in pages:extend (#​35661)
• nuxt: Render client components in nested server components (#​35669)
• nuxt: Preserve explicit useFetch method inference (#​35671)
• nuxt: Revalidate cached route payloads instead of using force-cache (#​35672)
• nuxt: Correct default export detection in plugin metadata (#​35676)
• nuxt: Clear hide/reset timeouts in set() (#​35534)
• kit,nuxt,rspack,schema,webpack: Add .mts file extension in resolver (#​33845)
• nuxt: Preserve trailing slash in NuxtLink href when unset (#​35501)
• nuxt: Don't cross-pollute useAsyncData cache on reactive key change (#​35656)
• nuxt: Filter plugin dependencies by build target (#​35682)
• nuxt: Reload real page module on HMR of JSX render-function pages (#​35678)
• nuxt: Resolve @unhead/vue/* from nuxt's dependency tree (#​35690)
• kit: Surface module load errors instead of masking as missing (#​35497)
• nuxt: Type auto-imported $fetch with nitro's $Fetch (#​35704)
• nuxt: Don't reference app config sources in shared and node tsconfigs (#​35673)
• vite: Resolve SSR inlined CSS module class name mismatch (#​35610)
• nuxt: Generate layout types even when pages module is disabled (#​35717)
• nitro: Skip resource hints for stylesheets already rendered as blocking links (#​35691)
• kit: Dedupe layers that are both auto-scanned and explicitly extended (#​35712)
• nuxt: Don't apply scroll behaviour after a subsequent nav (#​35719)
• vite: Ensure server sourcemap-preserver plugin actually runs (#​35680)
• vite: Preserve css suffix when extracting ssr inline styles (#​35714)
• nuxt: Watch external component directories in development (#​35652)
• nuxt: Don't exclude client entry module from style extraction (#​35720)
• nuxt: Amend cleanup command in NUXT_B7014 error message (#​35735)
• nuxt: Only pull in vue-router when there are island pages (#​35739)
• vite: Suppress external warnings for internal vite-node paths (#​35744)
• nuxt: Use scope-aware oxc parser for auto-imports (#​35743)
• nuxt: Sync layout meta during middleware on SSR (#​35633)
• nitro: Add alias for h3 that pins it to the version nuxt depends on (#​35774)
• nuxt: Preserve query params in cached payload extraction (#​35696)
• nuxt: Mirror runtime route tree in generated typed-router types (#​35788)
• nuxt: Warn when an imports preset from cannot be resolved (#​35799)
• kit: Avoid mutating layer configs when resolving options (#​35729)
• nuxt: Convert inline route rules exactly or drop with a warning (#​35455)
• nitro,nuxt,vite: Dedupe and normalise global css links in dev (#​35834)
• vite: Register template HMR plugin on dev servers (929c6c138)
• nuxt: Remove dev error overlay when error is cleared (#​35821)
• rspack,webpack: Resolve bundled postcss defaults from builder (#​35823)
• schema: Normalise slashes in app.buildAssetsDir (#​35833)
• nitro: Bound island props and v-for to prevent unauthenticated DoS (4e35ae9ba)
• nitro: Confine runtime payload cache to prerendering (ac9b41a36)
• nuxt: Case-fold route rule keys to match folded lookups (ad624a75a)
• nitro: Require loopback peer for chrome devtools workspace endpoint (0769c4f9b)
• nuxt: Reject reserved template island prop under runtime compiler (ee6c84633)
• nuxt: Reject top-level as prop for islands (581651ff3)

💅 Refactors

• nuxt: Use tick based debounce for asyncData executes (#​34151)
• kit,nuxt: Replace semver with verkit (#​35713)
• rspack,webpack: Use DI model to split builders (#​35751)

📖 Documentation

• Add dev container setup guide (#​35665)
• Fix dev container setup guide (#​35666)
• Add explanation of 200.html and 404.html SPA fallbacks (#​34483)
• Expand payload extraction documentation (#​35648)
• Clarify NuxtLink componentName is the internal (devtools) name (#​35658)
• Add example for components dir pattern option (#​35663)
• Require a single root element (#​35677)
• Add reason for why you should never import Vue app code in nitro code (#​34481)
• Document disabling code-splitting with codeSplitting: false (#​35683)
• Document nuxt-client caveat for non-SFC components (#​35654)
• Clarify favicon does not use cdnURL by default (#​35681)
• Standardize section order and headings across docs (#​35685)
• Clarify onPrehydrate example comment (#​35684)
• Add useId as a known limitation of nuxt island (#​35693)
• Recommend status over pending in data fetching (#​35694)
• Fill gaps in API minimalVersion badges after #​34485 (#​35708, #​34485)
• Explain dynamic asset paths (#​35695)
• Document runtimeConfig env var casting edge cases (#​35709)
• Clarify module dependency resolution (#​35718)
• Add more writing guidelines (#​35662)
• Add note with alternatives to using remote layers (#​35721)
• Use nuxt rather than nuxi (8891e179c)
• Document relative baseURL workarounds (#​34004)
• Warn about runtimeCompiler security best practices (449b63ab1)
• Warn about validating server component props (2c981cb07)

📦 Build

• nitro: Re-export type from augments to preserve module (dac937675)
• nuxt: Remove .ts file extension from runtime/ imports (#​35689)
• ui-templates: Commit generated ui template files (#​35770)

🏡 Chore

• Add extension 🤦 (d595fb3d4)
• Move to pnpm catalogs (#​35748)
• Update knip config, resolve issues, and run in ci (#​35742)
• Ignore @nuxt/telemetry in knip (9824d4f10)
• ui-templates: Pass config file path to unocss (34e7a810d)
• Allow regenerating lockfile in release script (c31389df3)
• nuxt: Bump @nuxt/devtools to v3.3.1 (#​35815)
• Ensure types are setup before unit tests (784d8f700)
• Simplify knip configuration (#​35827)

✅ Tests

• Reproduce duplicate CSS in shared chunks (#​35649)
• Prepare fixtures automatically before fixture and e2e runs (e8b3e6411)
• Improve and refactor basic fixture (#​35687)
• Slim down client-only, chunk-error and axis-independent suites (#​35706)
• Do not run type checking when benchmarking nuxt build (6355f3bc9)
• kit: Scope loadNuxt temp dir so it doesn't delete sibling fixtures (37301dd51)
• Guard against transient undefined _route in gotoPath (ca92d082b)
• Retry fixture prepare on transient ENOTEMPTY (3a6b59f96)
• Raise route-HMR polling timeout to reduce e2e flakiness (01dc27b7e)
• Update bundle size snapshot (30d24817c)

🤖 CI

• Rebalance shards and drop non-vite windows fixtures (#​35700)
• Warm windows dependency cache on main (#​35730)
• Run knip in default and production modes (#​35745)
• Run knip on pull requests (d620aa972)
• Prepare tests (c7bf7f738)
• Also prepare tests in knip job (58f68bd64)
• Check internal docs links on pull requests and all links weekly (#​35767)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Lars Kappert (@​webpro)
• Matej Černý (@​cernymatej)
• Anthony Fu (@​antfu)
• Harlan Wilton (@​harlan-zw)
• Florian Heuberger (@​Flo0806)
• Anoesj Sadraee (@​Anoesj)
• Ryota Watanabe (@​wattanx)
• Alexander Lichter (@​TheAlexLichter)
• Nestor Vera (@​hacknug)
• Mateleo (@​Mateleo)
• Kevin Deng (@​sxzz)
• Robin (@​OrbisK)
• Bochkarev Ivan (@​Ibochkarev)
• Quentin Macq (@​quentinmcq)
• Julien Huang (@​huang-julien)
• Max (@​onmax)
• Luke Nelson (@​luc122c)
• Darlan José Batista do Prado (@​DarlanPrado)
• kealan (@​KealanAU)
• Sushant (@​sushantguri)
• raminjafary (@​raminjafary)
• Aubakirov Asker (@​Askerka00)
• lutejka (@​lutejka)
• Amulet Iris (@​KazariAI)
• bdbch (@​bdbch)
• Elecmonkey (@​elecmonkey)

nuxt/module-builder (@​nuxt/module-builder)

v1.0.3

Compare Source

v1.0.3 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes

• update command defaults and descriptions (#​677)

📦 Build

• migrate to tsdown (#​765)

🏡 Chore

• migrate to pnpm v11 (#​738)
• remove shamefully-hoist (#​580)
• migrate resolutions/pnpm.overrides to pnpm-workspace.yaml (cfb45fb)
• migrate npm badges and links to npmx.dev (afcf2fa)
• revert pnpm trust policy and restore provenance action (aeb1d38)
• update pnpm to 10.21 and enable trust policy (92eb2af)

✅ Tests

• accept nuxt/app specifier for NuxtError in snapshot (809c89f)
• update v4.5 error type as well (9412c91)
• accept either #app or nuxt/app in generated declarations (#​727)

🤖 CI

• use uppt release workflow (604d5b3)
• add agent-scan workflow to flag bot-authored PRs (4442a14)
• rename workflow (f7be1a6)
• avoid checkout in reproduction (57e7ce9)
• pin github actions to full-length commit shas (c3c8e72)
• add provenance action to check for downgrades in provenance (d87d217)
• run tests on node 20 (54c5f13)

🎉 New Contributors

• Damian Głowala (@​DamianGlowala)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Damian Głowala (@​DamianGlowala)
• Bobbie Goede (@​BobbieGoede)

nuxt/test-utils (@​nuxt/test-utils)

v4.1.0

Compare Source

4.1.0 is the next minor release.

👉 Changelog

compare changes

🚀 Enhancements

• e2e: Silence server logs and allow customising log level (#​1735)
• runtime: Improve app.root and app.teleports html tag setup (#​1726)

🩹 Fixes

• e2e: Add warning message for e2e in nuxt vitest setup (#​1691)
• runtime-utils: Ensure RouterLink stub works with pages: false (#​1687)
• config: Patch ssr.resolve.conditions to remove import (#​1732)
• config: Browser setup in defineVitestProject (#​1724)
• config: Inline config for useRuntimeConfig() composable (#​1737)
• config: Nested browser-mode Nuxt Vitest projects with viteEnvironmentApi (#​1708)

📦 Build

• Migrate to tsdown (#​1720)

🏡 Chore

• Drop pkg.pr.new nitro resolution (#​1681)
• Migrate to pnpm v11 (#​1701)
• Move h3-next to optional dependencies (#​1733)

✅ Tests

• Add test for autoImport: false (#​1688)

🤖 CI

• Add agent-scan workflow to flag bot-authored PRs (13dd49cde)
• Migrate agentscan-action to v2 (08f8ee220)

❤️ Contributors

• Yoshihiro Yamaguchi (@​yamachi4416)
• Peter Budai (@​peterbud)
• Daniel Roe (@​danielroe)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

✅ Deploy Preview for html-validator ready!

Name	Link
🔨 Latest commit	e1766c8
🔍 Latest deploy log	https://app.netlify.com/projects/html-validator/deploys/6a69a497a5b3590008f06e4c
😎 Deploy Preview	https://deploy-preview-852--html-validator.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 55.05%. Comparing base (301f5e4) to head (e1766c8).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #852   +/-   ##
=======================================
  Coverage   55.05%   55.05%           
=======================================
  Files           4        4           
  Lines          89       89           
  Branches       29       29           
=======================================
  Hits           49       49           
  Misses         40       40           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.