Skip to content

chore: Update all non-major dependencies - #258

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore: Update all non-major dependencies#258
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence Type Update Pending
@graphql-tools/graphql-tag-pluck (source) ^8.3.33 → ^8.3.35 age adoption passing confidence devDependencies patch
@iconify-json/lucide ^1.2.117 → ^1.2.121 age adoption passing confidence dependencies patch 1.2.122
@nuxt/content (source) ^3.15.0 → ^3.15.2 age adoption passing confidence dependencies patch
@nuxt/eslint-config (source) ^1.16.0 → ^1.17.0 age adoption passing confidence devDependencies minor
@​nuxt/icon ^2.3.1 → ^2.4.1 age adoption passing confidence dependencies minor
@nuxt/image (source) ^2.0.0 → ^2.1.0 age adoption passing confidence dependencies minor
@nuxt/kit (source) ^4.4.8 → ^4.5.2 age adoption passing confidence dependencies minor
@nuxt/module-builder ^1.0.2 → ^1.0.3 age adoption passing confidence devDependencies patch
@nuxt/schema (source) ^4.4.8 → ^4.5.2 age adoption passing confidence devDependencies minor
@nuxt/test-utils ^4.0.3 → ^4.1.0 age adoption passing confidence devDependencies minor
@nuxt/ui (source) ^4.9.0 → ^4.10.0 age adoption passing confidence dependencies patch
@nuxtjs/i18n (source) ^10.4.1 → ^10.6.0 age adoption passing confidence dependencies minor
actions/checkout v7.0.0 → v7.0.1 age adoption passing confidence action patch
better-sqlite3 ^13.0.2 → ^13.0.3 age adoption passing confidence dependencies patch
docus ^5.12.2 → ^5.12.3 age adoption passing confidence dependencies patch
eslint (source) ^10.7.0 → ^10.8.0 age adoption passing confidence devDependencies minor 10.8.1
eslint (source) ^10.6.0 → ^10.8.0 age adoption passing confidence devDependencies minor 10.8.1
giget ^3.3.0 → ^3.3.1 age adoption passing confidence dependencies patch
happy-dom ^20.10.6 → ^20.11.1 age adoption passing confidence devDependencies minor 20.11.2
knip (source) ^6.26.0 → ^6.32.0 age adoption passing confidence devDependencies minor
minimatch ^10.2.5 → ^10.2.6 age adoption passing confidence dependencies patch
node 24.18.0 → 24.19.0 age adoption passing confidence uses-with minor
nuxt (source) ^4.4.8 → ^4.5.2 age adoption passing confidence dependencies minor
nuxt (source) ^3.21.8 → ^3.21.11 age adoption passing confidence dependencies patch
nuxt (source) ^4.4.8 → ^4.5.2 age adoption passing confidence devDependencies minor
pnpm (source) 11.5.3 → 11.20.0 age adoption passing confidence packageManager minor
pnpm/action-setup v6.0.9 → v6.0.10 age adoption passing confidence action patch
reka-ui ^2.10.0 → ^2.10.1 age adoption passing confidence dependencies patch
tailwindcss (source) ^4.3.1 → ^4.3.3 age adoption passing confidence dependencies patch
vite (source) ^8.1.4 → ^8.2.0 age adoption passing confidence devDependencies minor 8.2.1
vue (source) ^3.5.39 → ^3.5.41 age adoption passing confidence dependencies patch
vue-tsc (source) ^3.3.7 → ^3.3.9 age adoption passing confidence devDependencies patch

Release Notes

ardatan/graphql-tools (@​graphql-tools/graphql-tag-pluck)

v8.3.35

Compare Source

Patch Changes

v8.3.34

Compare Source

Patch Changes
nuxt/content (@​nuxt/content)

v3.15.2

Compare Source

Bug Fixes
  • dev: ignore temporary files in content source paths (#​3784) (a019e70)
  • security: reject SQL function calls in query WHERE clauses (#​3819) (847d523)

v3.15.1

Compare Source

Bug Fixes
nuxt/eslint (@​nuxt/eslint-config)

v1.17.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
nuxt/image (@​nuxt/image)

v2.1.0

Compare Source

v2.1.0 is the next minor release.

👀 Highlights

Nuxt Image 2.1 ships eight new image providers, a major upgrade to our image processing engine, and a bunch of fixes across existing providers.

🖼️ IPX v4

Under the hood, we've upgraded to IPX v4 which brings significant improvements:

  • Smaller bundles: IPX is now ESM-only with reduced dependency size
  • Stronger SVG security: SVG sanitization now always runs, regardless of optimization settings. This fixes a potential XSS vector where svgo: false would return untouched SVGs. The sanitizer now removes SMIL attribute injection, foreign content (<foreignObject>, <iframe>, etc.), and unsafe URIs across all elements
  • New image modifiers: opacity, brightness, saturation, hue, lightness, autoorient, dilate, erode, clahe, and linear
  • Better error messages: Invalid modifier arguments now return 400 errors with clear messages instead of cryptic 500s
  • Custom URL parsing: IPX now supports custom URL formats via the parseURL option
🌐 New Providers

This release adds support for eight new image optimization services:

🔧 Provider Improvements
  • Directus: Added support for sharp transforms and a key modifier for named presets (#​2207)
  • Sanity: Support for absolute URLs with automatic project/dataset extraction (#​2274), and a configurable baseURL for custom CDN setups (#​2273)
  • AWS Amplify & Vercel: minimumCacheTTL is now configurable (#​2278)
📦 Type Exports

NuxtImgProps and NuxtPictureProps are now exported from the runtime, making it easier to type your own components that wrap <NuxtImg> or <NuxtPicture> (#​2115).

import type { NuxtImgProps, NuxtPictureProps } from '#image'

👉 Changelog

compare changes

🚀 Enhancements
  • deps: migrate to ipx v4 (#​2094)
  • provider: add EdgeOne Pages provider (#​2173)
  • imgproxy: add provider (#​2117)
  • directus: add sharp transforms & key modifier (#​2207)
  • sanity: support absolute URLs with project and dataset extraction (#​2274)
  • awsAmplify,vercel: make minimumCacheTTL configurable (#​2278)
  • sanity: add configurable baseURL option to Sanity provider (#​2273)
  • runtime: export Picture and Image props types (#​2115)
  • umbraco: add image provider (#​2165)
  • flyimg: add Flyimg built-in provider (#​2125)
  • cloudflareimages: add new provider (#​2100)
  • builderio: add Builder.io Image API provider (#​2050)
  • picsum: add Lorem Picsum placeholder image provider (#​2106)
  • supabase: add image provider (#​2027)
🩹 Fixes
  • flyimg: encode all # characters in color values (137ee63)
  • remove duplicated provider key in generated image options (#​2279)
  • nuxt-picture: align preload link type with unhead v3 (#​2254)
  • github: set max size of 460 (7e561f6)
  • umbraco: shallow clone modifiers before modifying (237e480)
  • cloudflare: add baseURL for urls with no operations (#​2162)
  • nuxt-img: set imagesrcset preload when densities are set w/o sizes (#​2176)
  • fastly: handle absolute URLs and merge preexisting query params (#​2140)
  • ipx: merge user-defined runtimeConfig.ipx with defaults (#​2134)
  • directus: add withoutEnlargement modifier type (#​2133)
  • shopify: merge preexisting query params with modifiers (#​2135)
  • reduce max-width breakpoint values by 1px (#​2132)
  • netlifyImageCdn,netlifyLargeMedia: set netlify remote_images config (#​2086)
  • deduplicate formats (#​2038)
  • sanitise custom provider import names (#​2092)
  • guard access from layer.config.image (23b8cef)
  • bunny: merge query params with existing image src (#​2054)
  • do not shadow custom provider types with builtins (#​2016)
  • nuxt-picture: allow data-* in imgAttrs (#​2017)
  • resolve public/ dir in relation to rootDir (3e07761)
📖 Documentation
  • sanity: document baseURL option (6f59ab1)
  • shopify: update NuxtImg syntax to use v-bind for modifiers (#​2277)
  • update list of auto-detected providers (#​2147)
  • add sharp cross-platform installation section (#​2142)
  • add preload example for NuxtImg (#​2124)
  • exempt patterns from cf _routes.json (#​2136)
  • update placeholder attributes in <NuxtImg /> example (#​2074)
  • add nuxt.care health badge (93de8a9)
  • update docus and add mcp name (#​2080)
  • reference from Vercel's Edge Network to Vercel's CDN for image optimization. (2deacc0)
  • fix Nuxt badge icon (#​2049)
  • update installation warning (#​2061)
  • fix storyblok links (#​2046)
  • add deno example (#​2012)
📦 Build
  • deps: bump serialize-javascript from 7.0.4 to 7.0.5 (#​2249)
  • deps: bump js-cookie from 3.0.5 to 3.0.7 (#​2248)
  • deps: bump ws from 8.17.1 to 8.20.1 (#​2246)
  • deps: bump h3 from 1.15.6 to 1.15.9 (#​2177)
  • deps: bump h3 from 1.15.4 to 1.15.5 (#​2085)
🏡 Chore
  • run module prepare in prepack (97d3758)
  • move consola to dev dependencies (#​2275)
  • migrate to pnpm v11 (#​2236)
  • migrate resolutions to pnpm-workspace.yaml (9b80ce6)
  • migrate npm badges and links to npmx.dev (fd87f7d)
  • remove unused slot-related code from <NuxtPicture> (#​2145)
  • update lint scripts in package.json (#​2139)
  • remove deprecated github silent config (#​2026)
  • revert pnpm trust policy and restore provenance action (13b88c1)
  • update pnpm to 10.21 and enable trust policy (03b5ef4)
🤖 CI
  • add workflow to comment on issues resolved in the latest release (e529f37)
  • improve workflows (#​2288)
  • migrate to uppt (#​2286)
  • migrate agentscan-action to v2 (2f8b332)
  • add agent-scan workflow to flag bot-authored PRs (23ee710)
  • add merge group config (#​2137)
  • rename workflow (777239c)
  • avoid checkout for reproduction comment (a200dae)
  • pin github actions to full-length commit shas (f60d0f7)
  • unpin workflow (d1cb12b)
  • try pinning (09e5efb)
  • update var (402c729)
  • use new shared dependency review workflow (906111c)
🎉 New Contributors
❤️ Contributors
nuxt/nuxt (@​nuxt/kit)

v4.5.2

Compare Source

4.5.2 is the next patch release.

👉 Changelog

compare changes

🔥 Performance
  • nuxt,kit: Skip rewriting unchanged generated files (#​35902)
  • kit,nuxt: Use lazy imports to improve parsing speed (#​35901)
  • vite: Skip html entry probes in bare-import resolver (#​35907)
  • nuxt: Reuse app and component scans for unchanged structures (#​35912)
🩹 Fixes
  • vite: Resolve client manifest path from resolved config (#​35883)
  • nuxt: Use client-side navigation for links inside islands (#​35806)
  • nuxt: Generate types for route params defined with definePageMeta (#​35857)
  • nuxt: Serialize island payloads for components with underscores in keys (#​35807)
  • nitro: Dedupe island renders when prerendering (#​35835)
  • nuxt: Drop prefetch hints for never-hydrated chunks (#​35812)
  • vite: Use same asset filenames for worker builds (#​35866)
  • nitro: Reject non-object island props (#​35867)
  • nuxt: Support options api in v-for islands transform (#​35877)
  • nuxt: Improve page meta extraction + performance (#​35869)
  • nuxt: Set build outputs when restoring vue cache (#​35895)
  • kit: Honour nested apply and applyToEnvironment in vite wrapper (#​35899)
  • nuxt: Re-check for preview mode after prerendered page hydration (#​35886)
  • kit,nuxt,vite: Handle missed chokidar watch events (#​35887)
  • nuxt: Settle asyncData status when bailing (#​35908)
  • kit: Clone resolved config with klona rather than klona/full (#​35914)
  • kit: Honour nested plugins' enforce in vite wrapper (#​35916)
  • nuxt: Collect build cache once build outputs are final (#​35929)
  • vite: Resolve vite env api sourcemaps in vite-node (#​35758)
  • nuxt: Don't warn about missing <NuxtPage> on nav + with slot (#​35948)
  • kit: Prepend vite environment wrapper plugin when prepend is set (#​35942)
  • nuxt: Depend on rolldown as a peer to reuse vite's copy (3fda97f60)
  • nitro: Define import.meta.test for server code (#​35987)
  • nuxt: Match route rules against decoded paths (9123ed850)
💅 Refactors
  • nuxt: Use vue-component-type-helpers instead of locally maintained helpers (#​35840)
  • nuxt: Use isReferenceIdentifier in page-meta plugin (#​35882)
📖 Documentation
  • Sync mcp server page with live tools and providers (#​35856)
  • Add server components guide and mostly-static site recipe (#​35778)
  • Minor changes (#​33479)
  • Add accessible routing guide (#​34796)
  • Update testing guide to test-utils v4.1.0 (#​35873)
  • Update .env provider reference from dotenv to c12 (#​35911)
  • Add note to avoid using defineVitestProject in e2e tests (#​35926)
  • Update roadmap (f6e6027fe)
📦 Build
  • ui-templates: Copy generated templates from resolved output dir (#​35921)
🏡 Chore
✅ Tests
🤖 CI
  • Shard the critical-path test jobs and cache playwright (#​35832)
  • Add action to notify issues resolved on release (5fffe5718)
  • Make notification script more resilient (5337bd357)
  • Do not comment on issues in other repos (400dfdc11)
  • Add explicit permissions: {} to workflows (2e1a1cbeb)
  • Rebalance windows e2e matrix (dffe13742)
  • Let contributors know prs are backported (3e416c54f)
  • Regenerate templates in autofix job (95d33637f)
❤️ Contributors

v4.5.1

Compare Source

⚠️ This is a security release. We recommend upgrading as soon as possible with npx nuxt upgrade --dedupe.

It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, cross-user payload disclosure on cached pages, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.

If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.

If you use the cache, swr or isr route rules, purge any CDN or edge cache after upgrading; a leaked _payload.json may already be cached upstream.

Full details: Nuxt Security Patch Releases and GitHub Security Advisories.

👉 Changelog

compare changes

🔥 Performance
  • nitro: Replace island teleports in a single html pass (#​35515)
  • nuxt: Add vue.optionsApi and disable it for v5+ (#​35791)
  • nuxt: Without pages, skip client plugins that require routing (#​35794)
  • nuxt: Skip payload revival plugin when ssr: false (#​35782)
🩹 Fixes
  • nitro: Read rspack dev output fs lazily for server entry (#​35740)
  • rspack,webpack: Resolve loaders and runtime deps from nuxt dirs (#​35568)
  • nuxt: Return global route for useRoute in detached effect scope (#​35659)
  • nuxt: Ignore custom name or path when reusing an existing page in pages:extend (#​35661)
  • nuxt: Render client components in nested server components (#​35669)
  • nuxt: Preserve explicit useFetch method inference (#​35671)
  • nuxt: Revalidate cached route payloads instead of using force-cache (#​35672)
  • nuxt: Correct default export detection in plugin metadata (#​35676)
  • nuxt: Clear hide/reset timeouts in set() (#​35534)
  • kit,nuxt,rspack,schema,webpack: Add .mts file extension in resolver (#​33845)
  • nuxt: Preserve trailing slash in NuxtLink href when unset (#​35501)
  • nuxt: Don't cross-pollute useAsyncData cache on reactive key change (#​35656)
  • nuxt: Filter plugin dependencies by build target (#​35682)
  • nuxt: Reload real page module on HMR of JSX render-function pages (#​35678)
  • nuxt: Resolve @unhead/vue/* from nuxt's dependency tree (#​35690)
  • kit: Surface module load errors instead of masking as missing (#​35497)
  • nuxt: Type auto-imported $fetch with nitro's $Fetch (#​35704)
  • nuxt: Don't reference app config sources in shared and node tsconfigs (#​35673)
  • vite: Resolve SSR inlined CSS module class name mismatch (#​35610)
  • nuxt: Generate layout types even when pages module is disabled (#​35717)
  • nitro: Skip resource hints for stylesheets already rendered as blocking links (#​35691)
  • kit: Dedupe layers that are both auto-scanned and explicitly extended (#​35712)
  • nuxt: Don't apply scroll behaviour after a subsequent nav (#​35719)
  • vite: Ensure server sourcemap-preserver plugin actually runs (#​35680)
  • vite: Preserve css suffix when extracting ssr inline styles (#​35714)
  • nuxt: Watch external component directories in development (#​35652)
  • nuxt: Don't exclude client entry module from style extraction (#​35720)
  • nuxt: Amend cleanup command in NUXT_B7014 error message (#​35735)
  • nuxt: Only pull in vue-router when there are island pages (#​35739)
  • vite: Suppress external warnings for internal vite-node paths (#​35744)
  • nuxt: Use scope-aware oxc parser for auto-imports (#​35743)
  • nuxt: Sync layout meta during middleware on SSR (#​35633)
  • nitro: Add alias for h3 that pins it to the version nuxt depends on (#​35774)
  • nuxt: Preserve query params in cached payload extraction (#​35696)
  • nuxt: Mirror runtime route tree in generated typed-router types (#​35788)
  • nuxt: Warn when an imports preset from cannot be resolved (#​35799)
  • kit: Avoid mutating layer configs when resolving options (#​35729)
  • nuxt: Convert inline route rules exactly or drop with a warning (#​35455)
  • nitro,nuxt,vite: Dedupe and normalise global css links in dev (#​35834)
  • vite: Register template HMR plugin on dev servers (929c6c138)
  • nuxt: Remove dev error overlay when error is cleared (#​35821)
  • rspack,webpack: Resolve bundled postcss defaults from builder (#​35823)
  • schema: Normalise slashes in app.buildAssetsDir (#​35833)
  • nitro: Bound island props and v-for to prevent unauthenticated DoS (4e35ae9ba)
  • nitro: Confine runtime payload cache to prerendering (ac9b41a36)
  • nuxt: Case-fold route rule keys to match folded lookups (ad624a75a)
  • nitro: Require loopback peer for chrome devtools workspace endpoint (0769c4f9b)
  • nuxt: Reject reserved template island prop under runtime compiler (ee6c84633)
  • nuxt: Reject top-level as prop for islands (581651ff3)
💅 Refactors
  • nuxt: Use tick based debounce for asyncData executes (#​34151)
  • kit,nuxt:

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 18 times, most recently from 30033fa to ca40284 Compare August 9, 2026 02:32
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from ca40284 to 5945d4c Compare August 9, 2026 06:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants