chore(deps-dev): bump nuxt from 3.8.2 to 3.21.10

[dependabot]

Bumps nuxt from 3.8.2 to 3.21.10.

Release notes

Sourced from nuxt's releases.

v3.21.10

⚠️ This is a security release. We recommend upgrading as soon as possible with npx nuxt upgrade --dedupe.

It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.

If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.

Full details: Nuxt Security Patch Releases and GitHub Security Advisories.

👉 Changelog

compare changes

🩹 Fixes

• nuxt: Clear hide/reset timeouts in set() (#35534)
• nuxt: Preserve trailing slash in NuxtLink href when unset (#35501)
• vite: Resolve SSR inlined CSS module class name mismatch (#35610)
• nuxt: Sync layout meta during middleware on SSR (#35633)
• nuxt: Update client URL to match SSR on fatal middleware error (#35637)
• nuxt: Watch external component directories in development (#35652)
• nuxt: Don't cross-pollute useAsyncData cache on reactive key change (#35656)
• nuxt: Return global route for useRoute in detached effect scope (#35659)
• nuxt: Ignore custom name or path when reusing an existing page in pages:extend (#35661)
• nuxt: Preserve explicit useFetch method inference (#35671)
• nuxt: Correct default export detection in plugin metadata (#35676)
• nuxt: Reload real page module on HMR of JSX render-function pages (#35678)
• vite: Ensure server sourcemap-preserver plugin actually runs (#35680)
• nuxt: Resolve @unhead/vue/* from nuxt's dependency tree (#35690)
• nuxt: Don't apply scroll behaviour after a subsequent nav (#35719)
• vite: Preserve css suffix when extracting ssr inline styles (#35714)
• nuxt: Don't exclude client entry module from style extraction (#35720)
• kit: Avoid mutating layer configs when resolving options (#35729)
• nuxt: Generate layout types even when pages module is disabled (#35717)
• nitro: Skip resource hints for stylesheets already rendered as blocking links (#35691)
• nuxt: Revalidate cached route payloads instead of using force-cache (#35672)
• nuxt: Preserve query params in cached payload extraction (#35696)
• rspack,webpack: Resolve loaders and runtime deps from nuxt dirs (#35568)
• nuxt: Render client components in nested server components (#35669)
• nuxt: Remove dev error overlay when error is cleared (#35821)
• rspack,webpack: Resolve bundled postcss defaults from builder (#35823)
• schema: Normalise slashes in app.buildAssetsDir (#35833)
• nuxt: Case-fold route rule keys to match folded lookups (619963309)
• nitro: Require loopback peer for chrome devtools workspace endpoint (00f71bb65)
• nitro: Bound island props and v-for to prevent unauthenticated DoS (668cdfdfd)
• nuxt: Reject reserved template island prop under runtime compiler (5b60017f7)
• nuxt: Reject top-level as prop for islands (00a2b0494)

📖 Documentation

• Document relative baseURL workarounds (#34004)
• Warn about runtimeCompiler security best practices (b76c1a8bd)
• Warn about validating server component props (f6d72628d)

✅ Tests

... (truncated)

Commits

• deafc94 v3.21.10
• 00a2b04 fix(nuxt): reject top-level as prop for islands
• 5b60017 fix(nuxt): reject reserved template island prop under runtime compiler
• 668cdfd fix(nitro): bound island props and v-for to prevent unauthenticated DoS
• 6199633 fix(nuxt): case-fold route rule keys to match folded lookups
• aa5175b fix(nuxt): remove dev error overlay when error is cleared (#35821)
• a2271cc chore(deps): update all non-major dependencies (3.x) (#35819)
• d32dffa fix(nuxt): render client components in nested server components (#35669)
• 8958a22 fix(nuxt): preserve query params in cached payload extraction (#35696)
• e6c8ebb fix(nuxt): revalidate cached route payloads instead of using force-cache (#...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nuxt since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[changeset-bot]

⚠️ No Changeset found

Latest commit: ef42095

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[nx-cloud]

🤖 Nx Cloud AI Fix Eligible

An automatically generated fix could have helped fix failing tasks for this run, but Self-healing CI is disabled for this workspace. Visit workspace settings to enable it and get automatic fixes in future runs.

_{To disable these notifications, a workspace admin can disable them in workspace settings.}

---

View your CI Pipeline Execution ↗ for commit ef42095

Command	Status	Duration	Result
nx test @snippet/nuxt	❌ Failed	1m 12s	View ↗
nx test @builder.io/sdks	❌ Failed	7s	View ↗
nx test @e2e/solid	✅ Succeeded	4m 36s	View ↗
nx test @snippet/angular-17	✅ Succeeded	1m 40s	View ↗
nx test @snippet/vue	✅ Succeeded	2m 21s	View ↗
nx test @e2e/svelte	✅ Succeeded	4m 11s	View ↗
nx test @e2e/react-sdk-next-15-app	✅ Succeeded	4m 39s	View ↗
nx test @e2e/vue	✅ Succeeded	4m 17s	View ↗
Additional runs (38)	✅ Succeeded	...	View ↗

💡 Dealing with memory or CPU issues? See memory and CPU details with the resource usage add-on ↗.

---

☁️ Nx Cloud last updated this comment at 2026-08-06 15:03:11 UTC