Skip to content

chore(deps): update nuxt framework to ^4.6.4 - #1643

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/nuxt
Open

chore(deps): update nuxt framework to ^4.6.4#1643
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/nuxt

Conversation

@renovate

@renovate renovate Bot commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@nuxt/kit (source) ^4.6.2 → ^4.6.4 age confidence
@nuxt/schema (source) ^4.6.2 → ^4.6.4 age confidence
@nuxt/schema@^4 (source) 4.6.2 → 4.6.4 age confidence
nuxt (source) ^4.6.2 → ^4.6.4 age confidence
nuxt (source) 4.6.2 → 4.6.4 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

nuxt/nuxt (@​nuxt/schema)

v4.6.4

Compare Source

4.6.4 is a security release. It fixes eight advisories in Nuxt and pulls in nitropack 2.13.6, which fixes three more in Nitro. We recommend upgrading as soon as you can.

⚠️ Behaviour changes

These probably won't affect most apps, but it's worth flagging anyway:

  1. Error details in production. When a page fails to render on the server, the error page and the payload now only carry message and data of errors you create with createError. Everything else is stripped.
  2. Dev server Host checks. Webpack and rspack dev servers now reject requests with an unexpected Host header, as Vite already does. If you use a custom hostname or tunnel, you'll need to add it to the new devServer.allowedHosts option.
  3. workspaceDir detection. When workspaceDir isn't set, Nuxt now only widens it past rootDir to an explicit workspace root or the closest git repository.
  4. Nitropack cached routes. cache, swr and isr route rules now only cache GET and HEAD requests, and no longer store responses that set a cookie or send Cache-Control: private or no-store. Wildcard proxy and redirect rules also reject requests whose resolved target would leave the rule's scope.
  5. Route rules and encoded slashes. Route rules now match paths that contain encoded slashes, so /api%2Fadmin is covered by a /api/** rule.

👉 Changelog

compare changes

🩹 Fixes
  • nitro,nuxt: require unrouting 0.3.2 (768d21368)
  • nitro: preserve wildcard tails in case-insensitive route rules (bf31e4cd8)
  • nitro: require nitropack 2.13.6 (1b13c6981)
  • nitro: keep leading double slash in renderer request path (75c12c6fb)
  • nuxt: use unambiguous encoding for island hash (6f1b93c64)
  • vite-server: resolve wildcard redirect tails from the matched segments (1e7dfa6a7)
  • nuxt: do not expose details of untrusted thrown errors (8c56b71e4)
  • nuxt: strip trailing slashes in linear time (97424dd21)
  • nitro,webpack: include hosts the CLI allows after loading the config (8c11d965d)
  • webpack: skip hot middleware for forbidden dev requests (3c9645326)
  • rspack,webpack: reject unexpected Host headers in dev middleware (f8d64c9aa)
  • schema,nitro,vite: add devServer.allowedHosts (3e1c7964e)
  • nitro,nuxt: match route rules for paths with encoded slashes (084396b10)
  • schema: only widen workspace dir to a declared workspace root (89d3306d1)
  • nitro: only trust x-forwarded-proto in when opted-in (#​36818)
  • nitro: stream the body read through a nuxt/server handler (#​36817)
  • kit: suggest the specific fix when loading falls back to jiti (24d75659d)
  • vite: use a single type checker (#​36774)
  • nitro,vite: remove windows + virtual dev ssr css links after hydration (#​36765)
  • nitro,vite: dedupe dev css by module node (#​36420)
  • nuxt: avoid hoisting setup-only values from definePageMeta (#​36751)
  • nuxt: only match hydration modifiers after lazy prefix (#​36750)
  • kit,nitro,nuxt: make emitted tsconfig/types stable across reruns (#​36747)
  • nuxt: render inlined component styles after stylesheet links (#​36714)
  • webpack: use valid devtool for hidden client sourcemaps in dev (#​36555)
📖 Documentation
  • clarify template dependency regeneration (#​36766)
  • revise README structure and headings (#​36772)
  • link the Nuxt DevTools docs on nuxt.com (#​36769)
  • warn against spreading untrusted objects onto server components (1225ca7ff)
  • update anchors for flat heading ids (#​36664)
🏡 Chore
  • add 1000-row listing routes to the benchmark (c852d871f)
  • add client page weight and browser timing suites (#​36788)
✅ Tests
🤖 CI
  • check unversioned docs links against branch docs version (d093c88b1)
  • skip unneeded checks for release prs (4b90681bd)
  • skip benchmarks in merge groups (6428070e0)
  • re-enable codspeed ⚡ (bc17c03d1)
❤️ Contributors

v4.6.3

Compare Source

v4.6.3 is the next patch release.

👉 Changelog

compare changes

🚨 Security fixes
🔥 Performance
  • vite: skip compiling plain style blocks in the server build (#​36711)
  • nitro,nuxt,rspack,webpack: bundle esm vue + reuse caches (#​36710)
  • vite: avoid quadratic nested dir check for fs.allow (#​36702)
  • nuxt: server render internal custom links without RouterLink (#​36707)
  • nuxt: skip unneeded typed routes generation (#​36645)
🩹 Fixes
  • nitro: don't share prerender hints with self-fetched requests (#​36705)
  • nuxt: defer app scope cleanup on external navigation (#​36713)
  • nuxt: prevent useCookie CookieStore sync from rewriting with refresh (#​36673)
  • nuxt: only return redirects from navigateTo while middleware runs (#​36650)
  • nuxt: remove purged entries from _asyncData (#​36709)
  • vite: skip quoted import.meta keys + limit replace to client dev (#​36703)
  • nuxt: hide RouteLocationRaw from navigateTo's public return type (#​36691)
  • nuxt: tree-shake auto-imported #app composables (#​36696)
  • nuxt: don't treat constrained route rules as covering dynamic pages (#​36701)
  • nuxt: include shared/ in build cache hash (#​36704)
  • nuxt: hash keyed function ids + page import names relative to rootDir (#​36697)
  • nuxt: encode page paths before matching route rule keys (#​36683)
  • nuxt: handle rejected updateCallbackDone of aborted view transition (#​36639)
  • ui-templates: keep loading shader proportions on narrow screens (#​36654)
  • nuxt: reject case-dependent route rule constraints w/ sensitive: false (#​36708)
  • nuxt: don't case-fold regex constraints in route rule keys (#​36694)
  • nuxt: normalise page prefix when finding route rule exceptions (#​36685)
  • vite: mirror ssr invalidations for created and deleted files (634cba64c)
  • nitro: keep noScripts wildcard patterns single-segment (fa323db7d)
  • deps: update unrouting to v0.3.1 (#​36663)
  • nuxt: avoid self-referencing nuxt/schema augmentation (#​36633)
  • nuxt: let nightly runtime resolve its own nuxt/* imports (#​36632)
  • nuxt: don't warn for vite+ vite.config files (#​36628)
  • kit: keep generated declaration first in tsconfig include (#​36627)
  • nuxt: clamp numeric v-for sources in island renders at render time (#​36623)
  • rspack,webpack: register vue-loader plugin only once per config (#​36622)
  • nitro: abort the portable request when the client disconnects (#​36652)
  • deps: update nitropack to 2.13.5 + drop obsolete workarounds (#​36649)
📖 Documentation
  • note provide/inject limit in server components (#​35837)
  • use American spelling in a few guides (#​36706)
  • document controlling prefetch hints via build:manifest hook (#​36695)
  • update StackBlitz link to point to version 4 (#​36674)
  • link to the 2.x docs (#​36640)
  • clarify that island props must be validated before iteration (4b12d15c9)
✅ Tests
  • list NUXT_B4023 as main-only (4fd54ff9a)
  • wait for leave transition before each scroll behaviour test (453406999)
  • vite: assert spa server bundle does not ship the app (#​36699)
  • nuxt: cover route rule coverage under a base url (#​36682)
  • list NUXT_B9006 as main-only (e107e0f40)
🤖 CI
  • only run full checks for the last merge queue entry (132698a46)
  • run a reduced matrix in the merge queue (7d228ba4b)
  • compare merge queue changes against the base branch (bad8c3637)
  • notify resolved issues after publishing a release (9d47884f3)
  • remove broken ai-moderator and ecosystem-ci trigger workflows (1d89ad434)
🎉 New Contributors
❤️ Contributors

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Every minute (* * * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from danielroe as a code owner October 28, 2026 04:09
@renovate

renovate Bot commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: capture/fixture/package-lock.json
npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code EALLOWREMOTE
npm error Fetching packages of type "remote" have been disabled
npm error Refusing to fetch "https://registry.npmjs.org/@parcel/watcher-wasm/-/watcher-wasm-2.6.0.tgz"
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-11-11T16_58_57_218Z-debug-0.log

@socket-security

socket-security Bot commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​nuxt/​schema@​4.6.49910010094100
Addednuxt@​4.6.49710010094100

View full report

@pkg-pr-new

pkg-pr-new Bot commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown

  • nuxt-cli-playground

    npm i https://pkg.pr.new/create-nuxt@1643

    npm i https://pkg.pr.new/nuxi@1643

    npm i https://pkg.pr.new/@nuxt/cli@1643

commit: 9764ff5

@github-actions

github-actions Bot commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CLI benchmark

@nuxt/cli v4.1.0-alpha.0 (baseline) vs v4.1.0-alpha.0 (this PR)

Metric baseline v4.1.0-alpha.0 head v4.1.0-alpha.0 Delta
nuxt --version wall time (median) 69 ms 69 ms +0.6%
nuxt --help wall time (median) 141 ms 141 ms -0.3%
nuxt dev --help wall time (median) 107 ms 107 ms -0.4%
nuxt --version modules loaded 35 35 0.0%
nuxt --version built-ins loaded 29 29 0.0%
nuxt --help modules loaded 136 136 0.0%
nuxt --help built-ins loaded 93 93 0.0%
nuxt dev --help modules loaded 65 65 0.0%
nuxt dev --help built-ins loaded 90 90 0.0%
Installed node_modules 2.56 MB 2.56 MB -0.0%
Published tarball (packed) 247.8 kB 247.8 kB -0.0%
Full report

@nuxt/cli v4.1.0-alpha.0 (baseline) vs v4.1.0-alpha.0 (head)

Setting Value
Baseline ref:196e2bb916bc3b97c4fd9e45be6d130b1d370fda (v4.1.0-alpha.0)
Head local packages/nuxt-cli at 7a6895a (v4.1.0-alpha.0)
Node v24.22.3
OS Linux 7.0.0 (kernel 7.0.0-1019-azure)
CPU AMD EPYC 9V74 80-Core Processor x 4
Memory 15.6 GB
Load average at start 1.10, 0.48, 0.24
Run started 2026-11-11T17:06:47.635Z

Cold CLI startup

Median of 15 interleaved runs per command, one warmup discarded.

Command baseline v4.1.0-alpha.0 median head v4.1.0-alpha.0 median Delta baseline v4.1.0-alpha.0 min / p95 head v4.1.0-alpha.0 min / p95
nuxt --version 69 ms 69 ms +0.6% 66 ms / 71 ms 65 ms / 71 ms
nuxt --version (first output byte) 64 ms 64 ms +0.9% 61 ms / 66 ms 60 ms / 66 ms
nuxt --help 141 ms 141 ms -0.3% 139 ms / 143 ms 135 ms / 145 ms
nuxt --help (first output byte) 134 ms 134 ms -0.1% 132 ms / 137 ms 128 ms / 138 ms
nuxt dev --help 107 ms 107 ms -0.4% 103 ms / 111 ms 103 ms / 111 ms
nuxt dev --help (first output byte) 101 ms 100 ms -0.5% 97 ms / 105 ms 97 ms / 104 ms
nuxt <unknown-command> (no-op) 149 ms 150 ms +0.4% 147 ms / 152 ms 146 ms / 152 ms
nuxt <unknown-command> (no-op) (first output byte) 142 ms 142 ms +0.1% 140 ms / 145 ms 139 ms / 145 ms

Module load cost

Counted with a module.registerHooks load hook, compile cache disabled. Counts every JS module actually evaluated on that code path (native addons excluded). Built-ins loaded after bootstrap are counted separately, including the internal modules they load.

Command baseline v4.1.0-alpha.0 modules head v4.1.0-alpha.0 modules Delta baseline v4.1.0-alpha.0 source bytes head v4.1.0-alpha.0 source bytes Delta baseline v4.1.0-alpha.0 built-ins head v4.1.0-alpha.0 built-ins Delta
nuxt --version 35 35 0.0% 301.2 kB 301.2 kB 0.0% 29 29 0.0%
nuxt --help 136 136 0.0% 866.4 kB 866.4 kB 0.0% 93 93 0.0%
nuxt dev --help 65 65 0.0% 464.1 kB 464.1 kB 0.0% 90 90 0.0%

Install footprint and published tarball

Each version installed on its own into an empty project with nothing but @nuxt/cli as a dependency, so the tree is exactly the CLI and its transitive dependencies. npm cache is warm and the registry is only consulted for metadata, so install wall time is indicative, not a network benchmark.

Metric baseline v4.1.0-alpha.0 head v4.1.0-alpha.0 Delta
Direct dependencies of @nuxt/cli 23 23 0.0%
Packages in the installed tree (unique name@version) 38 38 0.0%
Unique package names 38 38 0.0%
Package directories on disk (cross-check) 32 32 0.0%
Installed node_modules on disk 2.56 MB 2.56 MB -0.0%
Installed files 442 442 0.0%
Install wall time (warm npm cache, median of 3) 1.38 s 1.39 s +0.4%
Published tarball (packed) 247.8 kB 247.8 kB -0.0%
Published tarball (unpacked) 802.0 kB 802.0 kB 0.0%
Files in tarball 104 104 0.0%

Interleaved runs on a shared runner: trust the deltas, not the absolute timings. The dev, restart and build suites run locally via pnpm bench:cli.

@codspeed

codspeed Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Merging this PR will not alter performance

1 warning

⚠️ 2 benchmarks are dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

✅ 2 untouched benchmarks

Comparing renovate/nuxt (9764ff5) with main (07ea7da)1

Open in CodSpeed

Footnotes

  1. No successful run was found on main (196e2bb) during the generation of this report, so 07ea7da was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

@renovate
renovate Bot force-pushed the renovate/nuxt branch 2 times, most recently from 3aacfd0 to 1045695 Compare November 3, 2026 22:57
@renovate renovate Bot changed the title chore(deps): update nuxt framework to ^4.6.3 chore(deps): update nuxt framework to ^4.6.4 Nov 3, 2026
@renovate
renovate Bot force-pushed the renovate/nuxt branch 5 times, most recently from 4038ab4 to 2990902 Compare November 9, 2026 16:28

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@danielroe danielroe Awaiting requested review from danielroe danielroe is a code owner

At least 0 approving reviews are required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants