v4.3.0

Compare Source

4.3.0 is the next minor release.

Nuxt 4.3 brings powerful new features for layouts, caching, and developer experience – plus significant performance improvements under the hood.

📣 Some News

Extended v3 Support

Early this month, I opened a discussion to find out how the upgrade had gone from v3 to v4. I was really pleased to hear how well it had gone for most people.

Having said that, we're committed to making sure no one gets left behind. And so we will continue to provide security updates and critical bug fix releases beyond the previously announced end-of-life date of January 31, 2026, meaning Nuxt v3 will meet its end-of-life on July 31, 2026.

[!TIP]
As usual, today also brings a minor release for v3, with many of the same improvements backported from v4.3.

Preparing for Nuxt 5

We're closer than ever to the releases of Nuxt v5 and Nitro v3. In the coming weeks, the main branch of the Nuxt repository will begin receiving initial commits for Nuxt 5. However, it's still business as usual.

• Continue making pull requests to the main branch
• We'll backport changes to the 4.x and 3.x branches

Keep an eye out on the Upgrade Guide – we'll be adding details about how you can already start migrating your projects to prepare for Nuxt v4 with future.compatibilityVersion: 5.

🗂️ Route Rule Layouts

But that's enough about the future. We have a lot of good things for you today!

First, you can now set layouts directly in route rules using the new appLayout property (#​31092). This provides a centralized, declarative way to manage layouts across your application without scattering definePageMeta calls throughout your pages.

export default defineNuxtConfig({
  routeRules: {
    '/admin/**': { appLayout: 'admin' },
    '/dashboard/**': { appLayout: 'dashboard' },
    '/auth/**': { appLayout: 'minimal' }
  }
})

This might be useful for:

• Admin panels with a shared layout across many routes
• Marketing pages that need a different layout from the app

[!TIP]
Plus, you can pass props to layouts now! See the setPageLayout improvements below.

📦 ISR/SWR Payload Extraction

Payload extraction now works with ISR (incremental static regeneration), SWR (stale-while-revalidate) and cache routeRules (#​33467). Previously, only pre-rendered pages could generate _payload.json files.

This means:

• Client-side navigation to ISR/SWR pages can use cached payloads
• CDNs (Vercel, Netlify, Cloudflare) can cache payload files alongside HTML
• Fewer API calls during navigation – data can be prefetched and served from the cached payload

export default defineNuxtConfig({
  routeRules: {
    '/products/**': { 
      isr: 3600, // Revalidate every hour
    }
  }
})

🧹 Dev Mode Payload Extraction

Related to the above, payload extraction now also works in development mode (#​30784). This makes it easier to test and debug payload behavior without needing to run a production build.

[!IMPORTANT]
Payload extraction works in dev mode with nitro.static set to true, or for individual pages which have isr, swr, prerender or cache route rules.

🚫 Disable Modules from Layers

When extending Nuxt layers, you can now disable specific modules that you don't need (#​33883). Just pass false to the module's options:

export default defineNuxtConfig({
  extends: ['../shared-layer'],
  // disable @​nuxt/image from layer
  image: false,
})

🏷️ Route Groups in Page Meta

Route groups (folders wrapped in parentheses like (protected)/) are now exposed in page meta (#​33460). This makes it easy to check which groups a route belongs to in middleware or anywhere you have access to the route.

<script setup lang="ts">
// This page's meta will include: { groups: ['protected'] }
useRoute().meta.groups
</script>

export default defineNuxtRouteMiddleware((to) => {
  if (to.meta.groups?.includes('protected') && !isAuthenticated()) {
    return navigateTo('/login')
  }
})

This provides a clean, convention-based approach to route-level authorization without needing to add definePageMeta to every protected page.

🎨 Layout Props with setPageLayout

The setPageLayout composable now accepts a second parameter to pass props to your layout (#​33805):

export default defineNuxtRouteMiddleware((to) => {
  setPageLayout('admin', {
    sidebar: true,
    theme: 'dark'
  })
})

<script setup lang="ts">
defineProps<{
  sidebar?: boolean
  theme?: 'light' | 'dark'
}>()
</script>

🔧 #server Alias

A new #server alias provides clean imports within your server directory (#​33870), similar to how #shared works:

// Before: relative path hell
import { helper } from '../../../../utils/helper'

// After: clean and predictable
import { helper } from '#server/utils/helper'

The alias includes import protection – you can't accidentally import #server code from client or shared contexts.

🪟 Draggable Error Overlay

The development error overlay introduced in Nuxt 4.2 is now draggable and can be minimized (#​33695). You can:

• Drag it to any corner of the screen (it snaps to edges)
• Minimize it to a small pill button when you want to keep working
• Your position and minimized state persist across page reloads

This is a quality-of-life improvement when you're iterating on fixes and don't want the overlay blocking your view.

https://github.com/user-attachments/assets/nuxt_4-3_error_demo.mp4

⚙️ Async Plugin Constructors

Module authors can now use async functions when adding build plugins (#​33619):

export default defineNuxtModule({
  async setup() {
    // Lazy load only when actually needed
    addVitePlugin(() => import('my-cool-plugin').then(r => r.default()))
    
    // No need to load webpack plugin if using Vite
    addWebpackPlugin(() => import('my-cool-plugin/webpack').then(r => r.default()))
  }
})

This enables true lazy loading of build plugins, avoiding unnecessary code loading when plugins aren't needed.

🚀 Performance Improvements

This release includes several performance optimizations for faster builds:

• Hook filters - Internal plugins now use filters to avoid running hooks unnecessarily (#​33898)
• SSR styles optimization - The nuxt:ssr-styles plugin is now significantly faster (#​33862, #​33865)
• Layer alias transform - Skipped when using Vite (it handles this natively) (#​33864)
• Route rules compilation - Route rules are now compiled into a client chunk using rou3, removing the need for radix3 in the client bundle and eliminating app manifest fetches (#​33920)

🎨 Inline Styles for Webpack/Rspack

The inlineStyles feature now works with webpack and rspack builders (#​33966), not just Vite. This enables critical CSS inlining for better Core Web Vitals regardless of your bundler choice.

⚠️ Deprecations

statusCode → status, statusMessage → statusText

In preparation for Nitro v3 and H3 v2, we're moving to use Web API naming conventions (#​33912). The old properties still work but are deprecated in advance of v5:

- throw createError({ statusCode: 404, statusMessage: 'Not Found' })
+ throw createError({ status: 404, statusText: 'Not Found' })

🐛 Bug Fixes

Notable fixes in this release:

• Fixed head component deduplication using key attribute (#​33958, #​33963)
• Fixed async data properties not being reactive in Options API (#​34119)
• Fixed useCookie unsafe number parsing during decode (#​34007)
• Fixed NuxtPage not re-rendering when nested NuxtLayout has layouts disabled (#​34078)
• Fixed client-side pathname decoding for non-ASCII route aliases (#​34043)
• Fixed suspense remounting when navigating after pending state (#​33991)
• Fixed clipboard copy in error overlay (#​33873)
• Enabled allowArbitraryExtensions by default in TypeScript config (#​34084)
• Added noUncheckedIndexedAccess to server tsconfig for safer typing (#​33985)

[!IMPORTANT]
Enabling noUncheckedIndexedAccess in the Nitro server TypeScript config improves type safety but may surface new type errors in your server code. This change was necessary because Nuxt's app context performs type checks on server routes (learn more).

While we recommend keeping this enabled for better type safety, you can disable it if needed:

export default defineNuxtConfig({
  nitro: {
    typescript: {
      tsConfig: {
        compilerOptions: {
          noUncheckedIndexedAccess: false
        }
      }
    }
  }
})

Note that disabling this may allow type errors to slip through that could cause runtime issues with indexed access.

📚 Documentation

• Improved module author guides with clearer structure (#​33803)
• Added MCP setup instructions for Claude Desktop (#​33914)
• Added layers directory documentation (#​33967)
• Added Deno package manager examples (#​34070)
• Clarified type-checking context limitations for server routes (#​33964)

🎉 Nuxt 3.21.0

Alongside v4.3.0, we're releasing Nuxt v3.21.0 with many of the same improvements backported to the 3.x branch. This release includes:

• All the same features: Route rule layouts, ISR payload extraction, layout props with setPageLayout, #server alias, draggable error overlay, and more
• All performance improvements: SSR styles optimization, hook filters, and route rules compilation
• Module disabling: Disable layer modules by setting options to false
• Critical bug fixes: Async data reactivity in Options API, useCookie number parsing, head component deduplication, and more

✅ Upgrading

Our recommendation for upgrading is to run:

npx nuxt upgrade --dedupe

# or, if you are upgrading to v3.21
npx nuxt@latest upgrade --dedupe --channel=v3

This will deduplicate your lockfile and help ensure you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.

[!TIP]
Check out our upgrade guide if upgrading from an older version.

👉 Changelog

compare changes

🚀 Enhancements

• kit: Support async constructor for adding plugins (#​33619)
• kit: Export Nuxt major version type (#​33700)
• schema: Add #server alias for server directory imports (#​33870)
• ui-templates: Let it snow! ❄️ (#​33804)
• schema: Hoist nitro crossws types (5b16a51f5)
• nitro,nuxt: Compile route rules into client chunk (#​33920)
• nuxt: Allow disabling modules by setting module options to false (#​33883)
• kit: Allow specifying moduleDependencies as an async function (#​33504)
• nuxt: Support appLayout in route rules (#​31092)
• nuxt: Add route groups to page meta (#​33460)
• nuxt: Enable payload extraction for ISR/SWR routes (#​33467)
• nuxt: Allow updating props with setPageLayout (#​33805)
• nuxt: Enable dragging and minimizing for error overlay (#​33695)
• nitro,nuxt: Add support for payload extraction in dev (#​30784)
• rspack,webpack: Add inline styles (#​33966)
• kit: Add forward-compatible nitro types (#​34036)

🔥 Performance

• nuxt: Do not init layer alias transform when using vite (#​33864)
• vite: Add hook filters for ssr styles plugin (#​33865)
• vite: Optimize nuxt:ssr-styles plugin (#​33862)
• nuxt: Use filter for vfs plugin load (eb3d2d4c6)
• nuxt,vite: Use filters to avoid running hooks unnecessarily (6b7fc7477)
• nuxt,vite: Add more filters to internal plugins (#​33898)

🩹 Fixes

• kit: Normalize local layer paths with trailing slashes (#​33858)
• nuxt: Avoid overwriting multiple head input in island handler (#​33849)
• nuxt: Update meta instead of calling router.replace in page hmr (#​33897)
• nuxt: Don't call page:loading:end in cache if already called (7789f73bd)
• vite: Add error handling for parsing NUXT_VITE_NODE_OPTIONS (41a564d23)
• nuxt: Do not skip middleware when appMiddleware references invalid key (323f27bc8)
• nitro: Clipboard copy in error overlay (#​33873)
• webpack,rspack: Resolve deep imports in virtual files (#​33927)
• webpack: Disable async chunks in dev mode (0310c4070)
• webpack: Correctly evaluate sourcemap name (653f364af)
• nuxt: Handle node10 resolution for nuxt/meta (01c2c9b13)
• nuxt: Do not early return if component priorities conflict (#​33955)
• nuxt: Use key for tag deduplication in <Head> component (#​33958)
• schema,vite: Resolve build.transpile when initialising vite (#​33868)
• nuxt,rspack,webpack: Inject module identifiers for webpack builders (#​33962)
• nuxt: Add key to head components for proper deduplication (#​33963)
• nitro: Check prettyResponse.body type before error overlay (#​33977)
• nuxt: Don't URI-encode static route paths (#​33990)
• nuxt: Skip internal stub routes from prerender (#​34001)
• kit,schema: Align module onUpgrade arguments with types (#​33988)
• nuxt: Handle unsafe number parsing in useCookie decode (#​34007)
• nuxt: Do not externalise rou3 (2df4e1ae3)
• nitro: Add noUncheckedIndexedAccess to server tsconfig (#​33985)
• nuxt: Add auto-import declarations for shared/ context (#​33978)
• nuxt: Update global reference to globalThis in useRequestFetch (#​33976)
• vite: Configure hmr port for server build (#​33929)
• kit: Add forward compatible nitro v3 types (#​34053)
• nitro,nuxt: Do not import nitro deps in builders (#​34054)
• nitro: Add h3 types to auto-imports (#​34035)
• schema: Add some more directories to ignore (ebc2a66ab)
• nitro: Also augment nuxt/schema (a6a044d81)
• nuxt: Make asyncData properties reactive in Options API (#​34119)
• nuxt: Rerender NuxtPage when nested NuxtLayout has explicitly disabled layouts (#​34078)
• kit,nitro: Enable allowArbitraryExtensions by default (#​34084)
• nuxt: Decode client-side pathname for non-ASCII route aliases (#​34043)
• nuxt: Force remount suspense when navigating after pending (#​33991)
• nuxt: Add documentation link to server builder error message (#​34122)
• nuxt: Validate placeholder/fallback tags + warn about placeholder/fallback props (567a1c6fb)
• nuxt: Force flush useAsyncData debounced execute post watcher flush (#​34125)
• nitro: Process isr/swr/cache keys (d84278622)
• nuxt: Add typeFrom support for imports.d.ts template exports (#​34135)
• nuxt: Ensure we inline styles for hydrate-never components (#​34132)

💅 Refactors

• kit: Add explicit return types for kit utilities (6cd1289d1)
• nitro,nuxt,schema,vite: Provide explicit return types (1d2c0c25f)
• kit,nuxt,schema: Use named imports from defu + consola (322dae3e0)
• Add explicit .ts file extensions to relative imports (80778c0cd)
• kit,nitro,nuxt,schema: Reduce barrels + move <> to as (f1713850c)
• nitro,nuxt: Use ~ prefix for internal ssrContext properties (#​33896)
• nitro: Add explicit return types for runtime utils (a4fda917e)
• nitro: Move tree-shaken flags from replace plugin -> vfs (#​33907)
• nitro,nuxt,vite,webpack: Use status/statusText + deprecate old props (#​33912)
• webpack: Use RuntimeModule API for chunk preloads (#​33930)
• nuxt: Use AST-aware function key injection (#​33446)
• nitro,nuxt,schema: Use augments for nitro schema types (#​34039)
• nitro,rspack,vite,webpack: Move cors handling -> nitro builder (#​34048)

📖 Documentation

• Split and improve Module Author Guides (#​33803)
• Update links to module guide (86d67b24f)
• Fix useHead return type (#​33857)
• Add note that middleware doesn't run when rendering islands (7df27c781)
• Add note on default branch for layers (#​33919)
• Add mcp setup instructions for claude desktop (#​33914)
• Mention deno as package manager (#​33875)
• Clarify purpose of statusText (#​32834)
• Update lychee config and remove medium article link (c0b4e0f28)
• Update module count and fix typo (#​33950)
• Add DeepWiki badge (#​33508)
• Give example of usage of defineWrappedResponseHandler (#​33952)
• Provide cleaner example code for vitest projects (#​33960)
• Improve addImports example (#​34011)
• Update yarn create command (4a3c08874)
• Update roadmap with a11y (d3453d6a5)
• Add a11y release (#​34041)
• Remove Nuxtr from recommendations (#​34045)
• Typo (#​34050)
• Remove duplicate feature (#​34058)
• Fix typo (#​34057)
• Provide deno package manager examples (#​34070)
• Update JSDoc for config.experimental properties (#​34069)
• Fix transition types (#​34082)
• Make custom wrapper recipe link more prominent (#​34085)
• Remove null from getCachedData trigger (f7cf3747e)
• nuxt: Mention custom serializers in useState docs (#​34105)
• Add info about runtime directories + type checking (#​34097)
• Clarify module setups in .nuxtrc example (#​34107)
• Remove duplicate entries in table (#​34094)
• Clarify catch all notation for addServerHandler (#​34060)
• Add layers directory documentation (#​33967)
• Clarify type-checking context limitations for server routes (#​33964)
• Add a tip for appLayout (beda47955)
• Add docs for disabling modules by passing false to its options (cdad9310c)
• Add info about caching payloads with isr/swr (6e10ff04f)
• Add example for async addVitePlugin (1098254f7)
• Add example of passing props to layouts (1f9e6b82c)
• Mark vite plugin as not typed (5e09fddfb)
• Add warning about source from <NuxtIsland> (1586bbb6e)

📦 Build

• Remove babel debugging plugin from jiti stub options (bce8248b4)
• vite: Add build entries for vite-node entrypoints (#​33893)
• nuxt: Tidy up subpath export types (a63d4a014)
• Use obuild except for nuxt + nitro-server packages (#​34049)
• schema: Fix /builder-env subpath types (7f5034288)

🏡 Chore

• Add return types to debug plugins (8f7554287)
• Add build:stub command for those that need it (3e3d3d37a)
• Revert change to how type augments are inserted (c1b3590ff)
• Update eslint config rule (2717d8fd3)
• Do not require aligned columns in tables (8d3c5b371)
• Lint (f89d447a1)
• Explicitly import node:process (#​33982)
• Add root scripts to lint context (e22089f82)
• Tidy up configs (8b42d4c2b)
• Lint docs with eslint (51da8e681)
• Lint (1cfd3c460)

✅ Tests

• Update tests for new version of nuxt/test-utils (#​33842)
• Avoid unnecessary tick (988f6657a)
• Add regression test for asyncData HMR (#​32182)
• Add test for page hmr resetting state (#​32418)
• Add reproduction for vite pre-transform error (#​31574)
• Add regression test for #​32154 (#​32154)
• Use vi.hoisted for klona mock (#​34113)

🤖 CI

• Directly call webhook url (ce15997ce)
• Use new reusable triage workflows (#​34072)
• Use new shared dependency review workflow (8c01e1ce9)

❤️ Contributors

• Florian Heuberger (@​Flo0806)
• Octavio Araiza (@​8ctavio)
• Daniel Roe (@​danielroe)
• Robin (@​OrbisK)
• shaheer-arbisoft (@​shaheer-arbisoft)
• Matej Černý (@​cernymatej)
• Francesco Mussoni (@​solidusite)
• Danila Poyarkov (@​dannote)
• Victor Saa (@​vis97c)
• Teages (@​Teages)
• Eli Sterken (@​eli-sterk)
• Ryota Watanabe (@​wattanx)
• Jakub Andrzejewski (@​Baroshem)
• edison (@​edison1105)
• Max (@​onmax)
• Aidan Hibbard (@​aidanhibbard)
• Rahul Dogra (@​rahuld109)
• Julien Huang (@​huang-julien)
• abeer0 (@​iiio2)
• James Robert Lund III (@​lundjrl)
• Philipp Wagner (@​imphil)
• Maxime Pauvert (@​maximepvrt)
• Wind (@​productdevbook)
• Agatem (@​agatemosu)
• Pavel (@​eL1fe)
• Alois Sečkár (@​AloisSeckar)
• Lucie (@​lihbr)
• Sergiu Ravliuc (@​YoSoySergio)
• Saeid Zareie (@​Saeid-Za)
• Alireza Jahandideh (@​Youhan)
• kikuchan (@​kikuchan)
• Ragura (@​Ragura)
• Josh Deltener (@​hecktarzuli)
• Teena (@​franklin-tina)
• Frederik Bußmann (@​freb97)
• Benjamin Oddou (@​BenjaminOddou)
• Mukund Shah (@​mukundshah)
• Jessé Correia Lins (@​linspw)
• Jannik Sohn (@​janniksohn)
• Dawit (@​oneminch)
• Ali Sokkar (@​NyllRE)
• Horu (@​HigherOrderLogic)
• Anthony Fu (@​antfu)
• Harlan Wilton (@​harlan-zw)
• Alexander Lichter (@​TheAlexLichter)
• Ryan Wilson (@​rywils)
• Hugo (@​HugoRCD)
• yamachi4416 (@​yamachi4416)

v7.6.0

Compare Source

   🚀 Features

• Add Astro support  -  by @​sxzz in #​154 (5aa3e)
• Add importWithError utility for optional plugin imports  -  by @​sxzz (4ce53)

    View changes on GitHub

v7.5.1

Compare Source

   🐞 Bug Fixes

• Move import condition before require  -  by @​sxzz (c3ca1)

    View changes on GitHub

v7.5.0

Compare Source

   🚀 Features

• Upgrade yaml plugin  -  by @​sxzz (5516e)

    View changes on GitHub

v2.3.1

Compare Source

   🐞 Bug Fixes

• Missing dist  -  by @​sxzz (e1152)

    View changes on GitHub

v2.3.0

Compare Source

No significant changes

    View changes on GitHub

v2.2.7

Compare Source

   🐞 Bug Fixes

• deps:
  • Update all non-major dependencies  -  in #​83 (4484b)
  • Update all non-major dependencies  -  in #​84 (1a098)

    View changes on GitHub

v7.0.0-dev.20260205.1

Compare Source

v7.0.0-dev.20260204.1

Compare Source

v7.0.0-dev.20260203.1

Compare Source

v7.0.0-dev.20260202.1

Compare Source

v7.0.0-dev.20260201.1

Compare Source

v7.0.0-dev.20260131.1

Compare Source

v7.0.0-dev.20260130.1

Compare Source

v7.0.0-dev.20260129.1

Compare Source

v7.0.0-dev.20260128.1

Compare Source

v7.0.0-dev.20260127.1

Compare Source

v7.0.0-dev.20260126.1

Compare Source

v7.0.0-dev.20260124.1

Compare Source

v7.0.0-dev.20260123.3

Compare Source

v7.0.0-dev.20260122.4

Compare Source

v7.0.0-dev.20260122.3

Compare Source

v7.0.0-dev.20260122.2

Compare Source

v7.0.0-dev.20260120.1

Compare Source

v7.0.0-dev.20260119.1

Compare Source

v4.0.18

Compare Source

   🚀 Experimental Features

• experimental: Add onModuleRunner hook to worker.init  -  by @​sheremet-va in #​9286 (ea837)

   🐞 Bug Fixes

• Use meta.url in createRequire  -  by @​sheremet-va in #​9441 (e0572)
• browser: Hide injected data-testid attributes  -  by @​sheremet-va in #​9503 (f8989)
• ui: Process artifact attachments when generating HTML reporter  -  by @​macarie in #​9472 (22543)

    View changes on GitHub

v10.4.1

Compare Source

   🚀 Features

• Add custom path to config  -  by @​OskarLebuda in #​107 (0f2e4)

    View changes on GitHub

v0.27.3

Compare Source

• Preserve URL fragments in data URLs (#​4370)

  Consider the following HTML, CSS, and SVG:

  • index.html:

    <!DOCTYPE html>
    <html>
      <head><link rel="stylesheet" href="icons.css"></head>
      <body><div class="triangle"></div></body>
    </html>

  • icons.css:

    .triangle {
      width: 10px;
      height: 10px;
      background: currentColor;
      clip-path: url(./triangle.svg#x);
    }

  • triangle.svg:

    <svg xmlns="http://www.w3.org/2000/svg">
      <defs>
        <clipPath id="x">
          <path d="M0 0H10V10Z"/>
        </clipPath>
      </defs>
    </svg>

  The CSS uses a URL fragment (the #x) to reference the clipPath element in the SVG file. Previously esbuild's CSS bundler didn't preserve the URL fragment when bundling the SVG using the dataurl loader, which broke the bundled CSS. With this release, esbuild will now preserve the URL fragment in the bundled CSS:

  /* icons.css */
  .triangle {
    width: 10px;
    height: 10px;
    background: currentColor;
    clip-path: url('data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg"><defs><clipPath id="x"><path d="M0 0H10V10Z"/></clipPath></defs></svg>#x');
  }

• Parse and print CSS @scope rules (#​4322)

  This release includes dedicated support for parsing @scope rules in CSS. These rules include optional "start" and "end" selector lists. One important consequence of this is that the local/global status of names in selector lists is now respected, which improves the correctness of esbuild's support for CSS modules. Minification of selectors inside @scope rules has also improved slightly.

  Here's an example:

  /* Original code */
  @​scope (:global(.foo)) to (:local(.bar)) {
    .bar {
      color: red;
    }
  }
  
  /* Old output (with --loader=local-css --minify) */
  @​scope (:global(.foo)) to (:local(.bar)){.o{color:red}}
  
  /* New output (with --loader=local-css --minify) */
  @​scope(.foo)to (.o){.o{color:red}}

• Fix a minification bug with lowering of for await (#​4378, #​4385)

  This release fixes a bug where the minifier would incorrectly strip the variable in the automatically-generated catch clause of lowered for await loops. The code that generated the loop previously failed to mark the internal variable references as used.

• Update the Go compiler from v1.25.5 to v1.25.7 (#​4383, #​4388)

  This PR was contributed by @​MikeWillCook.

v10.28.2: pnpm 10.28.2

Compare Source

Patch Changes

• Security fix: prevent path traversal in directories.bin field.

• When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

  This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

  Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.

• Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #​9950.

Platinum Sponsors

Gold Sponsors

Configuration 📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined). 🚦 Automerge: Enabled. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired. If you want to rebase/retry this PR, check this box This PR was generated by Mend Renovate. View the repository job log.