Skip to content

Conversation

@nerdy-tech-com-gitub
Copy link
Owner

snyk-top-banner

Snyk has created this PR to upgrade @nuxt/ui from 2.17.0 to 4.2.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


  • The recommended version is 61 versions ahead of your current version.

  • The recommended version was released 21 days ago.

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Incorrect Authorization
SNYK-JS-VITE-9512410
140 Mature
high severity Incorrect Authorization
SNYK-JS-VITE-9653016
140 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-CROSSSPAWN-8303230
140 Proof of Concept
high severity Command Injection
SNYK-JS-GLOB-14040952
140 Proof of Concept
high severity Uncontrolled Recursion
SNYK-JS-NODEFORGE-14125745
140 No Known Exploit
high severity Acceptance of Extraneous Untrusted Data With Trusted Data
SNYK-JS-NUXT-9486043
140 No Known Exploit
high severity Insecure Randomness
SNYK-JS-UNDICI-8641354
140 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BABELHELPERS-9397697
140 Proof of Concept
medium severity Directory Traversal
SNYK-JS-VITE-13644406
140 Proof of Concept
medium severity Information Exposure
SNYK-JS-VITE-8023174
140 Proof of Concept
medium severity Origin Validation Error
SNYK-JS-VITE-8648411
140 Proof of Concept
medium severity Access Control Bypass
SNYK-JS-VITE-9576207
140 Proof of Concept
medium severity Information Exposure
SNYK-JS-VITE-9685035
140 Proof of Concept
medium severity Directory Traversal
SNYK-JS-VITE-9919777
140 Proof of Concept
medium severity Missing Release of Resource after Effective Lifetime
SNYK-JS-INFLIGHT-6095116
140 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-JSYAML-13961110
140 No Known Exploit
medium severity Open Redirect
SNYK-JS-KOA-10944994
140 Proof of Concept
medium severity Inefficient Regular Expression Complexity
SNYK-JS-MICROMATCH-6838728
140 No Known Exploit
medium severity Improper Input Validation
SNYK-JS-NANOID-8492085
140 No Known Exploit
medium severity Improper Input Validation
SNYK-JS-NANOID-8492085
140 No Known Exploit
medium severity Integer Overflow or Wraparound
SNYK-JS-NODEFORGE-14125097
140 No Known Exploit
medium severity Cross-site Scripting (XSS)
SNYK-JS-NUXTDEVTOOLS-13849298
140 No Known Exploit
medium severity Origin Validation Error
SNYK-JS-NUXTVITEBUILDER-8663232
140 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-PARSEGITCONFIG-9403763
140 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHTOREGEXP-7925106
140 Proof of Concept
medium severity Cross-site Scripting (XSS)
SNYK-JS-ROLLUP-8073097
140 Proof of Concept
low severity Cross-site Scripting (XSS)
SNYK-JS-VITE-8022916
140 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BRACEEXPANSION-9789073
140 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BRACEEXPANSION-9789073
140 Proof of Concept
critical severity Prototype Pollution
SNYK-JS-DEVALUE-12205530
140 Proof of Concept
critical severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-KOA-8720152
140 No Known Exploit
low severity Cross-site Scripting (XSS)
SNYK-JS-KOA-9679272
140 Proof of Concept
critical severity Interpretation Conflict
SNYK-JS-NODEFORGE-14114940
140 No Known Exploit
low severity Directory Traversal
SNYK-JS-NUXT-12878602
140 Proof of Concept
low severity Cross-site Scripting
SNYK-JS-SEND-7926862
140 No Known Exploit
low severity Cross-site Scripting
SNYK-JS-SERVESTATIC-7926865
140 No Known Exploit
low severity Directory Traversal
SNYK-JS-SIRV-12558119
140 Proof of Concept
low severity Missing Release of Memory after Effective Lifetime
SNYK-JS-UNDICI-10176064
140 Proof of Concept
low severity Relative Path Traversal
SNYK-JS-VITE-12558116
140 Proof of Concept
Release notes
Package name: @nuxt/ui
  • 4.2.1 - 2025-11-21

    🐛 Bug Fixes

    • ChatPromptSubmit: proxy event to stop and reload emits (#5400) 736a547
    • ColorModeButton: missing icon import 5f30ccf, closes #5486
    • Icon: improve name type (#5498) b654a77
    • Link: define NuxtLinkProps instead of importing from #app (#5491) da8daaa
    • Link: ensure consistency across Nuxt, Vue and Inertia a9ed10d, closes #5012
    • module: put back #build/ui.css alias (#5499) d9aadc7

    New Contributors

    Full Changelog: v4.2.0...v4.2.1

  • 4.2.0 - 2025-11-18

    ✨ Highlights

    📅 New InputDate & InputTime components

    Two new components are now available to handle date and time inputs: InputDate (#5387) and InputTime (#5302).

    script setup lang="ts">
    const date = ref(new CalendarDate(2022, 2, 3))
    const time = ref(new Time(12, 30, 0))
    </script>

    <template>
    <UInputDate v-model="date" />

    <UInputTime v-model="time" />
    </template>

    🎨 Tailwind CSS prefix

    You can now use Tailwind CSS's prefix option (#5341) to prefix all utilities generated by Nuxt UI and avoid conflicts with your own styles or other libraries.

    export default defineNuxtConfig({
      modules: ['@ nuxt/ui'],
      css: ['~/assets/css/main.css'],
      ui: {
        theme: {
          prefix: 'tw'
        }
      }
    })
    @ import "tailwindcss" prefix(tw);
    @ import "@ nuxt/ui";

    🚨 Breaking Changes

    Exposed refs now consistently return the HTML element directly instead of the component instance. This affects InputMenu, InputNumber, InputTags, Select, and SelectMenu.

    - inputMenu.value.inputRef.$el // Component instance
    + inputMenu.value.inputRef // HTML element directly
    </script>

    • module: properly export composables from module (cb25902)

    There was an issue with how composables were exported, you no longer need the .js extension:

    <script setup lang="ts">
    - import { useToast } from '@ nuxt/ui/composables/useToast.js'
    + import { useToast } from '@ nuxt/ui/composables/useToast'
    // or
    + import { useToast } from '@ nuxt/ui/composables'
    </script>

    The Vite plugin now properly generates theme files as real files instead of incorrectly shipping them inside .nuxt/ on NPM. This ensures the #build/ui.css import and custom theme configuration work correctly.

    When using the Vite plugin, update your tsconfig.node.json alias:

    {
      "compilerOptions": {
        "paths": {
          "#build/ui": [
    -       "./node_modules/@ nuxt/ui/.nuxt/ui"
    +       "./node_modules/.nuxt-ui/ui"
          ]
        }
      }
    }

    🚀 Features

    🐛 Bug Fixes

    • AuthForm: ensure header is shown with leading slot (#5405) (b61127a)
    • AuthForm: use password input id for aria-controls (#5312) (55ea9be)
    • ChatPrompt: proxy disabled prop (a8f2156), closes #5300
    • CheckboxGroup/RadioGroup/Switch: consistent disabled styles (ddd8faf), closes #5391
    • ColorModeButton: use css to display color mode icon (#5394) (1d1c638)
    • CommandPalette/ContentSearch: improve performances and filtering logic (#5433) (e751b37)
    • components: calc virtualizer estimateSize based on item description (56ae8e7)
    • components: consistent exposed refs (#5385) (fce2df4)
    • components: remove locale / dir props proxy (#5432) (a6efa7a)
    • ContentNavigation/NavigationMenu/Tabs: ensure proper badge display (e5c11e6)
    • ContentSearchButton/DashboardSearchButton: hide label and trailing with css when collapsed (3e72bf8)
    • FileUpload: ensure native validation works with required (#5358) (eb491e1)
    • Form: refine nested prop type handling and simplify logic (#5360) (8d5c26f)
    • inertia: set serverRendered dynamically to prevent SSR crash (#5396) (c0da1b2)
    • Input/InputNumber/Textarea: make modelModifiers generic (#5361) (5c347af)
    • InputMenu: prevent change event when selecting create item (418c87b), closes #4664
    • Link: partial extend for vue-router and inertia (637ef58)
    • Marquee: move keyframes into global css (1e6242e)
    • module: detect lazy components when using experimental.componentDetection (5a5ac45)
    • module: properly export composables from module (cb25902), closes #5370
    • module: scan layers when using experimental.componentDetection (9872740), closes #5389
    • NavigationMenu: hide label and trailing with css when collapsed (f004031), closes #4254
    • NavigationMenu: proxy modelValue / defaultValue in vertical orientation (cffaaaa), closes #5392
    • ProseCallout: add inline-block class to icon (#5317) (fc36f69)
    • RadioGroup: update update:modelValue emit type (#5349) (4cb0638)
    • Table: apply styles to th based on column meta (#5418) (620defa)
    • types: export missing utils types (#5448) (5f0a107)
    • vite: write theme templates (#5355) (411ebcc)
    • vue: check import.meta.env.SSR to support vite-ssg (#5347) (8f38c04)

    🌐 Locales

    👋 New Contributors

    Full Changelog: v4.1.0...v4.2.0

  • 4.1.0 - 2025-10-23

    ✨ Highlights

    📦 New Empty Component

    A new Empty component is now available to display empty states when there's no content to show (#5200).

    CleanShot 2025-10-23 at 16 17 10@2x

    ⚡️ Component Virtualization

    Use the virtualize prop to enable virtualization for large datasets on CommandPalette, InputMenu, SelectMenu, Table and Tree components (#5162).

    <template>
      <UTable :data="data" :columns="columns" virtualize />
    </template>

    🎯 Experimental Component Detection

    Enable the new experimental.componentDetection option in your nuxt.config.ts to automatically detect which components are actually used and only generate the necessary CSS for those components including their dependencies (#5222).

    export default defineNuxtConfig({
      modules: ['@ nuxt/ui'],
      css: ['~/assets/css/main.css'],
      ui: {
        experimental: {
          componentDetection: true
        }
      }
    })

    🚨 Breaking Changes

    We apologize for these small breaking changes. With 110+ components in the library, we occasionally need to make corrections to maintain consistency and quality. We aim to minimize breaking changes, but sometimes they're necessary to improve the developer experience in the long run.

    • CommandPalette: add children-icon prop to use trailing-icon in input (#4397) (edda8a6)

    The trailing-icon prop is now used for the Input, and a new children-icon prop has been added to customize the icon for child items:

    <template>
    - <UCommandPalette :trailing-icon="i-lucide-arrow-right" />
    + <UCommandPalette :children-icon="i-lucide-arrow-right" />
    </template>
    • Table: consistent args order in select event (9526a1b)

    The @ select event now passes arguments in a consistent order: (event, row) instead of (row, event):

    <template>
    - <UTable @ select="(row, e) => {}" />
    + <UTable @ select="(e, row) => {}" />
    </template>

    🚀 Features

    • Calendar: add variant prop (#5138) (bb4f42c)
    • CommandPalette: add children-icon prop to use trailing-icon in input (#4397) (edda8a6)
    • CommandPalette: preserve group order in search results (#5197) (38647a2)
    • components: expose ui in slot props where used (#5207) (63c0a5f)
    • components: handle description in items (#5193) (70cf05f)
    • components: implement virtualization (#5162) (c744d6f)
    • Empty: new component (#5200) (6a6de8d)
    • InputNumber: handle increment / decrement as booleans (#4805) (1858908)
    • module: add experimental.componentDetection option (#5222) (f80474c)
    • Popover: add close method in slots (#5176) (53c6508)
    • ProseImg: improve zoom transition (#4998) (d502c30)
    • Tree: add global event handlers and checkbox example (#5195) (84f87a5)
    • Tree: expose $el for drag and drop example (#5239) (fcf6117)
    • Tree: provide additional slot props (#5194) (c8b01c9)
    • useToast: handle max global configuration (#5068) (e4c6113)

    🐛 Bug Fixes

    • BlogPost/ChangelogVersion: allow any attrs inimage prop (9632f99), closes #5276
    • Breadcrumb: handle active in items (cc8cbf3), closes #4771
    • ChatMessage: ensure left side takes full width (af8c023)
    • ChatMessage: only apply max-width on right side (a85b0e1)
    • ChatMessage: reset top and bottom margin (8f9176c)
    • ChatMessages: allow user scroll with should-auto-scroll (#5252) (db73765)
    • ChatMessages: define user & assistant ui prop type (#5234) (240bc1a)
    • CodeTree/Tree: restore item wrapper with presentation role (70aaf4a), closes #4945
    • components: add missing ui prop in prose proxy components (#5205) (d1afe90)
    • ContextMenu/DropdownMenu: allow item content class override (ab5032d), closes #5277
    • Drawer/Modal/Slideover: remove close autofocus prevent (#5191) (8099440)
    • Error/Main: render as div instead of main (2a09ac0), closes #4955
    • FileUpload: handle disabling file delete button (08c30cf), closes #5249
    • FileUpload: stuck focus while tabbing (#5128) (2477d44)
    • FileUpload: use native img element for blob URLs preview (69906bc), closes #5121 #4824
    • InputMenu/SelectMenu: enrich reusable template item prop (63074d6)
    • InputMenu: ensure tag can be removed when number (028538a)
    • Kbd: return original value and use uppercase class (#5238) (4095c9a)
    • NavigationMenu: display trailing slot when badge not undefined (f24204f), closes #4670
    • Table: consistent args order in select event (9526a1b)
    • Table: expose $el instead of rootRef (c019f8f), closes #5230 #5162

    🌐 Locales

    👋 New Contributors

Snyk has created this PR to upgrade @nuxt/ui from 2.17.0 to 4.2.1.

See this package in npm:
@nuxt/ui

See this project in Snyk:
https://app.snyk.io/org/nerds-github/project/8b4160ff-3510-4d06-a27b-7930a5e75719?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants