Skip to content

Conversation

@nerdy-tech-com-gitub
Copy link
Owner

snyk-top-banner

Snyk has created this PR to upgrade nuxt from 3.12.4 to 4.2.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


  • The recommended version is 47 versions ahead of your current version.

  • The recommended version was released a month ago.

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Incorrect Authorization
SNYK-JS-VITE-9512410
140 Mature
high severity Incorrect Authorization
SNYK-JS-VITE-9653016
140 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-CROSSSPAWN-8303230
140 Proof of Concept
high severity Command Injection
SNYK-JS-GLOB-14040952
140 Proof of Concept
high severity Uncontrolled Recursion
SNYK-JS-NODEFORGE-14125745
140 No Known Exploit
high severity Acceptance of Extraneous Untrusted Data With Trusted Data
SNYK-JS-NUXT-9486043
140 No Known Exploit
high severity Insecure Randomness
SNYK-JS-UNDICI-8641354
140 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BABELHELPERS-9397697
140 Proof of Concept
medium severity Directory Traversal
SNYK-JS-VITE-13644406
140 Proof of Concept
medium severity Information Exposure
SNYK-JS-VITE-8023174
140 Proof of Concept
medium severity Origin Validation Error
SNYK-JS-VITE-8648411
140 Proof of Concept
medium severity Access Control Bypass
SNYK-JS-VITE-9576207
140 Proof of Concept
medium severity Information Exposure
SNYK-JS-VITE-9685035
140 Proof of Concept
medium severity Directory Traversal
SNYK-JS-VITE-9919777
140 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-JSYAML-13961110
140 No Known Exploit
medium severity Open Redirect
SNYK-JS-KOA-10944994
140 Proof of Concept
medium severity Inefficient Regular Expression Complexity
SNYK-JS-MICROMATCH-6838728
140 No Known Exploit
medium severity Improper Input Validation
SNYK-JS-NANOID-8492085
140 No Known Exploit
medium severity Improper Input Validation
SNYK-JS-NANOID-8492085
140 No Known Exploit
medium severity Integer Overflow or Wraparound
SNYK-JS-NODEFORGE-14125097
140 No Known Exploit
medium severity Cross-site Scripting (XSS)
SNYK-JS-NUXTDEVTOOLS-13849298
140 No Known Exploit
medium severity Origin Validation Error
SNYK-JS-NUXTVITEBUILDER-8663232
140 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-PARSEGITCONFIG-9403763
140 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHTOREGEXP-7925106
140 Proof of Concept
medium severity Cross-site Scripting (XSS)
SNYK-JS-ROLLUP-8073097
140 Proof of Concept
low severity Cross-site Scripting (XSS)
SNYK-JS-VITE-8022916
140 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BRACEEXPANSION-9789073
140 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BRACEEXPANSION-9789073
140 Proof of Concept
critical severity Prototype Pollution
SNYK-JS-DEVALUE-12205530
140 Proof of Concept
critical severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-KOA-8720152
140 No Known Exploit
low severity Cross-site Scripting (XSS)
SNYK-JS-KOA-9679272
140 Proof of Concept
critical severity Interpretation Conflict
SNYK-JS-NODEFORGE-14114940
140 No Known Exploit
low severity Directory Traversal
SNYK-JS-NUXT-12878602
140 Proof of Concept
low severity Cross-site Scripting
SNYK-JS-SEND-7926862
140 No Known Exploit
low severity Cross-site Scripting
SNYK-JS-SERVESTATIC-7926865
140 No Known Exploit
low severity Directory Traversal
SNYK-JS-SIRV-12558119
140 Proof of Concept
low severity Missing Release of Memory after Effective Lifetime
SNYK-JS-UNDICI-10176064
140 Proof of Concept
low severity Relative Path Traversal
SNYK-JS-VITE-12558116
140 Proof of Concept
Release notes
Package name: nuxt
  • 4.2.1 - 2025-11-06

    4.2.1 is the next patch release.

    ✅ Upgrading

    Our recommendation for upgrading is to run:

    npx nuxt upgrade --dedupe

    This will deduplicate your lockfile as well, and help ensure that you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.

    👉 Changelog

    compare changes

    🩹 Fixes

    • kit,nuxt,schema: Deprecate ImportPresetWithDeprecation (#33596)
    • nuxt: Correct warning message for prefetch/noPrefetch conflict (#33617)
    • nitro: Remove <nuxt-error-overlay> iframe border (#33625)
    • vite: Use rolldown replace only in build (#33615)
    • nitro: Use directory paths in moduleEntryPaths (#33628)
    • nitro: Start error overlay minimized based on status code (#33658)
    • vite: Ensure optimizeDeps config is applied before other plugins (#33586)
    • nuxt: Respect layer priority order for scanned components (#33654)
    • nuxt: Process prerender routes on pages:resolved (#33662)
    • nuxt: Remove abort signal event listeners after render (#33665)
    • nuxt: Cleanup event listener with cleanup signal (#33667)
    • vite: Update vite-node (#33663)
    • vite: Respect vite proxy in dev middleware (#33670)

    💅 Refactors

    • kit,nitro,nuxt,schema,vite: Explicitly import process/performance (#33650)

    📖 Documentation

    • Fix typo in eslint flat config description (#33569)
    • Add signal support to useAsyncData examples (#33601)
    • Document pending as alias of status === 'pending' (#33221)
    • Note that cookieStore is true by default (#33572)
    • Add information on types for server context (#33511)
    • Mark webstorm issue resolved (#33608)
    • Clarify route middleware doesn't affect API routes (#33643)
    • Improve docs for useHead/useHydration/useLazy* (#33626)
    • Update link to nitro source to v2 branch (08018af4f)
    • Add typescript documentation for module authors (#33637)
    • Typo (#33655)

    🏡 Chore

    🤖 CI

    • Disable cache in release action (ff37598bc)

    ❤️ Contributors

  • 4.2.0 - 2025-10-25

    4.2.0 is the next minor release.

    👀 Highlights

    We're excited to announce Nuxt 4.2, bringing new capabilities for better TypeScript DX, enhanced error handling, and improved control over data fetching! 🎉

    🎯 Abort Control for Data Fetching

    You can now use AbortController signals directly within useAsyncData, giving you fine-grained control over request cancellation (#32531).

    This works by passing an internal signal to your useAsyncData handler to cancel any promise that can be canceled, such as $fetch.

    script setup lang="ts">
    const controller = new AbortController()

    const { data, error, clear, refresh } = await useAsyncData('users', (_nuxtApp, { signal }) => $fetch('/api/users', {
    signal
    }))

    refresh() // will actually cancel the $fetch request (if dedupe: cancel)
    refresh() // will actually cancel the $fetch request (if dedupe: cancel)
    refresh()

    clear() // will cancel the latest pending handler
    </script>

    You also pass an AbortController signal directly to refresh/execute, giving you fine-grained control over request cancellation. This is particularly useful when you need to abort requests based on user actions or component lifecycle events.

    const { data, refresh } = await useAsyncData('posts', fetchPosts)

    // Abort an ongoing refresh
    const abortController = new AbortController()
    refresh({ signal: abortController.signal })

    // Later...
    abortController.abort()

    🎨 Better Error Pages in Development

    When an error occurs during development, Nuxt will now display both your custom error page and a detailed technical error overlay (#33359). This gives you the best of both worlds – you can see what your users will experience while also having immediate access to stack traces and debugging information.

    Screenshot of the new development error page

    The technical overlay appears as a toggleable panel that doesn't interfere with your custom error page, making it easier to debug issues while maintaining a realistic preview of your error handling.

    🔮 Opt-in Vite Environment API

    For those wanting to experiment with cutting-edge features, you can now opt into the Vite Environment API (#33492).

    The Vite Environment API is a major architectural improvement in Vite 6. It closes the gap between development and production by allowing the Vite dev server to handle multiple environments concurrently (rather than requiring multiple Vite dev servers, as we have done previously in Nuxt).

    This should improve performance when developing and eliminate some edge case bugs.

    ... and it is the foundation for implementing Nitro as a Vite environment, which should speed up the dev server still further, as well as allowing more greater alignment in development with your Nitro preset.

    export default defineNuxtConfig({
      experimental: {
        viteEnvironmentApi: true
      }
    })

    This is also the first breaking change for Nuxt v5. You can opt in to these breaking changes by setting compatibilityVersion to 5:

    export default defineNuxtConfig({
      future: {
        compatibilityVersion: 5
      },
    })

    Please only use this for testing, as this opts in to unlimited future breaking changes, including updating to Nitro v3 once we ship the Nuxt integration.

    Warning

    This is highly experimental and the API may change. Only enable if you're prepared for potential breaking changes and want to help shape the future of Nuxt!

    📦 New @ nuxt/nitro-server Package

    We've extracted Nitro server integration into its own package: @ nuxt/nitro-server (#33462). This architectural change allows for different Nitro integration patterns and paves the way for future innovations in server-side rendering.

    While this change is mostly internal, it's part of our ongoing effort to make Nuxt more modular and flexible. The new package provides standalone Nitro integration and sets the foundation for alternative integration approaches (such as using Nitro as a Vite plugin in Nuxt v5+).

    Note

    This is an internal refactor – no changes should be required in your code.

    ⚡ Performance Improvements

    We've also shipped several performance enhancements:

    • Precomputed renderer dependencies – We now compute renderer dependencies at build time rather than runtime, improving cold start and initial render performance (#33361)
    • Reduced dependencies – Removed unnecessary dependencies from kit and schema packages (7ae2cf563)

    📉 Async Data Handler Extraction

    One of the most exciting performance improvements is the new experimental async data handler extraction (#33131). When enabled, handler functions passed to useAsyncData and useLazyAsyncData are automatically extracted into separate chunks and dynamically imported.

    This is particularly effective for prerendered static sites, as the data fetching logic is only needed at build time and can be completely excluded from the client bundle.

    Note

    In testing with a previous version of nuxt.com, this feature reduced JavaScript bundle size by 39%! Of course, your mileage may vary depending on how much data fetching logic you have.

    script setup lang="ts">
    // This handler will be extracted into a separate chunk
    // and only loaded when needed
    const { data: post } = await useAsyncData('post', async () => {
    const content = await queryContent(</span><span class="pl-s">/blog/${<span class="pl-smi">route</span>.<span class="pl-smi">params</span>.<span class="pl-smi">slug</span>}</span><span class="pl-s">).findOne()

    // Complex data processing that you don't want in the client bundle
    const processed = await processMarkdown(content)
    const related = await findRelatedPosts(content.tags)

    return {
    ...processed,
    related
    }
    })
    </script>

    For static/prerendered sites, enable it in your config:

    export default defineNuxtConfig({
      experimental: {
        extractAsyncDataHandlers: true
      }
    })

    The extracted handlers are then tree-shaken from your client bundle when prerendering, as the data is already available in the payload. This results in significantly smaller JavaScript files shipped to your users.

    🔧 Experimental TypeScript Plugin Support

    We're introducing experimental support for enhanced TypeScript developer experience through the @ dxup/nuxt module.

    This module adds a number of TypeScript plugins that aim to improve your experience when using Nuxt-specific features:

    • Smart component renaming: Automatically updates all references when you rename auto-imported component files
    • Go to definition for dynamic imports: Navigate directly to files when using glob patterns like import(\~/assets/${name}.webp`)`
    • Nitro route navigation: Jump to server route handlers from data fetching functions ($fetch, useFetch, useLazyFetch)
    • Runtime config navigation: Go to definition works seamlessly with runtime config properties
    • Enhanced auto-import support: Includes the @ dxup/unimport plugin for better navigation with auto-imported composables and utilities

    Note

    Read more in the documentation.

    To enable this feature, set experimental.typescriptPlugin to true in your Nuxt configuration:

    export default defineNuxtConfig({
      experimental: {
        typescriptPlugin: true
      }
    })

    Once enabled, the module will be automatically installed and configured by Nuxt.

    Important

    This feature also requires selecting the workspace TypeScript version in VS Code. Run the "TypeScript: Select TypeScript Version" command and choose "Use Workspace Version".

    🎁 Other Improvements

    • Component declarationPath – You can now specify a custom declaration path for components (#33419)
    • Module resolution extensions – Kit's resolveModule now accepts an extensions option (#33328)
    • Global head utility – New setGlobalHead utility in kit for easier head management (#33512)

    🩹 Important Fixes

    • Route hash is now preserved when redirecting based on routeRules (#33222)
    • Fixed concurrent calls to loadNuxtConfig with proper cleanup (#33420)
    • Object-format href now works correctly in <NuxtLink> (c69e4c30d)
    • Component auto-imports now work as arguments to Vue's h() function (#33509)
    • Fixed app config array handling during HMR (#33555)

    ✅ Upgrading

    Our recommendation for upgrading is to run:

    npx nuxt upgrade --dedupe

    This will refresh your lockfile and pull in all the latest dependencies that Nuxt relies on, especially from the unjs ecosystem.

    👉 Changelog

    compare changes

    🚀 Enhancements

    • nuxt: Allow specifying component declarationPath (#33419)
    • kit: Add extensions option for resolveModule (#33328)
    • nuxt: Add abortController option to useAsyncData (#32531)
    • nuxt: Display youch error page w/ user error page in dev (#33359)
    • nuxt: Experimental typescript plugin support (#33314)
    • nuxt,schema: Extract asyncData handlers to chunks (#33131)
    • schema: Enable setting future.compatibilityVersion to 5 (22f4693a1)
    • kit,vite: Allow enabling vite environment api (#33492)
    • kit: Add setGlobalHead utility (#33512)

    🔥 Performance

    • nuxt: Precompute renderer dependencies at build time (#33361)
    • kit,schema: Remove some unnecessary dependencies (7ae2cf563)

    🩹 Fixes

    • nuxt: Preserve hash with redirecting based on routeRules (#33222)
    • kit: Safely cleanup loadNuxtConfig in concurrent calls (#33420)
    • nuxt: Allow object-format href in <NuxtLink> (c69e4c30d)
    • nuxt: Remove mergeModels from auto imports (#33344)
    • nuxt: Add back shortPath property (#33384)
    • nuxt: Do not allow native attrs to shadow nuxt link props (4751a6aca)
    • nuxt: Remove declarationPath from component dirs (191bcb7e9)
    • nuxt: Preserve root route in isPrerendered check (#33476)
    • nuxt: Exempt webpack vfs from pkg lookup (285eac31c)
    • nitro: Exempt nightly release from import protections (dd522394a)
    • webpack,rspack: Preserve prerender + nitro flags in server builds (#33503)
    • nuxt: Support component auto-imports as arguments of h() (#33509)
    • vite: Prevent assignment for rolldown's replacement plugin (#33526)
    • nuxt: Use sha256 hash for prerender cache keys (#33505)
    • nuxt: Add NuxtTime relative time numeric prop (#33552)
    • nuxt: Add NuxtTime relative time relativeStyle prop (#33557)
    • nuxt: Handle arrays in app config correctly during HMR (#33555)
    • vite: Unset optimizeDeps.include for server environment (#33550)

    💅 Refactors

    • Remove obsolete shortPath property (#33384)
    • kit: Extract trace utilities (9687505ac)
    • nuxt,vite,webpack: Allow builders to augment types (#33427)
    • schema: Deprecate extend, extendConfig, and configResolved hooks (e060b9695)
    • vite: Make vite plugins environment-compatible (#33445)
    • nitro,nuxt: Extract @ nuxt/nitro-server package (#33462)
    • nuxt: Use RouteLocationNormalizedLoadedGeneric internally (b51cb3067)

    📖 Documentation

    • Update link to localisation issue (d32859da2)
    • Add nuxt module addServerPlugin note (#33409)
    • Remove deprecated node version (#33411)
    • Update declarationPath in addComponent (#33380)
    • Reproduction links for Nuxt v4 (#33429)
    • Add some notes/deprecations for vite hooks (31c5f26a2)
    • Fix incorrect ESM module field info (#33451)
    • Recommend getLayerDirectories() instead of nuxt.options._layers (#33484)
    • Add 4.x prefix (5c0bb9285)
    • Add docs for moduleDependencies (#33499)
    • Clarify extends removal in TypeScript config migration (#33523)
    • Pin codemod to v0.18.7 for migration recipe (#33522)
    • Fix links (#33554)

    🏡 Chore

    • Migrate gitpod to ona (#33159)
    • Use native node to run test:prepare (6ef632b82)
    • Do not use native node to run test:prepare (eca36cfe5)
    • Lint docs (3b9784111)
    • Update valid semantic scopes (3c38d1f8b)
    • Ignore nitro templates (27cf85bdc)
    • Update internal links (aac763017)
    • Remove vue-demi from ignoredBuiltDependencies (#33494)
    • Update vscode url (#33360)
    • Correct jsdoc location for function used as parameters (#33507)
    • Remove code comment (#33515)
    • Patch changelogen for large numbers of commits (bd36738b8)
    • Link Nuxt 1.x and 2.x (2016–2022) history to main (85838dfd9)
    • Filter out commits before last tag when constructing changelog (1c561daeb)
    • Also respect since date for bump type (08900f610)
    • Also respect since in nightly releases (74ca73ca1)
    • Ignore @ rollup/plugin-commonjs (cd12980ce)

    ✅ Tests

    • Refactor suite to use common matrix utils (#33483)

    🤖 CI

    • Publish @ nuxt/nitro-server on pkg-pr-new (b7ccf17bf)
    • Remove nitro-server publish until v4.2 is released (904d4f6ec)

    ❤️ Contributors

  • 4.1.3 - 2025-10-06

    4.1.3 is a regularly scheduled patch release.

    ✅ Upgrading

    Our recommendation for upgrading is to run:

    npx nuxt upgrade --dedupe

    This will deduplicate your lockfile as w...

Snyk has created this PR to upgrade nuxt from 3.12.4 to 4.2.1.

See this package in npm:
nuxt

See this project in Snyk:
https://app.snyk.io/org/nerds-github/project/8b4160ff-3510-4d06-a27b-7930a5e75719?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants