4.6.4 is a security release. It fixes eight advisories in Nuxt and pulls in nitropack 2.13.6, which fixes three more in Nitro. We recommend upgrading as soon as you can. ⚠️ Behaviour changes These probably won't affect most apps, but it's worth flagging anyway: Error details in production. When a page fails to render on the server, the error page and the payload now only carry message and data of…
v4.6.3 is the next patch release. 👉 Changelog compare changes 🚨 Security fixes vite: do not read files named in client error reports (63299e13c) - GHSA-x287-wcfc-q46c vite: deny dev server access to nitro dev output (c7e204ec6) - GHSA-648h-gw55-m2g7 vite: deny serving generated app secret in dev (16dfdc2a9) - GHSA-3xf4-9g3c-4h4w nitro,nuxt: handle dot segments in request paths (440250d97) - GHSA-9…
v4.6.2 is the next patch release. 👉 Changelog compare changes 🩹 Fixes nitro: apply useHeadSafe rules to server island head (493565e99) nitro-server: read router params from the path h3 matched (010f6b43d) nitro: match server route rules case-insensitively unless routing is sensitive (f6cfee52c) nuxt: resolve rooted paths through the URL parser (#36617) nuxt: resolve empty route types in shared con…
v4.6.1 is the next patch release. 👉 Changelog compare changes 🔥 Performance nitro: build the portable event's web view on first access (cffb182d6) 🩹 Fixes vite: match vite 8.1+ optimizer messages for deps hint (#36525) nuxt: accept any baseURL when fetch response type is named (#36523) nitro: resolve nitropack/types declarations under nodenext (242e1971e) nuxt: allow false in setPageLayout types (…
v4.6.0 is the next minor release. 📣 Some news 🖥️ Nuxt CLI v4 Alongside the release of Nuxt v4.6, today also brings a new major release of the Nuxt CLI: @nuxt/cli v4. It ships as a dependency of nuxt, so you'll get it automatically when you upgrade. Most of what's new is in nuxt dev: an interactive terminal UI, showing URLs, startup progress and keyboard shortcuts, with panels to dive into error lo…
3.21.11 is a patch release. ImportantNuxt v3 is now end-of-life. Please upgrade to Nuxt v4, or you may wish to check out our partner HeroDevs who provide never-ending support for end-of-life releases 👉 Changelog compare changes 🩹 Fixes nuxt: Serialize island payloads for components with underscores in keys (#35807) nitro: Dedupe island renders when prerendering (#35835) nitro: Reject non-object is…
4.5.2 is the next patch release. 👉 Changelog compare changes 🔥 Performance nuxt,kit: Skip rewriting unchanged generated files (#35902) kit,nuxt: Use lazy imports to improve parsing speed (#35901) vite: Skip html entry probes in bare-import resolver (#35907) nuxt: Reuse app and component scans for unchanged structures (#35912) 🩹 Fixes vite: Resolve client manifest path from resolved config (#35883)…
perf(nuxt): reuse the page tree and contents cache on page edits
⚠️ This is a security release. We recommend upgrading as soon as possible with npx nuxt upgrade --dedupe. It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.…
⚠️ This is a security release. We recommend upgrading as soon as possible with npx nuxt upgrade --dedupe. It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, cross-user payload disclosure on cached pages, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which…
4.5.0 is the next minor release. 📣 Some News Preparing for Nuxt 5 A good chunk of this release is (hopefully) invisible plumbing for Nuxt 5. We've moved onto the latest major versions of several core dependencies (unhead v3, unctx v3, and Vite 8), switched the framework's own build over to tsdown, and introduced a stable nuxt/* build output contract with dev exports so that type-checking in the Nu…
3.21.9 is the next patch release. 👉 Changelog compare changes 🩹 Fixes vite: Use spa entry for vite-node fallback (3.x) (c8410a16a) kit,nuxt: Pass error as cause when we re-throw (#35387) vite: Inline CSS for lazy components imported from #components (#35215) nuxt: Validate <ClientOnly> fallback tag name (#35325) vite: Extract server page CSS when inlineStyles is disabled (#35209) nitro: Include ne…
4.4.8 is a hotfix release to address an issue running the dev server on MacOS. 👉 Changelog compare changes 🩹 Fixes vite: Shorter socket name for macOs with tmp fallback (#35265) kit: Respect type option in findPath (#35272) deps: Update nuxt/scripts presets (905621594) nuxt: Revert unhead dependency back to v2 (e6d578fea) 📖 Documentation Fix many typos (#35266) Explain static fallback pages (#3527…
3.21.8 is a hotfix release to address an issue running the dev server on MacOS. 👉 Changelog compare changes 🩹 Fixes vite: Shorter socket name for macOs with tmp fallback (#35265) kit: Respect type option in findPath (#35272) deps: Update nuxt/scripts presets (ff6b060dd) 📖 Documentation Change null to undefined in data-fetching docs to match actual types (#35301) ❤️ Contributors Daniel Roe (@daniel…
4.4.7 is a security hotfix release. 👉 make sure to check https://github.com/nuxt/nuxt/security/advisories to view open advisories resolved by this release. 👉 Changelog compare changes 🩹 Fixes nitro: Assign noSSR before deciding payload extraction (#35108) vite: Avoid filtering out dirs with shared prefix from allowDirs (#35112) nuxt: Use resolve from pathe for buildCache path boundary check (#3511…
3.21.7 is the a security hotfix release. 👉 make sure to check https://github.com/nuxt/nuxt/security/advisories to view open advisories resolved by this release. 👉 Changelog compare changes 🩹 Fixes nitro: Assign noSSR before deciding payload extraction (#35108) vite: Avoid filtering out dirs with shared prefix from allowDirs (#35112) nuxt: Use resolve from pathe for buildCache path boundary check (…
4.4.6 is the next patch release. 👉 Changelog compare changes 🩹 Fixes vite: Use spa entry for vite-node fallback (#35037) vite: Invalidate SSR module cache when modules are invalidated via plugin hooks (a86657a0e) nuxt: Match deduplicated resolveComponent calls in jsx blocks (#35028) nuxt: Prefer our own builder/server deps (#35029) nuxt: Update useFetch key even with watch: false (#35002) nitro: M…
3.21.6 is the next patch release. 👉 Changelog compare changes 🩹 Fixes nuxt: Prefer our own builder/server deps (#35029) nitro: Add json extension to payload cache items (#35043) nuxt: Handle errors fetching app manifest (#35050) nuxt: Preserve setPageLayout props on same-path navigation (#35055) vite: Don't strip buildAssetsDir from vite-node SSR ids (#35040) nuxt: Mark useLoadingIndicator propert…
4.4.5 is the next patch release. 👉 Changelog compare changes 🔥 Performance kit: Cache layer roots and short-circuit isIgnored relative (#35015) 🩹 Fixes vite: Resolve vite clientServer with ssr: false (#34959) nitro: Correct payload route rule for / + override ssr: true (#34990) nitro: Break recursive rendering deadlocks during prerender (#34939) vite: Drop redundant css link when entry styles are…
3.21.5 is the next patch release. 👉 Changelog compare changes 🔥 Performance kit: Cache layer roots and short-circuit isIgnored relative (#35015) 🩹 Fixes nitro: Correct payload route rule for / + override ssr: true (#34990) nitro: Break recursive rendering deadlocks during prerender (#34939) vite: Drop redundant css link when entry styles are inlined (#34950) nuxt: Only force suspense remount after…
4.4.3 is the next patch release. v4.4.4 was published with no changes due to an issue running the release script for v4.4.3. 👉 Changelog compare changes 🔥 Performance nitro: Directly import nuxt package version (#34567) vite,webpack: Use vfs for manifest + vite node server (#34666) nuxt: Clean-up build hooks + emit gc'd snapshots (#34587) nuxt: Skip key watcher when useAsyncData key is static (#34…
v4.4.4