Skip to content

[Snyk] Upgrade nuxt from 3.12.4 to 4.1.0 #1252

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Upgrade nuxt from 3.12.4 to 4.1.0 #1252

wants to merge 1 commit into from

Conversation

nerdy-tech-com-gitub
Copy link
Owner

snyk-top-banner

Snyk has created this PR to upgrade nuxt from 3.12.4 to 4.1.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

  • The recommended version is 38 versions ahead of your current version.

  • The recommended version was released 23 days ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Excessive Platform Resource Consumption within a Loop
SNYK-JS-BRACES-6838727		 140 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-CROSSSPAWN-8303230		 140 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-ES5EXT-6095076		 140 Proof of Concept
high severity Acceptance of Extraneous Untrusted Data With Trusted Data
SNYK-JS-NUXT-9486043		 140 No Known Exploit
high severity Insecure Randomness
SNYK-JS-UNDICI-8641354		 140 Proof of Concept
high severity Incorrect Authorization
SNYK-JS-VITE-9653016		 140 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BABELHELPERS-9397697		 140 Proof of Concept
medium severity Missing Release of Resource after Effective Lifetime
SNYK-JS-INFLIGHT-6095116		 140 Proof of Concept
medium severity Inefficient Regular Expression Complexity
SNYK-JS-MICROMATCH-6838728		 140 No Known Exploit
medium severity Improper Input Validation
SNYK-JS-NANOID-8492085		 140 No Known Exploit
medium severity Improper Input Validation
SNYK-JS-NANOID-8492085		 140 No Known Exploit
medium severity Origin Validation Error
SNYK-JS-NUXTVITEBUILDER-8663232		 140 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-PARSEGITCONFIG-9403763		 140 Proof of Concept
medium severity Cross-site Scripting (XSS)
SNYK-JS-ROLLUP-8073097		 140 Proof of Concept
medium severity Information Exposure
SNYK-JS-VITE-8023174		 140 Proof of Concept
medium severity Origin Validation Error
SNYK-JS-VITE-8648411		 140 Proof of Concept
medium severity Incorrect Authorization
SNYK-JS-VITE-9512410		 140 Mature
medium severity Access Control Bypass
SNYK-JS-VITE-9576207		 140 Proof of Concept
medium severity Information Exposure
SNYK-JS-VITE-9685035		 140 Proof of Concept
medium severity Directory Traversal
SNYK-JS-VITE-9919777		 140 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BRACEEXPANSION-9789073		 140 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BRACEEXPANSION-9789073		 140 Proof of Concept
critical severity Prototype Pollution
SNYK-JS-DEVALUE-12205530		 140 Proof of Concept
low severity Directory Traversal
SNYK-JS-NUXT-12878602		 140 Proof of Concept
low severity Cross-site Scripting
SNYK-JS-SEND-7926862		 140 No Known Exploit
low severity Cross-site Scripting
SNYK-JS-SERVESTATIC-7926865		 140 No Known Exploit
low severity Directory Traversal
SNYK-JS-SIRV-12558119		 140 Proof of Concept
low severity Missing Release of Memory after Effective Lifetime
SNYK-JS-UNDICI-10176064		 140 Proof of Concept
low severity Relative Path Traversal
SNYK-JS-VITE-12558116		 140 Proof of Concept
low severity Cross-site Scripting (XSS)
SNYK-JS-VITE-8022916		 140 Proof of Concept
Release notes
Package name: nuxt
  • 4.1.0 - 2025-09-02

    👀 Highlights

    🔥 Build and Performance Improvements

    🍫 Enhanced Chunk Stability

    Build stability has been significantly improved with import maps (#33075). This prevents cascading hash changes that could invalidate large portions of your build when small changes are made:

    <!-- Automatically injected import map -->
<script type="importmap">{"imports":{"#entry":"/_nuxt/DC5HVSK5.js"}}</script>

    By default, JS chunks emitted in a Vite build are hashed, which means they can be cached immutably. However, this can cause a significant issue: a change to a single component can cause every hash to be invalidated, massively increasing the chance of 404s.

    In short:

    1. a component is changed slightly - the hash of its JS chunk changes
    2. the page which uses the component has to be updated to reference the new file name
    3. the entry now has its hash changed because it dynamically imports the page
    4. every other file which imports the entry has its hash changed because the entry file name is changed

    Obviously this wasn't optimal. With this new feature, the hash of (otherwise) unchanged files which import the entry won't be affected.

    This feature is automatically enabled and helps maintain better cache efficiency in production. It does require native import map support, but Nuxt will automatically disable it if you have configured vite.build.target to include a browser that doesn't support import maps.

    And of course you can disable it if needed:

    export default defineNuxtConfig({
  experimental: {
    entryImportMap: false
  }
})

    🦀 Experimental Rolldown Support

    Nuxt now includes experimental support for rolldown-vite (#31812), bringing Rust-powered bundling for potentially faster builds.

    To try Rolldown in your Nuxt project, you need to override Vite with the rolldown-powered version since Vite is a dependency of Nuxt. Add the following to your package.json:

    npm:

    {
  "overrides": {
    "vite": "npm:rolldown-vite@latest"
  }
}

    pnpm:

    {
  "pnpm": {
    "overrides": {
      "vite": "npm:rolldown-vite@latest"
    }
  }
}

    yarn:

    {
  "resolutions": {
    "vite": "npm:rolldown-vite@latest"
  }
}

    bun:

    {
  "overrides": {
    "vite": "npm:rolldown-vite@latest"
  }
}

    After adding the override, reinstall your dependencies. Nuxt will automatically detect when Rolldown is available and adjust its build configuration accordingly.

    For more details on Rolldown integration, see the Vite Rolldown guide.

    Note

    This is experimental and may have some limitations, but offers a glimpse into the future of high-performance bundling in Nuxt.

    🧪 Improved Lazy Hydration

    Lazy hydration macros now work without auto-imports (#33037), making them more reliable when component auto-discovery is disabled:

    <script setup>
// Works even with components: false
const LazyComponent = defineLazyHydrationComponent(
  'visible',
  () => import('./MyComponent.vue')
)
</script>

    This ensures that components that are not "discovered" through Nuxt (e.g., because components is set to false in the config) can still be used in lazy hydration macros.

    📄 Enhanced Page Rules

    If you have enabled experimental extraction of route rules, these are now exposed on a dedicated rules property on NuxtPage objects (#32897), making them more accessible to modules and improving the overall architecture:

    // In your module
nuxt.hook('pages:extend', pages => {
  pages.push({
    path: '/api-docs',
    rules: { 
      prerender: true,
      cors: true,
      headers: { 'Cache-Control': 's-maxage=31536000' }
    }
  })
})

    The defineRouteRules function continues to work exactly as before, but now provides better integration possibilities for modules.

    🚀 Module Development Enhancements

    🪾 Module Dependencies and Integration

    Modules can now specify dependencies and modify options for other modules (#33063). This enables better module integration and ensures proper setup order:

    export default defineNuxtModule({
  meta: {
    name: 'my-module',
  },
  moduleDependencies: {
    'some-module': {
      // You can specify a version constraint for the module
      version: '>=2',
      // By default moduleDependencies will be added to the list of modules 
      // to be installed by Nuxt unless `optional` is set.
      optional: true,
      // Any configuration that should override `nuxt.options`.
      overrides: {},
      // Any configuration that should be set. It will override module defaults but
      // will not override any configuration set in `nuxt.options`.
      defaults: {}
    }
  },
  setup (options, nuxt) {
    // Your module setup logic
  }
})

    This replaces the deprecated installModule function and provides a more robust way to handle module dependencies with version constraints and configuration merging.

    🪝 Module Lifecycle Hooks

    Module authors now have access to two new lifecycle hooks: onInstall and onUpgrade (#32397). These hooks allow modules to perform additional setup steps when first installed or when upgraded to a new version:

    export default defineNuxtModule({
    meta: {
    name: 'my-module',
    version: '1.0.0',
    },

    onInstall(nuxt) {
    // This will be run when the module is first installed
    console.log('Setting up my-module for the first time!')
    },

    onUpgrade(inlineOptions, nuxt, previousVersion) {
    // This will be run when the module is upgraded
    console.log(Upgrading my-module from v<span class="pl-s1"><span class="pl-kos">${</span><span class="pl-s1">previousVersion</span><span class="pl-kos">}</span></span>)
    }
    })

    The hooks are only triggered when both name and version are provided in the module metadata. Nuxt uses the .nuxtrc file internally to track module versions and trigger the appropriate hooks. (If you haven't come across it before, the .nuxtrc file should be committed to version control.)

    Tip

    This means module authors can begin implementing their own 'setup wizards' to provide a better experience when some setup is required after installing a module.

    🙈 Enhanced File Resolution

    The new ignore option for resolveFiles (#32858) allows module authors to exclude specific files based on glob patterns:

    // Resolve all .vue files except test files
const files = await resolveFiles(srcDir, '**/*.vue', {
  ignore: ['**/*.test.vue', '**/__tests__/**']
})

    📂 Layer Directories Utility

    A new getLayerDirectories utility (#33098) provides a clean interface for accessing layer directories without directly accessing private APIs:

    import { getLayerDirectories } from '@ nuxt/kit'

    const layerDirs = await getLayerDirectories(nuxt)
    // Access key directories:
    // layerDirs.app - /app/ by default
    // layerDirs.appPages - /app/pages by default
    // layerDirs.server - /server by default
    // layerDirs.public - /public by default

    ✨ Developer Experience Improvements

    🎱 Simplified Kit Utilities

    Several kit utilities have been improved for better developer experience:

    • addServerImports now supports single imports (#32289):
    // Before: required array
    addServerImports([{ from: 'my-package', name: 'myUtility' }])

    // Now: can pass directly
    addServerImports({ from: 'my-package', name: 'myUtility' })

    🔥 Performance Optimizations

    This release includes several internal performance optimizations:

    • Improved route rules cache management (#32877)
    • Optimized app manifest watching (#32880)
    • Better TypeScript processing for page metadata (#32920)

    🐛 Notable Fixes

    • Improved useFetch hook typing (#32891)
    • Better handling of TypeScript expressions in page metadata (#32902, #32914)
    • Enhanced route matching and synchronization (#32899)
    • Reduced verbosity of Vue server warnings in development (#33018)
    • Better handling of relative time calculations in <NuxtTime> (#32893)

    ✅ Upgrading

    As usual, our recommendation for upgrading is to run:

    npx nuxt upgrade --dedupe

    This will refresh your lockfile and pull in all the latest dependencies that Nuxt relies on, especially from the unjs ecosystem.

    👉 Changelog

    compare changes

    🚀 Enhancements

    • kit: Add ignore option to resolveFiles (#32858)
    • kit: Add onInstall and onUpgrade module hooks (#32397)
    • nuxt,vite: Add experimental support for rolldown-vite (#31812)
    • nuxt: Extract defineRouteRules to page rules property (#32897)
    • nuxt,vite: Use importmap to increase chunk stability (#33075)
    • nuxt: Lazy hydration macros without auto-imports (#33037)
    • kit,nuxt,schema: Allow modules to specify dependencies (#33063)
    • kit,nuxt: Add getLayerDirectories util and refactor to use it (#33098)

    🔥 Performance

    • nuxt: Clear inline route rules cache when pages change (#32877)
    • nuxt: Stop watching app manifest once a change has been detected (#32880)

    🩹 Fixes

    • nuxt: Handle satisfies in page augmentation (#32902)
    • nuxt: Type response in useFetch hooks (#32891)
    • nuxt: Add TS parenthesis and as expression for page meta extraction (#32914)
    • nuxt: Use correct unit thresholds for relative time (#32893)
    • nuxt: Handle uncached current build manifests (#32913)
    • kit: Resolve directories in resolvePath and normalize file extensions (#32857)
    • schema,vite: Bump requestTimeout + allow configuration (#32874)
    • nuxt: Deep merge extracted route meta (#32887)
    • nuxt: Do not expose app components until fully resolved (#32993)
    • kit: Only exclude node_modules/ if no custom srcDir (#32987)
    • nuxt: Transform ts before page meta extraction (#32920)
    • nuxt: Compare final matched routes when syncing route object (#32899)
    • nuxt: Make vue server warnings much less verbose in dev mode (#33018)
    • schema: Allow disabling cssnano/autoprefixer postcss plugins (#33016)
    • kit: Ensure local layers are prioritised alphabetically (#33030)
    • kit,nuxt: Expose global types to vue compiler (#33026)
    • deps: Bump devalue (#33072)
    • nuxt: Support config type inference for defineNuxtModule().with() (#33081)
    • nuxt: Search for colliding names in route children (b58c139d2)
    • nuxt: Delete nuxtApp._runningTransition on resolve (#33025)
    • nuxt: Add validation for nuxt island reviver key (#33069)

    💅 Refactors

    • nuxt: Simplify page segment parsing (#32901)
    • nuxt: Remove unnecessary async/await in afterEach (#32999)
    • vite: Simplify inline chunk iteration (6f4da1b8c)
    • kit,nuxt,ui-templates,vite: Address deprecations + improve regexp perf (#33093)

    📖 Documentation

    • Switch example to use vitest projects (#32863)
    • Update testing setupTimeout and add teardownTimeout (#32868)
    • Update webRoot to use new app directory (df7177bff)
    • Add middleware to layers guide (6fc25ff79)
    • Use app/ directory in layer guide (eee55ea41)
    • Add documentation for --nightly command (#32907)
    • Update package information in roadmap section (#32881)
    • Add more info about nuxt spa loader element attributes (#32871)
    • Update features.inlineStyles default value (6ff3fbebb)
    • Correct filename in example (#33000)
    • Add more information about using useRoute and accessing route in middleware (#33004)
    • Avoid variable shadowing in locale example (#33031)
    • Add documentation for module lifecycle hooks (#33115)

    🏡 Chore

    • config: Migrate renovate config (#32861)
    • Remove stray test file (ca84285cc)
    • Ignore webpagetest.org when scanning links (6c974f0be)
    • Add type: 'module' in playground (#33099)

    ✅ Tests

    • Add failing test for link component duplication (#32792)
    • Simplify module hook tests (#32950)
    • Refactor stubbing of import.meta.dev (#33023)
    • Use findWorkspaceDir rather than relative paths to repo root (a6dec5bd9)
    • Improve router test for global transitions (5d783662c)
    • Use expect.poll (53fb61d5d)
    • Use expect.poll instead of expectWithPolling (357492ca7)
    • Use vi.waitUntil instead of custom retry logic (611e66a47)

    🤖 CI

    • Remove double set of tests for docs prs (6bc9dccf4)
    • Add workflow for discord team discussion threads (bc656a24d)
    • Fix some syntax issues with discord + github integrations (f5f01b8c1)
    • Use token for adding issue to project (66afbe0a2)
    • Use discord bot to create thread automatically (618a3cd40)
    • Only use discord bot (bfd30d8ce)
    • Update format of discord message (eb79a2f07)
    • Try bolding entire line (c66124d7b)
    • Oops (38644b933)
    • Add delay after adding each reaction (ecb49019f)
    • Use last lts node version for testing (e06e37d02)
    • Try npm trusted publisher (85f1e05eb)
    • Use npm trusted publisher for main releases (abf5d9e9f)
    • Change wording (#32979)
    • Add github ai moderator (#33077)

    ❤️ Contributors

  • 4.0.3 - 2025-08-05

    4.0.3 is a regularly scheduled patch release.

    👉 Changelog

    compare changes

    🔥 Performance

    • kit: Get absolute path from tinyglobby in resolveFiles (#32846)

    🩹 Fixes

    • nuxt: Do not throw undefined error variable (#32807)
    • vite: Include tsconfig references during typeCheck (#32835)
    • nuxt: Add sourcemap path transformation for client builds (#32313)
    • nuxt: Add warning for lazy-hydration missing prefix (#32832)
    • nuxt: Trigger call once navigation even when no suspense (#32827)
    • webpack: Handle null result from webpack call (84816d8a1)
    • kit,nuxt: Use reverseResolveAlias for better errors (#32853)

    📖 Documentation

    • Fix publicDir alias (#32841)
    • Mention bun.lock for lockfile (#32820)
    • Add a section about augmenting types with TS project references (#32843)
    • Improve explanation of global middleware (#32855)

    🏡 Chore

    • Update reproduction help text links (#32803)
    • Update pnpm ignored build scripts (#32849)
    • Improve internal types (052b98a35)

    ✅ Tests

    • Move tests for defineNuxtComponent out of e2e test (#32848)

    🤖 CI

    • Move nightly releases into different concurrency group (664041be7)

    ❤️ Contributors

  • 4.0.2 - 2025-07-29

    4.0.2 is the next patch release.

    Timetable: 28 July.

    👉 Changelog

    compare changes

    🩹 Fixes

    • nuxt: Provide typed slots for <ClientOnly> and <DevOnly> (#32707)
    • kit,nuxt,schema: Add trailing slash to some dir aliases (#32755)
    • nuxt: Constrain global defineAppConfig type (#32760)
    • kit: Include module types in app context (#32758)
    • nuxt: Include source base url for remote islands (#32772)
    • vite: Use vite node server to transform requests (#32791)
    • kit: Use mlly to parse module paths (#32386)
    • nuxt: Execute all plugins after error rendering error.vue (#32744)

    📖 Documentation

    • Update Nuxt installation command to use npm create nuxt@latest (#32726)
    • Add AI-assisted contribution guidelines (#32725)
    • Hydration best practice (#32746)
    • Add example for module .with() (

@snyk-bot
feat: upgrade nuxt from 3.12.4 to 4.1.0
d416f08 
Snyk has created this PR to upgrade nuxt from 3.12.4 to 4.1.0.

See this package in npm:
nuxt

See this project in Snyk:
https://app.snyk.io/org/nerds-github/project/d13fd520-df96-4b88-87f8-38a6d7c57850?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@nerdy-tech-com-gitub @snyk-bot