Skip to content

nuxt peer dependency not marked as optional in peerDependenciesMeta, causing npm to install full Nuxt stack #192

@phloe

Description

@phloe

In @vercel/analytics@2.0.0, nuxt is listed in peerDependencies but is missing from peerDependenciesMeta as optional: true. All other framework peer dependencies (next, react, svelte, vue, etc.) are correctly marked optional, but nuxt was omitted.

As a result, npm installs the full Nuxt dependency tree into projects that don't use Nuxt at all. This brings in nitropack@rollup/plugin-terserserialize-javascript <=7.0.2, which triggers 6 high severity vulnerability warnings.

Steps to reproduce:

  1. Install @vercel/analytics@2.0.0 in a non-Nuxt project
  2. Run npm audit

Expected: No vulnerabilities — Nuxt should not be installed at all.

Actual: 6 high severity vulnerabilities from the transitive serialize-javascript dep pulled in via Nuxt.

Workaround: Downgrade to @vercel/analytics@1.6.1, which has no framework dependencies.

peerDependenciesMeta in v2.0.0 for reference:

{
  "@remix-run/react": { "optional": true },
  "@sveltejs/kit": { "optional": true },
  "next": { "optional": true },
  "react": { "optional": true },
  "svelte": { "optional": true },
  "vue": { "optional": true },
  "vue-router": { "optional": true }
}

nuxt is absent from this list.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions