In @vercel/analytics@2.0.0, nuxt is listed in peerDependencies but is missing from peerDependenciesMeta as optional: true. All other framework peer dependencies (next, react, svelte, vue, etc.) are correctly marked optional, but nuxt was omitted.
As a result, npm installs the full Nuxt dependency tree into projects that don't use Nuxt at all. This brings in nitropack → @rollup/plugin-terser → serialize-javascript <=7.0.2, which triggers 6 high severity vulnerability warnings.
Steps to reproduce:
- Install
@vercel/analytics@2.0.0 in a non-Nuxt project
- Run
npm audit
Expected: No vulnerabilities — Nuxt should not be installed at all.
Actual: 6 high severity vulnerabilities from the transitive serialize-javascript dep pulled in via Nuxt.
Workaround: Downgrade to @vercel/analytics@1.6.1, which has no framework dependencies.
peerDependenciesMeta in v2.0.0 for reference:
{
"@remix-run/react": { "optional": true },
"@sveltejs/kit": { "optional": true },
"next": { "optional": true },
"react": { "optional": true },
"svelte": { "optional": true },
"vue": { "optional": true },
"vue-router": { "optional": true }
}
nuxt is absent from this list.