chore(deps): update nuxt framework to ^4.6.3 by renovate[bot] · Pull Request #951 · nuxt/scripts

renovate · 2026-10-11T04:25:20Z

This PR contains the following updates:

Package	Change	Age	Confidence
@nuxt/kit (source)	`^4.6.0` → `^4.6.3`
nuxt (source)	`^4.6.0` → `^4.6.3`

Release Notes

nuxt/nuxt (@nuxt/kit)

`v4.6.3`

Compare Source

v4.6.3 is the next patch release.

👉 Changelog

compare changes

🚨 Security fixes

vite: do not read files named in client error reports (63299e13c) - GHSA-x287-wcfc-q46c
vite: deny dev server access to nitro dev output (c7e204ec6) - GHSA-648h-gw55-m2g7
vite: deny serving generated app secret in dev (16dfdc2a9) - GHSA-3xf4-9g3c-4h4w
nitro,nuxt: handle dot segments in request paths (440250d97) - GHSA-9v7c-q64q-vv33
nuxt: apply redirect route rules to page islands (b20372dbe) - GHSA-2fxj-c3j7-rr69

🔥 Performance

vite: skip compiling plain style blocks in the server build (#36711)
nitro,nuxt,rspack,webpack: bundle esm vue + reuse caches (#36710)
vite: avoid quadratic nested dir check for fs.allow (#36702)
nuxt: server render internal custom links without RouterLink (#36707)
nuxt: skip unneeded typed routes generation (#36645)

🩹 Fixes

nitro: don't share prerender hints with self-fetched requests (#36705)
nuxt: defer app scope cleanup on external navigation (#36713)
nuxt: prevent useCookie CookieStore sync from rewriting with refresh (#36673)
nuxt: only return redirects from navigateTo while middleware runs (#36650)
nuxt: remove purged entries from _asyncData (#36709)
vite: skip quoted import.meta keys + limit replace to client dev (#36703)
nuxt: hide RouteLocationRaw from navigateTo's public return type (#36691)
nuxt: tree-shake auto-imported #app composables (#36696)
nuxt: don't treat constrained route rules as covering dynamic pages (#36701)
nuxt: include shared/ in build cache hash (#36704)
nuxt: hash keyed function ids + page import names relative to rootDir (#36697)
nuxt: encode page paths before matching route rule keys (#36683)
nuxt: handle rejected updateCallbackDone of aborted view transition (#36639)
ui-templates: keep loading shader proportions on narrow screens (#36654)
nuxt: reject case-dependent route rule constraints w/ sensitive: false (#36708)
nuxt: don't case-fold regex constraints in route rule keys (#36694)
nuxt: normalise page prefix when finding route rule exceptions (#36685)
vite: mirror ssr invalidations for created and deleted files (634cba64c)
nitro: keep noScripts wildcard patterns single-segment (fa323db7d)
deps: update unrouting to v0.3.1 (#36663)
nuxt: avoid self-referencing nuxt/schema augmentation (#36633)
nuxt: let nightly runtime resolve its own nuxt/* imports (#36632)
nuxt: don't warn for vite+ vite.config files (#36628)
kit: keep generated declaration first in tsconfig include (#36627)
nuxt: clamp numeric v-for sources in island renders at render time (#36623)
rspack,webpack: register vue-loader plugin only once per config (#36622)
nitro: abort the portable request when the client disconnects (#36652)
deps: update nitropack to 2.13.5 + drop obsolete workarounds (#36649)

📖 Documentation

note provide/inject limit in server components (#35837)
use American spelling in a few guides (#36706)
document controlling prefetch hints via build:manifest hook (#36695)
update StackBlitz link to point to version 4 (#36674)
link to the 2.x docs (#36640)
clarify that island props must be validated before iteration (4b12d15c9)

✅ Tests

list NUXT_B4023 as main-only (4fd54ff9a)
wait for leave transition before each scroll behaviour test (453406999)
vite: assert spa server bundle does not ship the app (#36699)
nuxt: cover route rule coverage under a base url (#36682)
list NUXT_B9006 as main-only (e107e0f40)

🤖 CI

only run full checks for the last merge queue entry (132698a46)
run a reduced matrix in the merge queue (7d228ba4b)
compare merge queue changes against the base branch (bad8c3637)
notify resolved issues after publishing a release (9d47884f3)
remove broken ai-moderator and ecosystem-ci trigger workflows (1d89ad434)

🎉 New Contributors

rynx.z (@rynx-cc)
Felix Fang (@FelixFangX)
Volkan Akyel (@volkanakyel)
Gareth (@0xgdr)

❤️ Contributors

Daniel Roe (@danielroe)
rynx.z (@rynx-cc)
Felix Fang (@FelixFangX)
Max (@onmax)
Volkan Akyel (@volkanakyel)
Bochkarev Ivan (@Ibochkarev)
Gareth (@0xgdr)
Hugo (@HugoRCD)
Sébastien Chopin (@atinux)
Eduardo San Martin Morote (@posva)
Baptiste Leproux (@larbish)
Benjamin Canac (@benjamincanac)

`v4.6.2`

Compare Source

v4.6.2 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes

nitro: apply useHeadSafe rules to server island head (493565e99)
nitro-server: read router params from the path h3 matched (010f6b43d)
nitro: match server route rules case-insensitively unless routing is sensitive (f6cfee52c)
nuxt: resolve rooted paths through the URL parser (#36617)
nuxt: resolve empty route types in shared context (#36576)
nitro: preserve server tsconfig with relocated build dir (#36494)
nuxt: fix scroll offset for IDs starting with numbers (#36524)
kit: do not exclude module directories with a dot in their name from app tsconfig (#36331)
nuxt: detect vapor slots with rawVaporSlotKey from vue (#36614)
nuxt: keep middleware layout when restoring deferred prerendered route (#36560)
schema: provide default value for experimental.typescriptPlugin (#36561)
vite: only replay compile error overlays to newly loaded pages (#36611)
nuxt: re-export AnyFetchPath for emitted server route types (#36610)
vite: warm up the dev ssr entry from a nitro plugin (#36615)
nitro: avoid unused h3 imports in nuxt/server runtime (#36609)
vite-server: scope asset url helpers to the build (#36591)
nuxt: resolve nuxt/app to the app's runtime (#36587)
kit: lowercase filename-derived handler method on nitro v2 (#36567)
nuxt,nitro: normalise string/array appMiddleware (#36565)
nitro: pass response headers to render:response listeners (#36583)
vite: resolve inlined vue to its bundler build in dev (#36569)
nuxt: don't start a page transition with no page to leave (#36535)
nuxt: preserve error state on aborted or cancelled navigation (#36546)
vite,nitro: link null-byte virtual css through /@id/ in dev (#36549)
kit: resolve module dependencies from the declaring module (#36542)
nitro: only disable h3 + nitro presets when nitroAutoImports is off (#36548)
nitro,vite: don't access unspecified dependencies (#36541)
nitro: don't inline deps under absolute transpile dirs (#36540)
vite-server: respect spa loading template location (#36536)

💅 Refactors

webpack,rspack: inline friendly errors plugin (#36568)

📖 Documentation

remove DeepWiki badge (#36616)
rename H(TTP) to HTTP (#36559)
mention proxy route rule (4a529be68)
reference definePlugin and defineNitroPlugin in server plugin tip (64b8e0334)
open a PR to list a module (e551df267)
clarify testing environments, runners, and config (#32963)
align spa loading template references (#36552)
explain how to disable iOS Safari phone number detection (#36539)
fix outdated internal links (#36550)
explain how to restore nitro auto-imports with compat v5 (7499a445b)
add spa-loading-template documentation (#36537)

🏡 Chore

keep @nuxt/telemetry ignore for production mode 😭 (3110d6947)
fix knip, eslint and type import failures in ci (fb01db4eb)
exclude nuxt/app entry shim from root typecheck (c65cef3a8)
animate readme banner (#36593)
actually exclude fixtures from test:engines (6ce412822)
resolve #build/server-routes stub via root tsconfig paths (8235dd605)

✅ Tests

wait for scroll to settle in route-scroll e2e (ca784deb7)

🤖 CI

comment nuxt.com preview links on docs pull requests (#36594)
regenerate kit inlinedDependencies in autofix (4b6da3a29)
remove docs deploy triggers (917bdf218)

🎉 New Contributors

Sandro Circi (@sandros94)
Yunus Ozen (@ozenyunus35)
Vladislav (@dsfcoll)
AXH-xecoy (@axh-xecoy)
Jess (@JessicaSachs)
Gareth (@0xgdr)

❤️ Contributors

Daniel Roe (@danielroe)
Jonas Thelemann (@dargmuesli)
Sandro Circi (@sandros94)
Yunus Ozen (@ozenyunus35)
Vladislav (@dsfcoll)
Sébastien Chopin (@atinux)
Kazbek Askarov (@kazbekaskarov)
Nicholas (@Neekoras)
Peter (@tada5hi)
Baptiste Leproux (@larbish)
Hugo (@HugoRCD)
Harlan Wilton (@harlan-zw)
AXH-xecoy (@axh-xecoy)
Jess (@JessicaSachs)
Alex Liu (@Mini-ghost)
Gareth (@0xgdr)
Florian Heuberger (@Flo0806)

`v4.6.1`

Compare Source

v4.6.1 is the next patch release.

👉 Changelog

compare changes

🔥 Performance

nitro: build the portable event's web view on first access (cffb182d6)

🩹 Fixes

vite: match vite 8.1+ optimizer messages for deps hint (#36525)
nuxt: accept any baseURL when fetch response type is named (#36523)
nitro: resolve nitropack/types declarations under nodenext (242e1971e)
nuxt: allow false in setPageLayout types (#36506)
nuxt: align Serialize object types with JSON (#36503)
vite: don't abort dep scan on virtual imports in installed packages (#36477)
nuxt: update publishConfig config export extension (64fa191cb)
kit: install the package a missing subpath belongs to (#36507)
vite-server: use the configured outDir as the public directory for non-ssr environment (#36501)
kit,nitro: match dev handler paths on both nitro majors (#36515)
nuxt: preserve onServerPrefetch for useId hydration (#36430)
vite-server: include the request in dev error reports (#36489)
nitro: register each dev server handler once (#36493)
nitro: pass RequestEvent to nuxt dev server handlers (e6beceea2)
nuxt: type the global $fetch with nuxt's TypedFetch (#36492)
vite-server: work with deploy target plugins in dev (#36491)
schema: ignore .wrangler directory (#36487)
vite-server: pass the path to the error page render (#36488)
nuxt,vite: disable dev error broadcast if BroadcastChannel throws (#36480)
kit: align semantic version regexp with nightly version format (#36479)
nuxt: export types reachable from async data composables (#36478)
vite: detect enclosing string delimiter in inline style urls (#36476)
schema: type the nuxt dev server handler variant (452052793)
nitro: inline nuxt runtime when resolved to windows paths (21657c6fc)
nitro: resolve unhead from nuxt in server bundle (dc1e2d6e6)

💅 Refactors

kit: use package-manager-detector workspace + deno handling (1563a6d25)

📖 Documentation

document dev server handlers and nuxt/server scope (7c36a1352)
fix nightly examples (#36486)

🏡 Chore

remove CLAUDE.md (#36462)
relax minimum release age exclude (bdf98e936)
update welcome template (787d0d980)

✅ Tests

resolve temporary fixture paths on macos (30742865c)
update test expectation (1f22a114d)

🤖 CI

publish 4.x releases to latest (682605dba)
update release workflows (3b8853489)

🎉 New Contributors

okueng (@okueng)
Kaan Gökdemir (@kaangokdemir)
Kazbek Askarov (@kazbekaskarov)
QvarcY (@QvarcY)
Bruno Belloni (@brunobelloni)
Arnaud Dematte (@adematte)

❤️ Contributors

Daniel Roe (@danielroe)
Sébastien Chopin (@atinux)
okueng (@okueng)
Kaan Gökdemir (@kaangokdemir)
Kazbek Askarov (@kazbekaskarov)
Estéban (@Barbapapazes)
QvarcY (@QvarcY)
Bruno Belloni (@brunobelloni)
Amulet Kerria (@KazariEX)
abeer0 (@iiio2)
Arnaud Dematte (@adematte)

Configuration

📅 Schedule: (UTC)

Branch creation
- Every minute (* * * * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

vercel · 2026-10-11T04:25:21Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
scripts-playground	Error		Oct 28, 2026 4:11am UTC

pkg-pr-new · 2026-10-11T04:27:12Z

Open in StackBlitz

npm i https://pkg.pr.new/@nuxt/scripts-devtools@951

npm i https://pkg.pr.new/@nuxt/scripts@951

commit: f3e14cb

github-actions · 2026-10-11T04:28:17Z

📦 Package Size

✅ No notable size changes

📚 22 runtime dependencies (no change)

All tracked output (25)

Package output	Gzipped	Raw
@nuxt/scripts-cli · runtime dependencies	72 kB	355 kB	✅
@nuxt/scripts-cli · dependency magicast	72 kB	355 kB	✅
@nuxt/scripts-cli · export .	3.4 kB	12 kB	✅
@nuxt/scripts-cli · published payload	3.4 kB	12 kB	✅
@nuxt/scripts · runtime dependencies	543 kB	2.40 MB	✅
@nuxt/scripts · dependency @oxc-project/types	0 B	0 B	✅
@nuxt/scripts · dependency @vueuse/core	178 kB	720 kB	✅
@nuxt/scripts · dependency @vueuse/shared	39 kB	152 kB	✅
@nuxt/scripts · dependency lru-cache	141 kB	623 kB	✅
@nuxt/scripts · dependency semver	25 kB	72 kB	✅
@nuxt/scripts · dependency sirv	8.8 kB	21 kB	✅
@nuxt/scripts · dependency unstorage	70 kB	225 kB	✅
@nuxt/scripts · dependency valibot	82 kB	590 kB	✅
@nuxt/scripts · dist/runtime	104 kB	306 kB	✅
@nuxt/scripts · export .	26 kB	106 kB	✅
@nuxt/scripts · export ./registry	30 kB	94 kB	✅
@nuxt/scripts · export ./stats	13 kB	92 kB	✅
@nuxt/scripts · export ./types-source	49 kB	247 kB	✅
@nuxt/scripts · published payload	223 kB	846 kB	✅
@nuxt/scripts · app runtime	176 B	658 B	✅
@nuxt/scripts · components runtime	2.5 kB	6.4 kB	✅
@nuxt/scripts · composables runtime	7.8 kB	26 kB	✅
@nuxt/scripts · registry runtime	46 kB	136 kB	✅
@nuxt/scripts · server runtime	30 kB	89 kB	✅
@nuxt/scripts · utils runtime	2.9 kB	8.1 kB	✅

Runtime dependencies (22)

Package	Dependency	Requested	Resolved	Cost
@nuxt/scripts-cli	magicast	^0.5.5	0.5.5	📦 72 kB gzip
@nuxt/scripts-cli	pathe	^2.0.3	2.0.3	♻️ free via Nuxt 4.6.2
@nuxt/scripts	@nuxt/kit	^4.6.2	4.6.2	♻️ free via Nuxt 4.6.2
@nuxt/scripts	@oxc-project/types	^0.153.0	0.153.0	📦 0 B gzip
@nuxt/scripts	@vueuse/core	^15.0.0	15.0.0	📦 178 kB gzip
@nuxt/scripts	@vueuse/shared	^15.0.0	15.0.0	📦 39 kB gzip
@nuxt/scripts	consola	^3.4.2	3.4.2	♻️ free via Nuxt 4.6.2
@nuxt/scripts	defu	^6.1.7	6.1.7	♻️ free via Nuxt 4.6.2
@nuxt/scripts	lru-cache	^11.5.3	11.5.3	📦 141 kB gzip
@nuxt/scripts	magic-string	^1.4.3	1.4.3	♻️ free via Nuxt 4.6.2
@nuxt/scripts	ofetch	^1.5.1	1.5.1	♻️ free via Nuxt 4.6.2
@nuxt/scripts	ohash	^2.0.12	2.0.12	♻️ free via Nuxt 4.6.2
@nuxt/scripts	oxc-walker	^1.1.1	1.1.1	♻️ free via Nuxt 4.6.2
@nuxt/scripts	pathe	^2.0.3	2.0.3	♻️ free via Nuxt 4.6.2
@nuxt/scripts	semver	^7.8.5	7.8.5	📦 25 kB gzip
@nuxt/scripts	sirv	^3.0.2	3.0.2	📦 8.8 kB gzip
@nuxt/scripts	std-env	^4.3.0	4.3.0	♻️ free via Nuxt 4.6.2
@nuxt/scripts	ufo	^1.6.4	1.6.4	♻️ free via Nuxt 4.6.2
@nuxt/scripts	ultrahtml	^1.7.0	1.7.0	♻️ free via Nuxt 4.6.2
@nuxt/scripts	unplugin	^3.4.0	3.4.0	♻️ free via Nuxt 4.6.2
@nuxt/scripts	unstorage	^1.17.5	1.17.5	📦 70 kB gzip
@nuxt/scripts	valibot	^1.5.0	1.5.0	📦 82 kB gzip

_{Baseline: main_@_321e7574___2026-10-13 · gzip is the comparison metric · changes below 16 B gzip are ignored}

renovate · 2026-10-28T04:11:52Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Error:   × installing dependencies
  ╰─▶ Failed to resolve dependency tree: Failed to resolve dependency: High-
      risk trust downgrade for "seroval@1.7.2" (possible package takeover)

vercel Bot deployed to Preview October 11, 2026 04:28

View deployment

renovate Bot force-pushed the renovate/nuxt branch from 4a5fe82 to 7b82c86 Compare October 17, 2026 20:29

renovate Bot changed the title ~~chore(deps): update nuxt framework to ^4.6.1~~ chore(deps): update nuxt framework to ^4.6.2 Oct 17, 2026

vercel Bot deployed to Preview October 17, 2026 20:31

View deployment

renovate Bot force-pushed the renovate/nuxt branch from 7b82c86 to 73d4c38 Compare October 20, 2026 15:56

vercel Bot deployed to Preview October 20, 2026 15:59

View deployment

renovate Bot force-pushed the renovate/nuxt branch from 73d4c38 to 4546b59 Compare October 22, 2026 16:48

vercel Bot deployed to Preview October 22, 2026 16:53

View deployment

renovate Bot force-pushed the renovate/nuxt branch from 4546b59 to f3e14cb Compare October 26, 2026 20:00

vercel Bot deployed to Preview October 26, 2026 20:02

View deployment

chore(deps): update nuxt framework to ^4.6.3

062787a

renovate Bot force-pushed the renovate/nuxt branch from f3e14cb to 062787a Compare October 28, 2026 04:11

renovate Bot changed the title ~~chore(deps): update nuxt framework to ^4.6.2~~ chore(deps): update nuxt framework to ^4.6.3 Oct 28, 2026

vercel Bot had a problem deploying to Preview October 28, 2026 04:11 Failure

Navigation Menu

Repository navigation

chore(deps): update nuxt framework to ^4.6.3 - #951

chore(deps): update nuxt framework to ^4.6.3#951
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/nuxt

renovate Bot commented Oct 11, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Oct 11, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Oct 11, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 11, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Oct 28, 2026

Uh oh!

This branch had an error being deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Oct 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v4.6.3

👉 Changelog

🚨 Security fixes

🔥 Performance

🩹 Fixes

📖 Documentation

✅ Tests

🤖 CI

🎉 New Contributors

❤️ Contributors

v4.6.2

👉 Changelog

🩹 Fixes

💅 Refactors

📖 Documentation

🏡 Chore

✅ Tests

🤖 CI

🎉 New Contributors

❤️ Contributors

v4.6.1

👉 Changelog

🔥 Performance

🩹 Fixes

💅 Refactors

📖 Documentation

🏡 Chore

✅ Tests

🤖 CI

🎉 New Contributors

❤️ Contributors

Configuration

Uh oh!

vercel Bot commented Oct 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Oct 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📦 Package Size

Uh oh!

renovate Bot commented Oct 28, 2026

⚠️ Artifact update problem

File name: pnpm-lock.yaml

Uh oh!

This branch had an error being deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Oct 11, 2026 •

edited

Loading

`v4.6.3`

`v4.6.2`

`v4.6.1`

vercel Bot commented Oct 11, 2026 •

edited

Loading

pkg-pr-new Bot commented Oct 11, 2026 •

edited

Loading

github-actions Bot commented Oct 11, 2026 •

edited

Loading