Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Upgrade nuxt from 3.0.0 to 3.12.3 #5

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

bmvermeer
Copy link
Owner

snyk-top-banner

Snyk has created this PR to upgrade nuxt from 3.0.0 to 3.12.3.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


  • The recommended version is 48 versions ahead of your current version.

  • The recommended version was released on 25 days ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Code Injection
SNYK-JS-LODASHTEMPLATE-1088054
432 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795
432 Proof of Concept
medium severity Information Exposure
SNYK-JS-EVENTSOURCE-2823375
432 Proof of Concept
medium severity Cross-site Scripting (XSS)
SNYK-JS-SERIALIZEJAVASCRIPT-6147607
432 Proof of Concept
Release notes
Package name: nuxt
  • 3.12.3 - 2024-07-02

    3.12.3 is the next regularly scheduled patch release.

    👉 Changelog

    compare changes

    🔥 Performance

    • nuxt,vite: Use native fs utils rather than fs-extra (#27787)
    • schema: Use chokidar when a custom srcDir is provided (#27871)
    • nuxt: Ensure prefetchComponents is treeshaken on server (#27905)

    🩹 Fixes

    • nuxt: Flag async data promise as cancelled only if defined (#27690)
    • schema: Handle backwards compat for dir.app (0c73cb734)
    • nuxt: Support hoisting types of subpath imports (#27720)
    • nuxt: Resolve routes when navigateTo called with open (#27742)
    • nuxt: Handle subpaths more correctly (d7402a799)
    • nuxt: Delay navigation until user input is acknowledged (#27743)
    • nuxt: Resolve aliases used in nitro plugin paths (#27741)
    • schema: Do not use full path assets/public aliases (d0518650f)
    • nuxt: Defer registering inp handler until nuxt is mounted (866a5319a)
    • nuxt: Add refresh type in server component refs (#27778)
    • nuxt: Extract all-literal page meta (#27821)
    • kit: Handle loading nuxt 4+ (cf251bd48)
    • nuxt: Handle external links to named route objects (#27829)
    • nuxt: Use URL to encode redirected URLs (#27822)
    • nuxt: Don't use app version when verifying nuxt deps (#27864)
    • nuxt: Prompt to set compatibility date with latest nitro (#27893)
    • nuxt: Add #vue-router alias for backwards compat (#27896)
    • nuxt: Move app augments to core nuxt types (#27900)
    • nuxt: Pass augmented pages to child paths (ecb35d3a2)
    • nuxt: Use pascal name when loading server component (#27928)
    • nuxt: Improve async data warning (#27874, #27934)
    • nuxt: Allow configuring server components in modules (#27936)
    • vite: Omit css ?raw from head when in dev mode (#27940)
    • kit,nuxt: Ensure webworker types are available (4cab71d66)
    • nuxt: Seed crawler when prerendering pages (#27955)
    • vite: Fix type issue with legacy dev bundler (f9fa1a3e9)
    • nuxt: Improve dx around compatibility date prompt (#27965)

    💅 Refactors

    • kit,nuxt: Use performance.now to measure time (d14f7ec46)

    📖 Documentation

    • Add referral query variable to Vue School Links (#27670)
    • Fix variable name (#27675)
    • Clarify how transitions are configured globally (#27679)
    • Remove outdated recommendation (#27691)
    • Add refreshCookie on useCookie doc page (#27744)
    • Sync changes from main branch (e7fbc9f81)
    • Remove outdated tip (#27773)
    • Warn about awaiting useFetch/AsyncData in wrappers (#27785)
    • Update some code groups with package manager examples (#27791)
    • Hint to use runtime config (#27859)
    • Use internal link (#27883)
    • Update links to vue-router docs (#27895)
    • Use internal link (#27894)
    • Remove warning about type checking (#27911)
    • compatibilityVersion is available in the latest release (#27919)
    • Update roadmap + readme (748bc751d)
    • Update Nuxt 3 -> Nuxt or Nuxt 3+ (3c16c890c)
    • Update reference to nightly release for testing nuxt 4 (5d2dc9714)
    • Remove duplicate server-side notice in runtime config (#27929)
    • Warn about ref unwrapping when auto-importing refs (#27933)
    • Mention layers in directory guide (c222fe7aa)

    🏡 Chore

    • Use absolute urls for sources to assets in readme (5ef305cec)
    • Use relative links and update in build script (7dd15186e)
    • Use backup file extension (a42a3869b)
    • Allow changelogs with breaking changes (e11587189)
    • Allow major bumps (dea0b86c7)
    • Add 4x tag for v4 nightly releases (9d5dd5494)
    • vite: Restore utils required for dev-bundler (e3448fa0d)
    • Remove nitro/h3 from renovate, and reenable vitejs/vue (9037b0d2c)
    • Improve type safety with indexed access (#27626)
    • Add @ danielroe to code owners (7fa957729)
    • Remove renovate configuration from 2.x branch (8003cf72f)
    • Remove issue template for 2.x (9f9fb9251)
    • Remove unused variable (f07969d88)

    ✅ Tests

    • schema: Normalize snapshot paths for windows (#27654)
    • nuxt: Normalize paths for windows (#27653)
    • Bump timeout for node-compat test (228b8b889)
    • Slightly improve test reliability (#27811)

    🤖 CI

    • Update changelog from 3.x branch updates (2b6967fbb)
    • Add 3x tag instead (c0ef279f2)
    • Run workflows against 3.x branch as well (31255a14d)
    • Use correct SHA calculation for release-pr action (#27604)
    • Resolve bash syntax error (#27789)
    • Only run scorecards against main branch (7abd982f8)
    • Raise renovate prs against 3.x branch too (f176c150a)
    • Ignore @ vitejs/plugin-vue again (56660cbdd)
    • Prevent more than one release from occurring at same time (71705550f)
    • Don't run changelog update on 2.x branch (1be639364)

    ❤️ Contributors

  • 3.12.2 - 2024-06-16

    3.12.2 is the a regularly scheduled patch release.

    ✅ Upgrading

    As usual, our recommendation for upgrading is to run:

    npx nuxi@latest upgrade --force

    This will refresh your lockfile as well, and ensures that you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.

    👉 Changelog

    compare changes

    🔥 Performance

    • kit: Deduplicate layers before resolving config (#27582)
    • webpack: Decrease assets map iterations (d929cd4ef)
    • kit: Various performance improvements (#27600)
    • vite: Various performance improvements (#27601)
    • nuxt: Don't wait for key deps check (#27638)

    🩹 Fixes

    • nuxt: Call onNuxtReady callback without arguments (#27428)
    • schema: Don't narrow head string types to literals (#27540)
    • schema: app/ dir backwards compatibility (#27529)
    • nuxt: Manually assign payload reactivity when ssr: false (#27542)
    • nuxt: Only log warning once per runtimeConfig key (9e56b60c6)
    • nuxt: Overwrite #app/defaults rather than augmenting (#27567)
    • nuxt: Export useRouteAnnouncer (#27562)
    • nuxt: Remove backticks around runtimeConfig warning log (#27549)
    • nuxt: Close top-level watcher on nuxt 'close' (#27571)
    • nuxt: Handle tsx code when extracting pageMeta/routeRules (#27583)
    • nuxt: Handle more edge cases with external/custom links (#27487)
    • nuxt: Preserve route metadata assigned outside page (#27587)
    • nuxt: Use portal to sync nitro/nuxt runtimeConfig + routeRules (#27596)
    • nuxt,schema: Add types for _installedModules (e4bfea642)
    • nuxt: Include build-time pages in prerender routes (#27569)
    • nuxt: Warn when async data doesn't return a value (#27599)
    • nuxt: Replace deprecated app.rootId with app.rootAttrs.id (#27630)
    • nuxt: Add mergeProps import in islands transform (#27622)
    • nuxt: Reset cookie timeoutLength after expiration (#27632)
    • nuxt: Add missing island uid for selective client components (#27633)
    • schema,vite: Respect vite.cacheDir if defined (#27628)
    • nuxt: Unregister hooks the moment close is called (#27637)
    • nuxt: Add missing script stubs (#27640)
    • nuxt: Only inject root path in prerender (44cada95a)
    • nuxt: Reduce usage of cjs utilities (#27642)
    • nuxt: Add / even if pages module isn't enabled (dabcb5ecc)

    📖 Documentation

    • Add warning about bridge migration with head (#27575)
    • Update compatibility example (4b28d2628)
    • Document new clear() function added in 3.11 (#27615)
    • String vs object errors + accessing data of server-thrown errors (#27398)
    • Correct Cloudflare deployment recommendations (#27641)

    🏡 Chore

    • Add extra types for empty array definitions (02945b9fa)
    • Remove stub types file for webpack-virtual-modules (58dd7f3a6)
    • Lint (cb77ddc30)

    ✅ Tests

    • Add type test for nuxt module resolved types (115fc2d18)

    🤖 CI

    ❤️ Contributors

  • 3.12.1 - 2024-06-11

    3.12.1 is a hotfix release to address a typo in the nuxt/script stub auto-imports.

    👉 Changelog

    compare changes

    🩹 Fixes

    • nuxt: Update registry list for @ nuxt/scripts (0252000d7)

    💅 Refactors

    • schema: Use CompatibilityDateSpec (#27521)

    📖 Documentation

    • Update more references to v3.12 (1d2eee00d)
    • Mention 3.12 for testing nuxt 4 (#27525)

    🏡 Chore

    ✅ Tests

    ❤️ Contributors

  • 3.12.0 - 2024-06-11

    👀 Highlights

    We're on the road to the release of Nuxt 4, but we've not held back in Nuxt v3.12. A huge thank you to the 75+ Nuxt contributors and community members who have been part of this release. ❤️

    🚀 Testing Nuxt 4 changes

    Nuxt 4 is on the horizon, and it's now possible to test out the behaviour changes that will be coming in the next major release (#26925) by setting an option in your nuxt.config file:

    export default defineNuxtConfig({
      future: {
        compatibilityVersion: 4,
      },
    })

    As we've been merging PRs for Nuxt 4, we've been enabling them behind this flag. As much as possible we're aiming for backwards compatibility - our test matrix is running the same fixtures in both v3 and v4 compatibility mode.

    There is a lot to say here, with 10+ different PRs and behaviour changes documented and testable, but for full details, including migration steps, see the v4 upgrade documentation.

    We'd be very grateful for early testing of what's coming in Nuxt 4! 🙏

    📜 Nuxt Scripts auto-install

    We've been gradually working to release Nuxt Scripts. It's currently in public preview, but we're near a public release, so we've added some stubs for composables that (when used) will prompt installing the @ nuxt/scripts module.

    👉 Watch out for the launch - and an article explaining more!

    🌈 Layer auto-registration and bugfixes

    Just like ~/modules, any layers within your project in the ~/layers directory will now be automatically registered as layers in your project (#27221).

    We also now correctly load layer dependencies, which should resolve a range of issues with monorepos and git installations (#27338).

    🌐 Built-in accessibility improvements

    We now have a built-in <NuxtRouteAnnouncer> component and corresponding useRouteAnnouncer composable, which will be added by default to new Nuxt templates going forward.

    For full details, see the original PR (#25741) and documentation.

    We're continuing to work on nuxt/a11y - expect to hear more on that in future!

    🔥 Performance improvements

    We've landed some performance improvements as well, many of which are behind the compatibilityVersion: 4 flag, such as a move away from deeply reactive asyncData payloads.

    Significant improvements include deduplicating modules (#27475) - which will apply mostly to layer users who specify modules in their layers. In one project, we saw 30s+ improvement in starting Nuxt.

    We've also improved Vite dev server start up time by excluding common ESM dependencies from pre-bundling, and would suggest module authors consider doing the same (#27372).

    We improved chunk determinism, so sequential builds should be less likely to have completely different chunk hashes (#27258).

    And we tree shake more client-only composables from your server builds (#27044), and have reduced the size of server component payloads (#26863).

    👨‍👩‍👧‍👦 Multi-app support

    We've landed a couple of changes that take us toward a place of supporting multi-app natively in Nuxt, including a multiApp experimental flag (#27291) and the ability to have multiple Nuxt app instances running in parallel at runtime (#27068).

    While it's not yet ready, please do follow along on the tracker issue, and feel free to pitch in if this is interesting to you.

    ⛑️ DX wins

    We now serialise more things in your dev server logs, including VNodes (#27309) and URLs. We also addressed a bug that could lead to a frozen dev server.

    When accessing private runtime config in the browser, we now let you know with a more informative error message (#26441).

    🪨 Stabilising features

    We've removed some experimental options that have been stabilised and which we feel no longer need to be configurable:

    • experimental.treeshakeClientOnly (enabled by default since v3.0.0)
    • experimental.configSchema (enabled by default since v3.3.0)
    • experimental.polyfillVueUseHead (disabled since v3.4.0) - implementable in user-land with plugin
    • experimental.respectNoSSRHeader (disabled since v3.4.0) - implementable in user-land with server middleware

    We've also enabled scanPageMeta by default (#27134). This pulls out any page metadata in your definePageMeta macro, and makes it available to modules (like @ nuxtjs/i18n) so they can augment it.

    This unlocks much better module/typed routing integration, but has a potential performance cost - so please file an issue if you experience any problems.

    💪 Type improvements

    We now have support for typed #fallback slots in server components (#27097).

    We've also improved some defaults in your generated tsconfig.json, including setting module: 'preserve' if you have a locally installed TypeScript v5.4 version (see docs) - see #26667, #27485.

    📦 Module author/power user improvements

    We have shipped a range of type improvements for module authors, including:

    • support for typed module options in installModule (#26744)
    • the option to specify compatibility with certain builders (vite/webpack) in module options (#27022)
    • a new onPrehydrate hook for hooking into the browser hydration cycle (#27037)
    • the ability to access and update resolved runtime configuration within modules, with new build-time useRuntimeConfig and updateRuntimeConfig utils (#27117)

    🎨 Inlined UI templates

    If you previously used @ nuxt/ui-templates then it may be worth knowing that we have moved them from a separate repository into the nuxt/nuxt monorepo. (This is purely a refactor rather than a change, although you can expect some new designs for Nuxt v4.)

    ✅ Upgrading

    As usual, our recommendation for upgrading is to run:

    npx nuxi@latest upgrade --force

    This will refresh your lockfile as well, and ensures that you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.

    👉 Changelog

    compare changes

    🚀 Enhancements

    • nuxt: Support passing options to useRequestURL (#26687)
    • nuxt: Introduce imports.scan option (#26576)
    • nuxt: Add <NuxtRouteAnnouncer> and useRouteAnnouncer (#25741)
    • kit: Handle virtual files in resolvePath and findPath (#26465)
    • nuxt: Expose useLink from NuxtLink (#26522)
    • schema: V4 opt-in with future.compatibilityVersion (#26925)
    • nuxt,schema: Inline error, welcome, spa-loading templates (#27021)
    • nuxt: Configurable app.rootAttrs and teleportAttrs (#27014)
    • schema: Enable cookieStore by default (f597ca59a)
    • nuxt,schema: Support new Nuxt folder structure (#27029)
    • nuxt: Treeshake onUpdated and onUnmounted on server (#27044)
    • nuxt: Prompt to install nuxt/scripts on usage (#27010)
    • nuxt: Expose default slot from <NuxtPage> (#27050)
    • nuxt: Custom renderSSRHeadOptions config for unhead (#26989)
    • nuxt: Add onPrehydrate lifecycle hook (#27037)
    • nuxt: Support multiple nuxtApps at runtime (#27068)
    • nuxt: Add #fallback slot to server components types (#27097)
    • nuxt: Allow specifying builder compatibility in modules (#27022)
    • kit: Add useRuntimeConfig and updateRuntimeConfig utils (#27117)
    • schema: Remove some experimental options for v4 (#27132)
    • nuxt: Auto-register layers in layers/ directory (#27221)
    • nuxt: Allow displaying error state in loading indicator (#27176)
    • nuxt,schema: Add appId and improve chunk determinism (#27258)
    • nuxt: Check schema/kit versions when loading nuxt (#27224)
    • schema: Add experimental multiApp flag (#27291)
    • nuxt: Respect defaults when clearing asyncData (#27295)
    • nuxt: Display banner when run with compatibilityVersion (#27305)
    • nuxt: Add URL serialiser for dev server logs (a549b46e9)
    • nuxt: Handle nuxt route injection for this.$route (#27313)
    • nuxt: Allow configuring interval for checking app update (#27324)
    • nuxt: Warn when accessing private runtimeConfig on client (#26441)
    • kit: Support typed module options in installModule (#26744)
    • kit,schema: Add .with for better module options types (#26850)
    • nuxt: Register plugin hooks before executing plugins (#27449)
    • nuxt,schema: Add compatibilityDate flag for future (#27512)

    🔥 Performance

    • nuxt: Don't add client fallback plugin if not enabled (#26666)
    • nuxt: Unsubscribe from asyncData watch when unmounted (#26821)
    • nuxt: Remove state from nuxt island response (#26863)
    • nuxt: Emit simpler functional ui templates (w/o lodash) (#27091)
    • ui-templates: Don't emit message data for pure strings (9b1bfe69e)
    • nuxt: Remove ssrContext.styles reference (from unused vue-style-loader) (2d1ab61b2)
    • nuxt: Mark payload as shallowReactive (#27214)
    • nuxt: Abort vue render when plugins throw error (#27304)
    • vite: Exclude common ESM deps from pre-bundling (#27372)
    • kit,nuxt: Remove handling for node 14 perf api (#27396)
    • nuxt: Deduplicate modules to install (#27475)
    • webpack: Decrease iteration count and improve type safety (#27488)

    🩹 Fixes

    • nuxt: Prevent getCachedData from shaping type of useAsyncData (#25946)
    • nuxt: Encode location header in navigateTo (#26712)
    • nuxt: Correctly remove extension from path in hasSuffix (#26725)
    • nuxt: Hint prerenderer to crawl routes at runtime (#26694)
    • kit: Ignore negation when resolving ignore patterns (e105fadd7)
    • nuxt: Avoid double-slash in ignore pattern (75e43ac42)
    • kit: Set typescript moduleDetection to 'force' (#26667)
    • nuxt: Re-initialise nuxt._ignore after all modules run (#26680)
    • nuxt: Assign v-for to slot in islands (#26880)
    • nuxt: Don't encode location header (#26893)
    • nuxt: Check if _scope is active before calling run function (#26756, #26904)
    • nuxt: Don't scan component dirs when enabled is false (#26906)
    • vite: Inline styles for vue components with lang="ts" (#26912)
    • nuxt: Handle arrays correctly in updateAppConfig (#26949)
    • nuxt: useState in NuxtClientFallback setup function (#26928)
    • nuxt: Compile plugin templates last (#27009)
    • nuxt: Register redirect middleware before pushing route (#27016)
    • nuxt,schema: Remove .js extension from template imports (0d4a622f3)
    • nuxt: Don't overwrite existing scope in runWithContext (#26976)
    • schema: Use v3 folder structure if app.vue exists in rootDir (1af81ed0f)
    • nuxt: Use resolved path for test component import (8e793ad5c)
    • nuxt: Use URL constructor to resolve external protocols (5f0693a69)
    • nuxt: Use URL for parsing URLs rather than parseURL (ea22d3f98)
    • nuxt: Deprecate process.* flags (#27089)
    • nuxt: Provide default url for URL constructor (8bdd620ba)
    • nuxt: Preload links with same hostname (c065505e1)
    • nuxt: Remove unused prop in NuxtTeleportIslandComponent (#27093)
    • nuxt: Don't pass options to spaLoadingTemplate function (0e12b6eb8)
    • nuxt: Scan folder indices for middleware (#27187)
    • nuxt: Pass path to jiti and not file URL (#27252)
    • schema: Hoist `@ nuxt/devtools types for config auto-completion...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants