Due to the insufficient validation of the path parameter in the NuxtTestComponentWrapper, an attacker can execute arbitrary JavaScript on the server side, which allows them to execute arbitrary commands.
Since import(...) uses query.path instead of the normalized path, a non-normalized URL can reach the import(...) function.
For example, passing something like ./components/test normalizes path to /root/directory/components/test, but import(...) still receives ./components/test.
By using this behavior, it's possible to load arbitrary JavaScript by using the path like the following:
data:text/javascript;base64,Y29uc29sZS5sb2coMSk
Since resolve(...) resolves the filesystem path, not the URI, the above URI is treated as a relative path, but import(...) sees it as an absolute URI, and loads it as a JavaScript.
PoC
Create a nuxt project and run it in the test mode:
npx nuxi@latest init test
cd test
TEST=true npm run dev
Users who open a malicious web page in the browser while running the test locally are affected by this vulnerability, which results in the remote code execution from the malicious web page.
Since web pages can send requests to arbitrary addresses, a malicious web page can repeatedly try to exploit this vulnerability, which then triggers the exploit when the test server starts.
The navigateTo function attempts to blockthe javascript: protocol, but does not correctly use API's provided by unjs/ufo. This library also contains parsing discrepancies.
Details
The function first tests to see if the specified URL has a protocol. This uses the unjs/ufo package for URL parsing. This function works effectively, and returns true for a javascript: protocol.
After this, the URL is parsed using the parseURL function. This function will refuse to parse poorly formatted URLs. Parsing javascript:alert(1) returns null/"" for all values.
Next, the protocol of the URL is then checked using the isScriptProtocol function. This function simply checks the input against a list of protocols, and does not perform any parsing.
The combination of refusing to parse poorly formatted URLs, and not performing additional parsing means that script checks fail as no protocol can be found. Even if a protocol was identified, whitespace is not stripped in the parseURL implementation, bypassing the isScriptProtocol checks.
Certain special protocols are identified at the top of parseURL. Inserting a newline or tab into this sequence will block the special protocol check, and bypass the latter checks.
XSS, access to cookies, make requests on user's behalf.
Recommendations
As always with these bugs, the URL constructor provided by the browser is always the safest method of parsing a URL.
Given the cross-platform requirements of nuxt/ufo a more appropriate solution is to make parsing consistent between functions, and to adapt parsing to be more consistent with the WHATWG URL specification.
Note
I've reported this vulnerability here as it is unclear if this is a bug in ufo or a misuse of the ufo library.
This ONLY has impact after SSR has occured, the javascript: protocol within a location header does not trigger XSS.
Release Notes
nuxt/nuxt (nuxt)
### [`v3.12.4`](https://togithub.com/nuxt/nuxt/releases/tag/v3.12.4)
[Compare Source](https://togithub.com/nuxt/nuxt/compare/v3.12.3...v3.12.4)
> 3.12.4 is the next regularly scheduled patch release.
#### ๐ Changelog
[compare changes](https://togithub.com/nuxt/nuxt/compare/v3.12.3...v3.12.4)
##### ๐ฅ Performance
- **vite:** Start warmups after nitro build ([#27963](https://togithub.com/nuxt/nuxt/pull/27963))
- **vite:** Avoid extra resolve call for `resolveId` in layers ([#27971](https://togithub.com/nuxt/nuxt/pull/27971))
- **kit,nuxt,schema,vite,webpack:** Use explicit exports ([#27998](https://togithub.com/nuxt/nuxt/pull/27998))
##### ๐ฉน Fixes
- **schema:** Resolve public alias correctly ([#27975](https://togithub.com/nuxt/nuxt/pull/27975))
- **nuxt:** Omit rendering payload prefetch when `noScripts` ([#27972](https://togithub.com/nuxt/nuxt/pull/27972))
- **nuxt:** Add `/` as fallback if page can't be identified ([e6109b226](https://togithub.com/nuxt/nuxt/commit/e6109b226))
- **ui-templates:** Validate templates with `html-validate` ([#28024](https://togithub.com/nuxt/nuxt/pull/28024))
- **schema:** Don't constrain postcss plugin options ([#28045](https://togithub.com/nuxt/nuxt/pull/28045))
- **kit:** Remove exports from v4 branch ([5c8312e9b](https://togithub.com/nuxt/nuxt/commit/5c8312e9b))
- **nuxt:** Use `unhead` key for ad-hoc module options ([#28088](https://togithub.com/nuxt/nuxt/pull/28088))
- **nuxt:** Use native vue-router composables ([#28114](https://togithub.com/nuxt/nuxt/pull/28114))
- **kit:** Ensure `getNuxtVersion` returns `string` ([#28125](https://togithub.com/nuxt/nuxt/pull/28125))
- **nuxt:** Always prerender at least one page with crawler ([#28131](https://togithub.com/nuxt/nuxt/pull/28131))
- **nuxt:** Consider doc `scroll-padding-top` in scrollBehavior ([#28083](https://togithub.com/nuxt/nuxt/pull/28083))
- **nuxt:** Only warn when `useAsyncData` returns undefined ([#28154](https://togithub.com/nuxt/nuxt/pull/28154))
- **nuxt:** Revert change to `getCachedData` null response ([d10cea11b](https://togithub.com/nuxt/nuxt/commit/d10cea11b))
- **schema:** Don't use `app/` as `srcDir` if it doesn't exist ([#28176](https://togithub.com/nuxt/nuxt/pull/28176))
- **kit:** Normalise `serverDir` within layers using v4 compat ([#28177](https://togithub.com/nuxt/nuxt/pull/28177))
- **nuxt:** Allow `getCachedData` to return undefined ([#28187](https://togithub.com/nuxt/nuxt/pull/28187))
- **nuxt:** Use `addEventListener` to register cookie store listener ([#28193](https://togithub.com/nuxt/nuxt/pull/28193))
- **nuxt:** Merge route meta properties with scanned meta ([#28170](https://togithub.com/nuxt/nuxt/pull/28170))
- **nuxt:** Prevent duplicate `set-cookie` headers ([#28211](https://togithub.com/nuxt/nuxt/pull/28211))
##### ๐ Refactors
- **schema,vite,webpack:** Rework `postcss` module loading ([#27946](https://togithub.com/nuxt/nuxt/pull/27946))
- **nuxt:** Remove `_registeredComponents` from ssrContext ([#27819](https://togithub.com/nuxt/nuxt/pull/27819))
- **nuxt:** Use `errx` to handle dev log traces ([#28027](https://togithub.com/nuxt/nuxt/pull/28027))
##### ๐ Documentation
- Fix link ([83bd4fde9](https://togithub.com/nuxt/nuxt/commit/83bd4fde9))
- Fix Cloudflare spelling ([#27989](https://togithub.com/nuxt/nuxt/pull/27989))
- Update example to use `nuxtApp.runWithContext` ([#28000](https://togithub.com/nuxt/nuxt/pull/28000))
- Remove deprecated `pending` variable from data fetching docs ([#28011](https://togithub.com/nuxt/nuxt/pull/28011))
- Clarify xrsp danger ([#28053](https://togithub.com/nuxt/nuxt/pull/28053))
- Deprecate pending and emphasis undefined ([#28113](https://togithub.com/nuxt/nuxt/pull/28113))
- Update phrasing in route announcer ([#28108](https://togithub.com/nuxt/nuxt/pull/28108))
- Use code groups for install commands in module guide ([#28094](https://togithub.com/nuxt/nuxt/pull/28094))
- Capitalize text ([#28056](https://togithub.com/nuxt/nuxt/pull/28056))
- Mention content in upgrade guide v4 folder structure ([#28090](https://togithub.com/nuxt/nuxt/pull/28090))
- Remove a resolved issue from view transition docs ([#28091](https://togithub.com/nuxt/nuxt/pull/28091))
- Clarify navigateTo is not for nitro routes ([#28092](https://togithub.com/nuxt/nuxt/pull/28092))
- Warn about nested islands ([#28062](https://togithub.com/nuxt/nuxt/pull/28062))
- Add info about `layers/` directory ([#28128](https://togithub.com/nuxt/nuxt/pull/28128))
- Codemods for migrating to Nuxt 4 ([#28072](https://togithub.com/nuxt/nuxt/pull/28072))
##### โ Tests
- Add `typeCheck` test in minimal build ([#28166](https://togithub.com/nuxt/nuxt/pull/28166))
##### ๐ค CI
- Run prepare step before linting docs ([f8fbefb42](https://togithub.com/nuxt/nuxt/commit/f8fbefb42))
- Run prepare step before linting docs ([d629b82b3](https://togithub.com/nuxt/nuxt/commit/d629b82b3))
##### โค๏ธ Contributors
- Daniel Roe ([@danielroe](https://togithub.com/danielroe))
- arshcodemod ([@arshcodemod](https://togithub.com/arshcodemod))
- xjccc ([@xjccc](https://togithub.com/xjccc))
- Julien Huang ([@huang-julien](https://togithub.com/huang-julien))
- BoogieBen ([@boogie-ben](https://togithub.com/boogie-ben))
- Santiago A ([@santiagoaloi](https://togithub.com/santiagoaloi))
- Bobbie Goede ([@BobbieGoede](https://togithub.com/BobbieGoede))
- John Tanzer ([@moshetanzer](https://togithub.com/moshetanzer))
- Thomas ([@ThomasWT](https://togithub.com/ThomasWT))
- [@beer](https://togithub.com/beer) ([@iiio2](https://togithub.com/iiio2))
- Dominic ([@rexhent](https://togithub.com/rexhent))
- Alex Liu ([@Mini-ghost](https://togithub.com/Mini-ghost))
- Florian Metz ([@Timeraa](https://togithub.com/Timeraa))
- Liran Tal ([@lirantal](https://togithub.com/lirantal))
- Daniel Kelly ([@danielkellyio](https://togithub.com/danielkellyio))
- Daniel Flanagan ([@FlantasticDan](https://togithub.com/FlantasticDan))
- ๅฑฑๅน่ฒๅพกๅฎ ([@KazariEX](https://togithub.com/KazariEX))
- izzy goldman ([@izzygld](https://togithub.com/izzygld))
- Anthony Fu ([@antfu](https://togithub.com/antfu))
### [`v3.12.3`](https://togithub.com/nuxt/nuxt/releases/tag/v3.12.3)
[Compare Source](https://togithub.com/nuxt/nuxt/compare/v3.12.2...v3.12.3)
> 3.12.3 is the next regularly scheduled patch release.
#### ๐ Changelog
[compare changes](https://togithub.com/nuxt/nuxt/compare/v3.12.2...v3.12.3)
##### ๐ฅ Performance
- **nuxt,vite:** Use native fs utils rather than `fs-extra` ([#27787](https://togithub.com/nuxt/nuxt/pull/27787))
- **schema:** Use `chokidar` when a custom `srcDir` is provided ([#27871](https://togithub.com/nuxt/nuxt/pull/27871))
- **nuxt:** Ensure `prefetchComponents` is treeshaken on server ([#27905](https://togithub.com/nuxt/nuxt/pull/27905))
##### ๐ฉน Fixes
- **nuxt:** Flag async data promise as cancelled only if defined ([#27690](https://togithub.com/nuxt/nuxt/pull/27690))
- **schema:** Handle backwards compat for `dir.app` ([0c73cb734](https://togithub.com/nuxt/nuxt/commit/0c73cb734))
- **nuxt:** Support hoisting types of subpath imports ([#27720](https://togithub.com/nuxt/nuxt/pull/27720))
- **nuxt:** Resolve routes when `navigateTo` called with `open` ([#27742](https://togithub.com/nuxt/nuxt/pull/27742))
- **nuxt:** Handle subpaths more correctly ([d7402a799](https://togithub.com/nuxt/nuxt/commit/d7402a799))
- **nuxt:** Delay navigation until user input is acknowledged ([#27743](https://togithub.com/nuxt/nuxt/pull/27743))
- **nuxt:** Resolve aliases used in nitro plugin paths ([#27741](https://togithub.com/nuxt/nuxt/pull/27741))
- **schema:** Do not use full path assets/public aliases ([d0518650f](https://togithub.com/nuxt/nuxt/commit/d0518650f))
- **nuxt:** Defer registering inp handler until nuxt is mounted ([866a5319a](https://togithub.com/nuxt/nuxt/commit/866a5319a))
- **nuxt:** Add `refresh` type in server component refs ([#27778](https://togithub.com/nuxt/nuxt/pull/27778))
- **nuxt:** Extract all-literal page meta ([#27821](https://togithub.com/nuxt/nuxt/pull/27821))
- **kit:** Handle loading nuxt 4+ ([cf251bd48](https://togithub.com/nuxt/nuxt/commit/cf251bd48))
- **nuxt:** Handle external links to named route objects ([#27829](https://togithub.com/nuxt/nuxt/pull/27829))
- **nuxt:** Use URL to encode redirected URLs ([#27822](https://togithub.com/nuxt/nuxt/pull/27822))
- **nuxt:** Don't use app version when verifying nuxt deps ([#27864](https://togithub.com/nuxt/nuxt/pull/27864))
- **nuxt:** Prompt to set compatibility date with latest nitro ([#27893](https://togithub.com/nuxt/nuxt/pull/27893))
- **nuxt:** Add `#vue-router` alias for backwards compat ([#27896](https://togithub.com/nuxt/nuxt/pull/27896))
- **nuxt:** Move app augments to core `nuxt` types ([#27900](https://togithub.com/nuxt/nuxt/pull/27900))
- **nuxt:** Pass augmented pages to child paths ([ecb35d3a2](https://togithub.com/nuxt/nuxt/commit/ecb35d3a2))
- **nuxt:** Use pascal name when loading server component ([#27928](https://togithub.com/nuxt/nuxt/pull/27928))
- **nuxt:** Improve async data warning ([#27874](https://togithub.com/nuxt/nuxt/pull/27874), [#27934](https://togithub.com/nuxt/nuxt/pull/27934))
- **nuxt:** Allow configuring server components in modules ([#27936](https://togithub.com/nuxt/nuxt/pull/27936))
- **vite:** Omit css `?raw` from head when in dev mode ([#27940](https://togithub.com/nuxt/nuxt/pull/27940))
- **kit,nuxt:** Ensure webworker types are available ([4cab71d66](https://togithub.com/nuxt/nuxt/commit/4cab71d66))
- **nuxt:** Seed crawler when prerendering pages ([#27955](https://togithub.com/nuxt/nuxt/pull/27955))
- **vite:** Fix type issue with legacy dev bundler ([f9fa1a3e9](https://togithub.com/nuxt/nuxt/commit/f9fa1a3e9))
- **nuxt:** Improve dx around compatibility date prompt ([#27965](https://togithub.com/nuxt/nuxt/pull/27965))
##### ๐ Refactors
- **kit,nuxt:** Use `performance.now` to measure time ([d14f7ec46](https://togithub.com/nuxt/nuxt/commit/d14f7ec46))
##### ๐ Documentation
- Add referral query variable to Vue School Links ([#27670](https://togithub.com/nuxt/nuxt/pull/27670))
- Fix variable name ([#27675](https://togithub.com/nuxt/nuxt/pull/27675))
- Clarify how transitions are configured globally ([#27679](https://togithub.com/nuxt/nuxt/pull/27679))
- Remove outdated recommendation ([#27691](https://togithub.com/nuxt/nuxt/pull/27691))
- Add `refreshCookie` on `useCookie` doc page ([#27744](https://togithub.com/nuxt/nuxt/pull/27744))
- Sync changes from `main` branch ([e7fbc9f81](https://togithub.com/nuxt/nuxt/commit/e7fbc9f81))
- Remove outdated tip ([#27773](https://togithub.com/nuxt/nuxt/pull/27773))
- Warn about awaiting `useFetch`/`AsyncData` in wrappers ([#27785](https://togithub.com/nuxt/nuxt/pull/27785))
- Update some code groups with package manager examples ([#27791](https://togithub.com/nuxt/nuxt/pull/27791))
- Hint to use runtime config ([#27859](https://togithub.com/nuxt/nuxt/pull/27859))
- Use internal link ([#27883](https://togithub.com/nuxt/nuxt/pull/27883))
- Update links to `vue-router` docs ([#27895](https://togithub.com/nuxt/nuxt/pull/27895))
- Use internal link ([#27894](https://togithub.com/nuxt/nuxt/pull/27894))
- Remove warning about type checking ([#27911](https://togithub.com/nuxt/nuxt/pull/27911))
- `compatibilityVersion` is available in the latest release ([#27919](https://togithub.com/nuxt/nuxt/pull/27919))
- Update roadmap + readme ([748bc751d](https://togithub.com/nuxt/nuxt/commit/748bc751d))
- Update `Nuxt 3` -> `Nuxt` or `Nuxt 3+` ([3c16c890c](https://togithub.com/nuxt/nuxt/commit/3c16c890c))
- Update reference to nightly release for testing nuxt 4 ([5d2dc9714](https://togithub.com/nuxt/nuxt/commit/5d2dc9714))
- Remove duplicate server-side notice in runtime config ([#27929](https://togithub.com/nuxt/nuxt/pull/27929))
- Warn about ref unwrapping when auto-importing `ref`s ([#27933](https://togithub.com/nuxt/nuxt/pull/27933))
- Mention layers in directory guide ([c222fe7aa](https://togithub.com/nuxt/nuxt/commit/c222fe7aa))
##### ๐ก Chore
- Use absolute urls for sources to assets in readme ([5ef305cec](https://togithub.com/nuxt/nuxt/commit/5ef305cec))
- Use relative links and update in build script ([7dd15186e](https://togithub.com/nuxt/nuxt/commit/7dd15186e))
- Use backup file extension ([a42a3869b](https://togithub.com/nuxt/nuxt/commit/a42a3869b))
- Allow changelogs with breaking changes ([e11587189](https://togithub.com/nuxt/nuxt/commit/e11587189))
- Allow major bumps ([dea0b86c7](https://togithub.com/nuxt/nuxt/commit/dea0b86c7))
- Add `4x` tag for v4 nightly releases ([9d5dd5494](https://togithub.com/nuxt/nuxt/commit/9d5dd5494))
- **vite:** Restore utils required for `dev-bundler` ([e3448fa0d](https://togithub.com/nuxt/nuxt/commit/e3448fa0d))
- Remove nitro/h3 from renovate, and reenable vitejs/vue ([9037b0d2c](https://togithub.com/nuxt/nuxt/commit/9037b0d2c))
- Improve type safety with indexed access ([#27626](https://togithub.com/nuxt/nuxt/pull/27626))
- Add [@danielroe](https://togithub.com/danielroe) to code owners ([7fa957729](https://togithub.com/nuxt/nuxt/commit/7fa957729))
- Remove renovate configuration from `2.x` branch ([8003cf72f](https://togithub.com/nuxt/nuxt/commit/8003cf72f))
- Remove issue template for 2.x ([9f9fb9251](https://togithub.com/nuxt/nuxt/commit/9f9fb9251))
- Remove unused variable ([f07969d88](https://togithub.com/nuxt/nuxt/commit/f07969d88))
##### โ Tests
- **schema:** Normalize snapshot paths for windows ([#27654](https://togithub.com/nuxt/nuxt/pull/27654))
- **nuxt:** Normalize paths for windows ([#27653](https://togithub.com/nuxt/nuxt/pull/27653))
- Bump timeout for node-compat test ([228b8b889](https://togithub.com/nuxt/nuxt/commit/228b8b889))
- Slightly improve test reliability ([#27811](https://togithub.com/nuxt/nuxt/pull/27811))
##### ๐ค CI
- Update changelog from 3.x branch updates ([2b6967fbb](https://togithub.com/nuxt/nuxt/commit/2b6967fbb))
- Add 3x tag instead ([c0ef279f2](https://togithub.com/nuxt/nuxt/commit/c0ef279f2))
- Run workflows against 3.x branch as well ([31255a14d](https://togithub.com/nuxt/nuxt/commit/31255a14d))
- Use correct SHA calculation for release-pr action ([#27604](https://togithub.com/nuxt/nuxt/pull/27604))
- Resolve bash syntax error ([#27789](https://togithub.com/nuxt/nuxt/pull/27789))
- Only run scorecards against `main` branch ([7abd982f8](https://togithub.com/nuxt/nuxt/commit/7abd982f8))
- Raise renovate prs against 3.x branch too ([f176c150a](https://togithub.com/nuxt/nuxt/commit/f176c150a))
- Ignore `@vitejs/plugin-vue` again ([56660cbdd](https://togithub.com/nuxt/nuxt/commit/56660cbdd))
- Prevent more than one release from occurring at same time ([71705550f](https://togithub.com/nuxt/nuxt/commit/71705550f))
- Don't run changelog update on 2.x branch ([1be639364](https://togithub.com/nuxt/nuxt/commit/1be639364))
##### โค๏ธ Contributors
- Daniel Roe ([@danielroe](https://togithub.com/danielroe))
- Typed SIGTERM ([@typed-sigterm](https://togithub.com/typed-sigterm))
- Seno ([@s-en-o](https://togithub.com/s-en-o))
- Julien Huang ([@huang-julien](https://togithub.com/huang-julien))
- Michael Brevard ([@GalacticHypernova](https://togithub.com/GalacticHypernova))
- Ryota Watanabe ([@wattanx](https://togithub.com/wattanx))
- Martin Masevski ([@Archetipo95](https://togithub.com/Archetipo95))
- Alex Liu ([@Mini-ghost](https://togithub.com/Mini-ghost))
- Bochkarev Ivan ([@Ibochkarev](https://togithub.com/Ibochkarev))
- Alexander Lichter ([@manniL](https://togithub.com/manniL))
- Dominic ([@rexhent](https://togithub.com/rexhent))
- Aviv Keller ([@RedYetiDev](https://togithub.com/RedYetiDev))
- Maxime Pauvert ([@maximepvrt](https://togithub.com/maximepvrt))
- Daniel Kelly ([@danielkellyio](https://togithub.com/danielkellyio))
- Damian Gลowala ([@DamianGlowala](https://togithub.com/DamianGlowala))
- Idorenyin Udoh ([@idorenyinudoh](https://togithub.com/idorenyinudoh))
### [`v3.12.2`](https://togithub.com/nuxt/nuxt/releases/tag/v3.12.2)
[Compare Source](https://togithub.com/nuxt/nuxt/compare/v3.12.1...v3.12.2)
> 3.12.2 is the a regularly scheduled patch release.
#### โ Upgrading
As usual, our recommendation for upgrading is to run:
```sh
npx nuxi@latest upgrade --force
```
This will refresh your lockfile as well, and ensures that you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.
#### ๐ Changelog
[compare changes](https://togithub.com/nuxt/nuxt/compare/v3.12.1...v3.12.2)
##### ๐ฅ Performance
- **kit:** Deduplicate layers before resolving config ([#27582](https://togithub.com/nuxt/nuxt/pull/27582))
- **webpack:** Decrease assets map iterations ([d929cd4ef](https://togithub.com/nuxt/nuxt/commit/d929cd4ef))
- **kit:** Various performance improvements ([#27600](https://togithub.com/nuxt/nuxt/pull/27600))
- **vite:** Various performance improvements ([#27601](https://togithub.com/nuxt/nuxt/pull/27601))
- **nuxt:** Don't wait for key deps check ([#27638](https://togithub.com/nuxt/nuxt/pull/27638))
##### ๐ฉน Fixes
- **nuxt:** Call `onNuxtReady` callback without arguments ([#27428](https://togithub.com/nuxt/nuxt/pull/27428))
- **schema:** Don't narrow head string types to literals ([#27540](https://togithub.com/nuxt/nuxt/pull/27540))
- **schema:** `app/` dir backwards compatibility ([#27529](https://togithub.com/nuxt/nuxt/pull/27529))
- **nuxt:** Manually assign payload reactivity when `ssr: false` ([#27542](https://togithub.com/nuxt/nuxt/pull/27542))
- **nuxt:** Only log warning once per `runtimeConfig` key ([9e56b60c6](https://togithub.com/nuxt/nuxt/commit/9e56b60c6))
- **nuxt:** Overwrite `#app/defaults` rather than augmenting ([#27567](https://togithub.com/nuxt/nuxt/pull/27567))
- **nuxt:** Export `useRouteAnnouncer` ([#27562](https://togithub.com/nuxt/nuxt/pull/27562))
- **nuxt:** Remove backticks around runtimeConfig warning log ([#27549](https://togithub.com/nuxt/nuxt/pull/27549))
- **nuxt:** Close top-level watcher on nuxt 'close' ([#27571](https://togithub.com/nuxt/nuxt/pull/27571))
- **nuxt:** Handle tsx code when extracting pageMeta/routeRules ([#27583](https://togithub.com/nuxt/nuxt/pull/27583))
- **nuxt:** Handle more edge cases with external/custom links ([#27487](https://togithub.com/nuxt/nuxt/pull/27487))
- **nuxt:** Preserve route metadata assigned outside page ([#27587](https://togithub.com/nuxt/nuxt/pull/27587))
- **nuxt:** Use portal to sync nitro/nuxt runtimeConfig + routeRules ([#27596](https://togithub.com/nuxt/nuxt/pull/27596))
- **nuxt,schema:** Add types for `_installedModules` ([e4bfea642](https://togithub.com/nuxt/nuxt/commit/e4bfea642))
- **nuxt:** Include build-time pages in prerender routes ([#27569](https://togithub.com/nuxt/nuxt/pull/27569))
- **nuxt:** Warn when async data doesn't return a value ([#27599](https://togithub.com/nuxt/nuxt/pull/27599))
- **nuxt:** Replace deprecated `app.rootId` with `app.rootAttrs.id` ([#27630](https://togithub.com/nuxt/nuxt/pull/27630))
- **nuxt:** Add `mergeProps` import in islands transform ([#27622](https://togithub.com/nuxt/nuxt/pull/27622))
- **nuxt:** Reset cookie timeoutLength after expiration ([#27632](https://togithub.com/nuxt/nuxt/pull/27632))
- **nuxt:** Add missing island uid for selective client components ([#27633](https://togithub.com/nuxt/nuxt/pull/27633))
- **schema,vite:** Respect `vite.cacheDir` if defined ([#27628](https://togithub.com/nuxt/nuxt/pull/27628))
- **nuxt:** Unregister hooks the moment `close` is called ([#27637](https://togithub.com/nuxt/nuxt/pull/27637))
- **nuxt:** Add missing script stubs ([#27640](https://togithub.com/nuxt/nuxt/pull/27640))
- **nuxt:** Only inject root path in prerender ([44cada95a](https://togithub.com/nuxt/nuxt/commit/44cada95a))
- **nuxt:** Reduce usage of cjs utilities ([#27642](https://togithub.com/nuxt/nuxt/pull/27642))
- **nuxt:** Add `/` even if pages module isn't enabled ([dabcb5ecc](https://togithub.com/nuxt/nuxt/commit/dabcb5ecc))
##### ๐ Documentation
- Add warning about bridge migration with `head` ([#27575](https://togithub.com/nuxt/nuxt/pull/27575))
- Update compatibility example ([4b28d2628](https://togithub.com/nuxt/nuxt/commit/4b28d2628))
- Document new `clear()` function added in 3.11 ([#27615](https://togithub.com/nuxt/nuxt/pull/27615))
- String vs object errors + accessing data of server-thrown errors ([#27398](https://togithub.com/nuxt/nuxt/pull/27398))
- Correct Cloudflare deployment recommendations ([#27641](https://togithub.com/nuxt/nuxt/pull/27641))
##### ๐ก Chore
- Add extra types for empty array definitions ([02945b9fa](https://togithub.com/nuxt/nuxt/commit/02945b9fa))
- Remove stub types file for `webpack-virtual-modules` ([58dd7f3a6](https://togithub.com/nuxt/nuxt/commit/58dd7f3a6))
- Lint ([cb77ddc30](https://togithub.com/nuxt/nuxt/commit/cb77ddc30))
##### โ Tests
- Add type test for nuxt module resolved types ([115fc2d18](https://togithub.com/nuxt/nuxt/commit/115fc2d18))
##### ๐ค CI
- Improve generated changelog ([d20266961](https://togithub.com/nuxt/nuxt/commit/d20266961))
##### โค๏ธ Contributors
- Daniel Roe ([@danielroe](https://togithub.com/danielroe))
- Julien Huang ([@huang-julien](https://togithub.com/huang-julien))
- Alexandru Ungureanu ([@unguul](https://togithub.com/unguul))
- Josh Dean ([@jdbdnz](https://togithub.com/jdbdnz))
- Yusuf Mansur รzer ([@ymansurozer](https://togithub.com/ymansurozer))
- Matteo Rigoni ([@Rigo-m](https://togithub.com/Rigo-m))
- Leo Osa ([@leoosa](https://togithub.com/leoosa))
- Levi (Nguyแป n Lฦฐฦกng Huy) ([@huynl-96](https://togithub.com/huynl-96))
- David Nahodyl ([@Smef](https://togithub.com/Smef))
- Michael Brevard ([@GalacticHypernova](https://togithub.com/GalacticHypernova))
- garthreckers ([@garthreckers](https://togithub.com/garthreckers))
- Valerii Strilets ([@letstri](https://togithub.com/letstri))
- Okuto Oyama ([@yamanoku](https://togithub.com/yamanoku))
- Harlan Wilton ([@harlan-zw](https://togithub.com/harlan-zw))
### [`v3.12.1`](https://togithub.com/nuxt/nuxt/releases/tag/v3.12.1)
[Compare Source](https://togithub.com/nuxt/nuxt/compare/v3.12.0...v3.12.1)
> 3.12.1 is a hotfix release to address a typo in the nuxt/script stub auto-imports.
#### ๐ Changelog
[compare changes](https://togithub.com/nuxt/nuxt/compare/v3.12.0...v3.12.1)
##### ๐ฉน Fixes
- **nuxt:** Update registry list for `@nuxt/scripts` ([0252000d7](https://togithub.com/nuxt/nuxt/commit/0252000d7))
##### ๐ Refactors
- **schema:** Use `CompatibilityDateSpec` ([#27521](https://togithub.com/nuxt/nuxt/pull/27521))
##### ๐ Documentation
- Update more references to v3.12 ([1d2eee00d](https://togithub.com/nuxt/nuxt/commit/1d2eee00d))
- Mention 3.12 for testing nuxt 4 ([#27525](https://togithub.com/nuxt/nuxt/pull/27525))
##### ๐ก Chore
- Fix release script ([7777f0564](https://togithub.com/nuxt/nuxt/commit/7777f0564))
- Lint ([24b8533e7](https://togithub.com/nuxt/nuxt/commit/24b8533e7))
- Bump `nuxi` dependency ([#27526](https://togithub.com/nuxt/nuxt/pull/27526))
##### โ Tests
- Update scrolling test ([52b85a886](https://togithub.com/nuxt/nuxt/commit/52b85a886))
##### โค๏ธ Contributors
- Daniel Roe ([@danielroe](https://togithub.com/danielroe))
- Pooya Parsa ([@pi0](https://togithub.com/pi0))
- Alexander Lichter ([@manniL](https://togithub.com/manniL))
### [`v3.12.0`](https://togithub.com/nuxt/nuxt/releases/tag/v3.12.0)
[Compare Source](https://togithub.com/nuxt/nuxt/compare/v3.11.2...v3.12.0)
#### ๐ Highlights
We're on the road to the release of Nuxt 4, but we've not held back in Nuxt v3.12. A huge thank you to the 75+ Nuxt contributors and community members who have been part of this release. โค๏ธ
##### ๐ Testing Nuxt 4 changes
Nuxt 4 is on the horizon, and it's now possible to test out the behaviour changes that will be coming in the next major release ([#26925](https://togithub.com/nuxt/nuxt/pull/26925)) by setting an option in your `nuxt.config` file:
```ts
export default defineNuxtConfig({
future: {
compatibilityVersion: 4,
},
})
```
As we've been merging PRs for Nuxt 4, we've been enabling them behind this flag. As much as possible we're aiming for backwards compatibility - our test matrix is running the same fixtures in both v3 and v4 compatibility mode.
There is a lot to say here, with 10+ different PRs and behaviour changes documented and testable, but for full details, including migration steps, see [the v4 upgrade documentation](https://nuxt.com/docs/getting-started/upgrade#testing-nuxt-4).
We'd be very grateful for early testing of what's coming in Nuxt 4! ๐
##### ๐ Nuxt Scripts auto-install
We've been gradually working to release [Nuxt Scripts](https://scripts.nuxt.com/). It's currently in public preview, but we're near a public release, so we've added some stubs for composables that (when used) will prompt installing the `@nuxt/scripts` module.
๐ Watch out for the launch - and an article explaining more!
##### ๐ Layer auto-registration and bugfixes
Just like `~/modules`, any layers within your project in the `~/layers` directory will now be automatically registered as layers in your project ([#27221](https://togithub.com/nuxt/nuxt/pull/27221)).
We also now correctly load layer dependencies, which should resolve a range of issues with monorepos and git installations ([#27338](https://togithub.com/nuxt/nuxt/pull/27338)).
##### ๐ Built-in accessibility improvements
We now have a built-in [``](https://nuxt.com/docs/api/components/nuxt-route-announcer) component and corresponding [`useRouteAnnouncer`](https://nuxt.com/docs/api/composables/use-route-announcer) composable, which will be added by default to new Nuxt templates going forward.
For full details, see [the original PR (#25741)](https://togithub.com/nuxt/nuxt/pull/25741) and [documentation](https://nuxt.com/docs/api/components/nuxt-route-announcer).
We're continuing to work on `nuxt/a11y` - expect to hear more on that in future!
##### ๐ฅ Performance improvements
We've landed some performance improvements as well, many of which are behind the `compatibilityVersion: 4` flag, such as a move away from deeply reactive asyncData payloads.
Significant improvements include deduplicating modules ([#27475](https://togithub.com/nuxt/nuxt/pull/27475)) - which will apply mostly to layer users who specify modules in their layers. In one project, we saw 30s+ improvement in starting Nuxt.
We've also improved Vite dev server start up time by excluding common ESM dependencies from pre-bundling, and would suggest module authors consider doing the same ([#27372](https://togithub.com/nuxt/nuxt/pull/27372)).
We improved chunk determinism, so sequential builds should be less likely to have *completely* different chunk hashes ([#27258](https://togithub.com/nuxt/nuxt/pull/27258)).
And we tree shake more client-only composables from your server builds ([#27044](https://togithub.com/nuxt/nuxt/pull/27044)), and have reduced the size of server component payloads ([#26863](https://togithub.com/nuxt/nuxt/pull/26863)).
##### ๐จโ๐ฉโ๐งโ๐ฆ Multi-app support
We've landed a couple of changes that take us toward a place of supporting multi-app natively in Nuxt, including a `multiApp` experimental flag ([#27291](https://togithub.com/nuxt/nuxt/pull/27291)) and the ability to have multiple Nuxt app instances running in parallel at runtime ([#27068](https://togithub.com/nuxt/nuxt/pull/27068)).
While it's not yet ready, please do follow along on [the tracker issue](https://togithub.com/nuxt/nuxt/issues/21635), and feel free to pitch in if this is interesting to you.
##### โ๏ธ DX wins
We now serialise more things in your dev server logs, including VNodes ([#27309](https://togithub.com/nuxt/nuxt/pull/27309)) and [URLs](https://togithub.com/nuxt/nuxt/commit/a549b46e9). We also addressed a bug that could lead to a frozen dev server.
When accessing private runtime config in the browser, we now let you know with a more informative error message ([#26441](https://togithub.com/nuxt/nuxt/pull/26441)).
##### ๐ชจ Stabilising features
We've removed some experimental options that have been stabilised and which we feel no longer need to be configurable:
- `experimental.treeshakeClientOnly` (enabled by default since v3.0.0)
- `experimental.configSchema` (enabled by default since v3.3.0)
- `experimental.polyfillVueUseHead` (disabled since v3.4.0) - implementable in user-land with [plugin](https://togithub.com/nuxt/nuxt/blob/f209158352b09d1986aa320e29ff36353b91c358/packages/nuxt/src/head/runtime/plugins/vueuse-head-polyfill.ts#L10-L11)
- `experimental.respectNoSSRHeader` (disabled since v3.4.0) - implementable in user-land with [server middleware](https://togithub.com/nuxt/nuxt/blob/c660b39447f0d5b8790c0826092638d321cd6821/packages/nuxt/src/core/runtime/nitro/no-ssr.ts#L8-L9)
We've also enabled `scanPageMeta` by default ([#27134](https://togithub.com/nuxt/nuxt/pull/27134)). This pulls out any page metadata in your `definePageMeta` macro, and makes it available to modules (like `@nuxtjs/i18n`) so they can augment it.
This unlocks much better module/typed routing integration, but has a potential performance cost - so please file an issue if you experience any problems.
##### ๐ช Type improvements
We now have support for typed `#fallback` slots in server components ([#27097](https://togithub.com/nuxt/nuxt/pull/27097)).
We've also improved some defaults in your generated `tsconfig.json`, including setting `module: 'preserve'` if you have a locally installed TypeScript v5.4 version ([see docs](https://www.typescriptlang.org/tsconfig/#preserve)) - see [#26667](https://togithub.com/nuxt/nuxt/26667), [#27485](https://togithub.com/nuxt/nuxt/27485).
##### ๐ฆ Module author/power user improvements
We have shipped a range of type improvements for module authors, including:
- support for typed module options in `installModule` ([#26744](https://togithub.com/nuxt/nuxt/pull/26744))
- the option to specify compatibility with certain builders (vite/webpack) in module options ([#27022](https://togithub.com/nuxt/nuxt/pull/27022))
- a new `onPrehydrate` hook for hooking into the browser hydration cycle ([#27037](https://togithub.com/nuxt/nuxt/pull/27037))
- the ability to access and update *resolved* runtime configuration within modules, with new build-time `useRuntimeConfig` and `updateRuntimeConfig` utils ([#27117](https://togithub.com/nuxt/nuxt/pull/27117))
##### ๐จ Inlined UI templates
If you previously used `@nuxt/ui-templates` then it may be worth knowing that we have moved them from [a separate repository](https://togithub.com/nuxt/ui-templates) into the [nuxt/nuxt](https://togithub.com/nuxt/nuxt) monorepo. (This is purely a refactor rather than a change, although you can expect some new designs for Nuxt v4.)
#### โ Upgrading
As usual, our recommendation for upgrading is to run:
```sh
npx nuxi@latest upgrade --force
```
This will refresh your lockfile as well, and ensures that you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.
#### ๐ Changelog
[compare changes](https://togithub.com/nuxt/nuxt/compare/v3.11.2...v3.12.0)
##### ๐ Enhancements
- **nuxt:** Support passing options to `useRequestURL` ([#26687](https://togithub.com/nuxt/nuxt/pull/26687))
- **nuxt:** Introduce `imports.scan` option ([#26576](https://togithub.com/nuxt/nuxt/pull/26576))
- **nuxt:** Add `` and `useRouteAnnouncer` ([#25741](https://togithub.com/nuxt/nuxt/pull/25741))
- **kit:** Handle virtual files in `resolvePath` and `findPath` ([#26465](https://togithub.com/nuxt/nuxt/pull/26465))
- **nuxt:** Expose `useLink` from `NuxtLink` ([#26522](https://togithub.com/nuxt/nuxt/pull/26522))
- **schema:** V4 opt-in with `future.compatibilityVersion` ([#26925](https://togithub.com/nuxt/nuxt/pull/26925))
- **nuxt,schema:** Inline error, welcome, spa-loading templates ([#27021](https://togithub.com/nuxt/nuxt/pull/27021))
- **nuxt:** Configurable `app.rootAttrs` and `teleportAttrs` ([#27014](https://togithub.com/nuxt/nuxt/pull/27014))
- **schema:** Enable `cookieStore` by default ([f597ca59a](https://togithub.com/nuxt/nuxt/commit/f597ca59a))
- **nuxt,schema:** Support new Nuxt folder structure ([#27029](https://togithub.com/nuxt/nuxt/pull/27029))
- **nuxt:** Treeshake `onUpdated` and `onUnmounted` on server ([#27044](https://togithub.com/nuxt/nuxt/pull/27044))
- **nuxt:** Prompt to install `nuxt/scripts` on usage ([#27010](https://togithub.com/nuxt/nuxt/pull/27010))
- **nuxt:** Expose default slot from `` ([#27050](https://togithub.com/nuxt/nuxt/pull/27050))
- **nuxt:** Custom `renderSSRHeadOptions` config for `unhead` ([#26989](https://togithub.com/nuxt/nuxt/pull/26989))
- **nuxt:** Add `onPrehydrate` lifecycle hook ([#27037](https://togithub.com/nuxt/nuxt/pull/27037))
- **nuxt:** Support multiple nuxtApps at runtime ([#27068](https://togithub.com/nuxt/nuxt/pull/27068))
- **nuxt:** Add `#fallback` slot to server components types ([#27097](https://togithub.com/nuxt/nuxt/pull/27097))
- **nuxt:** Allow specifying builder compatibility in modules ([#27022](https://togithub.com/nuxt/nuxt/pull/27022))
- **kit:** Add `useRuntimeConfig` and `updateRuntimeConfig` utils ([#27117](https://togithub.com/nuxt/nuxt/pull/27117))
- **schema:** Remove some experimental options for v4 ([#27132](https://togithub.com/nuxt/nuxt/pull/27132))
- **nuxt:** Auto-register layers in `layers/` directory ([#27221](https://togithub.com/nuxt/nuxt/pull/27221))
- **nuxt:** Allow displaying error state in loading indicator ([#27176](https://togithub.com/nuxt/nuxt/pull/27176))
- **nuxt,schema:** Add `appId` and improve chunk determinism ([#27258](https://togithub.com/nuxt/nuxt/pull/27258))
- **nuxt:** Check schema/kit versions when loading nuxt ([#27224](https://togithub.com/nuxt/nuxt/pull/27224))
- **schema:** Add experimental `multiApp` flag ([#27291](https://togithub.com/nuxt/nuxt/pull/27291))
- **nuxt:** Respect defaults when clearing asyncData ([#27295](https://togithub.com/nuxt/nuxt/pull/27295))
- **nuxt:** Display banner when run with `compatibilityVersion` ([#27305](https://togithub.com/nuxt/nuxt/pull/27305))
- **nuxt:** Add `URL` serialiser for dev server logs ([a549b46e9](https://togithub.com/nuxt/nuxt/commit/a549b46e9))
- **nuxt:** Handle nuxt route injection for `this.$route` ([#27313](https://togithub.com/nuxt/nuxt/pull/27313))
- **nuxt:** Allow configuring interval for checking app update ([#27324](https://togithub.com/nuxt/nuxt/pull/27324))
- **nuxt:** Warn when accessing private runtimeConfig on client ([#26441](https://togithub.com/nuxt/nuxt/pull/26441))
- **kit:** Support typed module options in `installModule` ([#26744](https://togithub.com/nuxt/nuxt/pull/26744))
- **kit,schema:** Add `.with` for better module options types ([#26850](https://togithub.com/nuxt/nuxt/pull/26850))
- **nuxt:** Register plugin hooks before executing plugins ([#27449](https://togithub.com/nuxt/nuxt/pull/27449))
- **nuxt,schema:** Add `compatibilityDate` flag for future ([#27512](https://togithub.com/nuxt/nuxt/pull/27512))
##### ๐ฅ Performance
- **nuxt:** Don't add client fallback plugin if not enabled ([#26666](https://togithub.com/nuxt/nuxt/pull/26666))
- **nuxt:** Unsubscribe from `asyncData` watch when unmounted ([#26821](https://togithub.com/nuxt/nuxt/pull/26821))
- **nuxt:** Remove state from nuxt island response ([#26863](https://togithub.com/nuxt/nuxt/pull/26863))
- **nuxt:** Emit simpler functional ui templates (w/o lodash) ([#27091](https://togithub.com/nuxt/nuxt/pull/27091))
- **ui-templates:** Don't emit message data for pure strings ([9b1bfe69e](https://togithub.com/nuxt/nuxt/commit/9b1bfe69e))
- **nuxt:** Remove `ssrContext.styles` reference (from unused `vue-style-loader`) ([2d1ab61b2](https://togithub.com/nuxt/nuxt/commit/2d1ab61b2))
- **nuxt:** Mark payload as `shallowReactive` ([#27214](https://togithub.com/nuxt/nuxt/pull/27214))
- **nuxt:** Abort vue render when plugins throw error ([#27304](https://togithub.com/nuxt/nuxt/pull/27304))
- **vite:** Exclude common ESM deps from pre-bundling ([#27372](https://togithub.com/nuxt/nuxt/pull/27372))
- **kit,nuxt:** Remove handling for node 14 perf api ([#27396](https://togithub.com/nuxt/nuxt/pull/27396))
- **nuxt:** Deduplicate modules to install ([#27475](https://togithub.com/nuxt/nuxt/pull/27475))
- **webpack:** Decrease iteration count and improve type safety ([#27488](https://togithub.com/nuxt/nuxt/pull/27488))
##### ๐ฉน Fixes
- **nuxt:** Prevent `getCachedData` from shaping type of `useAsyncData` ([#25946](https://togithub.com/nuxt/nuxt/pull/25946))
- **nuxt:** Encode location header in navigateTo ([#26712](https://togithub.com/nuxt/nuxt/pull/26712))
- **nuxt:** Correctly remove extension from path in `hasSuffix` ([#26725](https://togithub.com/nuxt/nuxt/pull/26725))
- **nuxt:** Hint prerenderer to crawl routes at runtime ([#26694](https://togithub.com/nuxt/nuxt/pull/26694))
- **kit:** Ignore negation when resolving ignore patterns ([e105fadd7](https://togithub.com/nuxt/nuxt/commit/e105fadd7))
- **nuxt:** Avoid double-slash in ignore pattern ([75e43ac42](https://togithub.com/nuxt/nuxt/commit/75e43ac42))
- **kit:** Set typescript `moduleDetection` to 'force' ([#26667](https://togithub.com/nuxt/nuxt/pull/26667))
- **nuxt:** Re-initialise `nuxt._ignore` after all modules run ([#26680](https://togithub.com/nuxt/nuxt/pull/26680))
- **nuxt:** Assign `v-for` to slot in islands ([#26880](https://togithub.com/nuxt/nuxt/pull/26880))
- **nuxt:** Don't encode location header ([#26893](https://togithub.com/nuxt/nuxt/pull/26893))
- **nuxt:** Check if `_scope` is active before calling `run` function ([#26756](https://togithub.com/nuxt/nuxt/pull/26756), [#26904](https://togithub.com/nuxt/nuxt/pull/26904))
- **nuxt:** Don't scan component dirs when `enabled` is `false` ([#26906](https://togithub.com/nuxt/nuxt/pull/26906))
- **vite:** Inline styles for vue components with `lang="ts"` ([#26912](https://togithub.com/nuxt/nuxt/pull/26912))
- **nuxt:** Handle arrays correctly in `updateAppConfig` ([#26949](https://togithub.com/nuxt/nuxt/pull/26949))
- **nuxt:** `useState` in `NuxtClientFallback` setup function ([#26928](https://togithub.com/nuxt/nuxt/pull/26928))
- **nuxt:** Compile plugin templates last ([#27009](https://togithub.com/nuxt/nuxt/pull/27009))
- **nuxt:** Register redirect middleware before pushing route ([#27016](https://togithub.com/nuxt/nuxt/pull/27016))
- **nuxt,schema:** Remove `.js` extension from template imports ([0d4a622f3](https://togithub.com/nuxt/nuxt/commit/0d4a622f3))
- **nuxt:** Don't overwrite existing scope in `runWithContext` ([#26976](https://togithub.com/nuxt/nuxt/pull/26976))
- **schema:** Use v3 folder structure if `app.vue` exists in `rootDir` ([1af81ed0f](https://togithub.com/nuxt/nuxt/commit/1af81ed0f))
- **nuxt:** Use resolved path for test component import ([8e793ad5c](https://togithub.com/nuxt/nuxt/commit/8e793ad5c))
- **nuxt:** Use `URL` constructor to resolve external protocols ([5f0693a69](https://togithub.com/nuxt/nuxt/commit/5f0693a69))
- **nuxt:** Use `URL` for parsing URLs rather than `parseURL` ([ea22d3f98](https://togithub.com/nuxt/nuxt/commit/ea22d3f98))
- **nuxt:** Deprecate `process.*` flags ([#27089](https://togithub.com/nuxt/nuxt/pull/27089))
- **nuxt:** Provide default url for URL constructor ([8bdd620ba](https://togithub.com/nuxt/nuxt/commit/8bdd620ba))
- **nuxt:** Preload links with same hostname ([c065505e1](https://togithub.com/nuxt/nuxt/commit/c065505e1))
- **nuxt:** Remove unused prop in `NuxtTeleportIslandComponent` ([#27093](https://togithub.com/nuxt/nuxt/pull/27093))
- **nuxt:** Don't pass options to `spaLoadingTemplate` function ([0e12b6eb8](https://togithub.com/nuxt/nuxt/commit/0e12b6eb8))
- **nuxt:** Scan folder indices for middleware ([#27187](https://togithub.com/nuxt/nuxt/pull/27187))
- **nuxt:** Pass path to `jiti` and not file URL ([#27252](https://togithub.com/nuxt/nuxt/pull/27252))
- **schema:** Hoist \`@nuxt/devtools types for config auto-completion ([008a26417](https://togithub.com/nuxt/nuxt/commit/008a26417))
- **nuxt:** Correct components dir regexp ([dad89c2b1](https://togithub.com/nuxt/nuxt/commit/dad89c2b1))
- **schema:** Handle dev/test `buildId` in schema ([#27274](https://togithub.com/nuxt/nuxt/pull/27274))
- **nuxt:** Encode `location` header in `navigateTo` ([#27280](https://togithub.com/nuxt/nuxt/pull/27280))
- **nuxt:** Invert version check ([e5649613c](https://togithub.com/nuxt/nuxt/commit/e5649613c))
- **nuxt:** Exempt equality check for kit/schema version ([a531e6f46](https://togithub.com/nuxt/nuxt/commit/a531e6f46))
- **nuxt:** Use `undefined` rather than `null` for data fetching defaults ([#27294](https://togithub.com/nuxt/nuxt/pull/27294))
- **vite:** Ignore query/hash when resolving public assets ([#27306](https://togithub.com/nuxt/nuxt/pull/27306))
- **nuxt:** Clear timeout when asyncData request finishes/aborts ([#27308](https://togithub.com/nuxt/nuxt/pull/27308))
- **nuxt:** Provide default data type values in nuxt/app dir ([#27314](https://togithub.com/nuxt/nuxt/pull/27314))
- **nuxt:** Add module declarations for virtual files ([#27311](https://togithub.com/nuxt/nuxt/pull/27311))
- **nuxt:** Respect `app.cdnURL` for extracted payloads ([#26668](https://togithub.com/nuxt/nuxt/pull/26668))
- **vite:** Handle runtime paths in inlined styles ([#27327](https://togithub.com/nuxt/nuxt/pull/27327))
- **nuxt:** Add `VNode` reviver & don't deduplicate dev logs ([#27309](https://togithub.com/nuxt/nuxt/pull/27309))
- **vite:** Suppress warning about unresolved public assets ([#27328](https://togithub.com/nuxt/nuxt/pull/27328))
- **nuxt:** Defer shared asyncData promises to next tick ([#27329](https://togithub.com/nuxt/nuxt/pull/27329))
- **nuxt:** Resolve modules from layers directories ([#27338](https://togithub.com/nuxt/nuxt/pull/27338))
- **schema:** Pass correct jsx config for esbuild-loader ([#27341](https://togithub.com/nuxt/nuxt/pull/27341))
- **nuxt:** Transpile `app.config` files in nitro build ([#27342](https://togithub.com/nuxt/nuxt/pull/27342))
- **nuxt:** Use relative paths in `app.config.d.ts` ([#27350](https://togithub.com/nuxt/nuxt/pull/27350))
- **vite:** Disable `optimizeDeps` in ssr ([#27356](https://togithub.com/nuxt/nuxt/pull/27356))
- **vite:** Don't get available port when `hmr.server` is set ([#27326](https://togithub.com/nuxt/nuxt/pull/27326))
- **nuxt:** Mark nuxt/scripts stubs as lower priority ([51740fa1d](https://togithub.com/nuxt/nuxt/commit/51740fa1d))
- **nuxt:** Handle errors loading app manifest ([#27441](https://togithub.com/nuxt/nuxt/pull/27441))
- **schema:** Exclude non-serialisable types from `app` options ([#27478](https://togithub.com/nuxt/nuxt/pull/27478))
- **nuxt:** Deduplicate `app.head` arrays ([#27480](https://togithub.com/nuxt/nuxt/pull/27480))
- **kit:** Improve defaults in generated `tsconfig.json` ([#27485](https://togithub.com/nuxt/nuxt/pull/27485))
- **nuxt:** Use `buildAssetsDir` in island teleport dev chunk ([#27469](https://togithub.com/nuxt/nuxt/pull/27469))
- **kit:** Do not use `module: preserve` unelss ts v5.4 is installed ([b08dfc98b](https://togithub.com/nuxt/nuxt/commit/b08dfc98b))
- **nuxt:** Ensure payload script executes before entry ([#27506](https://togithub.com/nuxt/nuxt/pull/27506))
- **kit:** Avoid fallback to normalized path in module loading ([#27507](https://togithub.com/nuxt/nuxt/pull/27507))
- **nuxt:** Also augment page metadata after `pages:extend` hook ([#27134](https://togithub.com/nuxt/nuxt/pull/27134))
- **nuxt:** Resolve full path to app manifest stub page ([91685a5b2](https://togithub.com/nuxt/nuxt/commit/91685a5b2))
- **nuxt:** Resolve paths without file extensions ([dccf2e5f3](https://togithub.com/nuxt/nuxt/commit/dccf2e5f3))
- **kit:** Revert back to `esnext` target ([7bb02735e](https://togithub.com/nuxt/nuxt/commit/7bb02735e))
- **kit,schema:** Revert changes to module options types ([#26850](https://togithub.com/nuxt/nuxt/pull/26850))
- **nuxt:** Remove `boolean` value for `dedupe` in v4 compat ([#27511](https://togithub.com/nuxt/nuxt/pull/27511))
- **nuxt:** Add parent `scopeId` to server components ([#27497](https://togithub.com/nuxt/nuxt/pull/27497))
- **nuxt:** Handle symbol keys in wrapped runtime config ([13fec55c1](https://togithub.com/nuxt/nuxt/commit/13fec55c1))
- **nuxt:** Register augmented pages to avoid re-augmenting ([b75bf870b](https://togithub.com/nuxt/nuxt/commit/b75bf870b))
- **nuxt:** Use file path as key for re-augmenting ([09f6a88e1](https://togithub.com/nuxt/nuxt/commit/09f6a88e1))
##### ๐ Refactors
- Improve regexp performance ([#27207](https://togithub.com/nuxt/nuxt/pull/27207))
##### ๐ Documentation
- Update Nuxt 4 scheduled release date ([#26663](https://togithub.com/nuxt/nuxt/pull/26663))
- Remove step of installing deps in new nuxt project ([#26676](https://togithub.com/nuxt/nuxt/pull/26676))
- Clarify `dependsOn` works not just for parallel plugins ([#26707](https://togithub.com/nuxt/nuxt/pull/26707))
- Add `--preset` flag for `nuxi build` ([#26759](https://togithub.com/nuxt/nuxt/pull/26759))
- Fix typo ([#26752](https://togithub.com/nuxt/nuxt/pull/26752))
- Remove misleading reference to `useFetch` ([#26748](https://togithub.com/nuxt/nuxt/pull/26748))
- Update the code style page ([#26792](https://togithub.com/nuxt/nuxt/pull/26792))
- Reference correct composable in `callWithNuxt` ([#26771](https://togithub.com/nuxt/nuxt/pull/26771))
- Add sample app.vue ([#26796](https://togithub.com/nuxt/nuxt/pull/26796))
- Remove direct link to subheading ([#26775](https://togithub.com/nuxt/nuxt/pull/26775))
- Fix `srcDir` description mentioning deprecated `static/` directory ([#26804](https://togithub.com/nuxt/nuxt/pull/26804))
- Provide example of passing props to a child page ([#26805](https://togithub.com/nuxt/nuxt/pull/26805))
- Provide example of exposing a `pageRef` from a child page ([#26806](https://togithub.com/nuxt/nuxt/pull/26806))
- Correct definePageMeta scrollToTop docs link ([#26829](https://togithub.com/nuxt/nuxt/pull/26829))
- Advise correct extension for vitest config ([#26845](https://togithub.com/nuxt/nuxt/pull/26845))
- Deprecate `pending` value in data fetching composables ([#26766](https://togithub.com/nuxt/nuxt/pull/26766))
- Fix file name ([#26852](https://togithub.com/nuxt/nuxt/pull/26852))
- Add info about self-hosted github/gitlab instances ([#26501](https://togithub.com/nuxt/nuxt/pull/26501))
- Add `@vue/test-utils` getting started guide ([#26205](https://togithub.com/nuxt/nuxt/pull/26205))
- Add a note about HTTPS with a self-signed certificates ([#26481](https://togithub.com/nuxt/nuxt/pull/26481))
- Clarify purpose of play online section ([#25978](https://togithub.com/nuxt/nuxt/pull/25978))
- Fix typo with `a` -> `an` ([#26856](https://togithub.com/nuxt/nuxt/pull/26856))
- Fix code block formatting ([#26859](https://togithub.com/nuxt/nuxt/pull/26859))
- Add more detail to `usePreviewMode` explanation ([#26602](https://togithub.com/nuxt/nuxt/pull/26602))
- Fix import of `defineConfig` ([a60de743a](https://togithub.com/nuxt/nuxt/commit/a60de743a))
- Add `@since` annotations to exported functions ([#25365](https://togithub.com/nuxt/nuxt/pull/25365))
- Add watch example link ([#26818](https://togithub.com/nuxt/nuxt/pull/26818))
- Add source tag ([#26884](https://togithub.com/nuxt/nuxt/pull/26884))
- Update strict checks section with new default ([#26965](https://togithub.com/nuxt/nuxt/pull/26965))
- Correct link to data fetching docs ([#26988](https://togithub.com/nuxt/nuxt/pull/26988))
- Add link to one of [@manniL](https://togithub.com/manniL)'s videos on layers ([#26984](https://togithub.com/nuxt/nuxt/pull/26984))
- Fix small typo ([#26999](https://togithub.com/nuxt/nuxt/pull/26999))
- Preprocessors as dev deps to align with vue plugin ([#27005](https://togithub.com/nuxt/nuxt/pull/27005))
- Change `.eslintrc.js` to `eslint.config.js` ([#27020](https://togithub.com/nuxt/nuxt/pull/27020))
- Add docs for `future.compatibilityVersion` ([e7789a257](https://togithub.com/nuxt/nuxt/commit/e7789a257))
- Add vite plugin recipe ([#27043](https://togithub.com/nuxt/nuxt/pull/27043))
- Improve data fetching wording and explanation ([#27061](https://togithub.com/nuxt/nuxt/pull/27061))
- Add missing options for `nuxi init` ([#27051](https://togithub.com/nuxt/nuxt/pull/27051))
- Update docs for `ignorePrefix` to clarify ignored files ([#27065](https://togithub.com/nuxt/nuxt/pull/27065))
- Mention nightly release channel for unreleased features ([8fcf893f8](https://togithub.com/nuxt/nuxt/commit/8fcf893f8))
- Add migration/testing guide for nuxt 4 ([#27128](https://togithub.com/nuxt/nuxt/pull/27128))
- Improve testing component examples ([#27138](https://togithub.com/nuxt/nuxt/pull/27138))
- Fix type checking of component testing blocks ([b5e35e3bd](https://togithub.com/nuxt/nuxt/commit/b5e35e3bd))
- Add `app.config.ts` to nuxt 4 testing/migration ([#27164](https://togithub.com/nuxt/nuxt/pull/27164))
- Add video links for more context ([#27174](https://togithub.com/nuxt/nuxt/pull/27174))
- Add module execution order ([#27178](https://togithub.com/nuxt/nuxt/pull/27178))
- Mark bridge as stable ([#27212](https://togithub.com/nuxt/nuxt/pull/27212))
- Explain how environment variables work in production ([#27189](https://togithub.com/nuxt/nuxt/pull/27189))
- Add cache option to useFetch params ([#27225](https://togithub.com/nuxt/nuxt/pull/27225))
- Add custom `useFetch` recipe ([#27208](https://togithub.com/nuxt/nuxt/pull/27208))
- Add `nuxt/scripts` ([#27229](https://togithub.com/nuxt/nuxt/pull/27229))
- Add example of passing params to `` ([#27284](https://togithub.com/nuxt/nuxt/pull/27284))
- Add additional example for setting `baseURL` and `cdnURL` ([#27273](https://togithub.com/nuxt/nuxt/pull/27273))
- Update readme for Nuxt 2 NES and support ([d35e9cd3f](https://togithub.com/nuxt/nuxt/commit/d35e9cd3f))
-
Configuration
๐ Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
๐ฆ Automerge: Enabled.
โป Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
๐ Ignore: Close this PR and you won't be reminded about this update again.
[ ] If you want to rebase/retry this PR, check this box
This PR contains the following updates:
3.9.0->3.12.4GitHub Vulnerability Alerts
CVE-2024-34344
Summary
Due to the insufficient validation of the
pathparameter in the NuxtTestComponentWrapper, an attacker can execute arbitrary JavaScript on the server side, which allows them to execute arbitrary commands.Details
While running the test, a special component named
NuxtTestComponentWrapperis available. https://github.com/nuxt/nuxt/blob/4779f5906fa4d3c784c2e2d6fe5a5c5f181faaec/packages/nuxt/src/app/components/nuxt-root.vue#L42-L43This component loads the specified path as a component and renders it.
https://github.com/nuxt/nuxt/blob/4779f5906fa4d3c784c2e2d6fe5a5c5f181faaec/packages/nuxt/src/app/components/test-component-wrapper.ts#L9-L27
There is a validation for the
pathparameter to check whether the path traversal is performed, but this check is not sufficient.https://github.com/nuxt/nuxt/blob/4779f5906fa4d3c784c2e2d6fe5a5c5f181faaec/packages/nuxt/src/app/components/test-component-wrapper.ts#L15-L19
Since
import(...)usesquery.pathinstead of the normalizedpath, a non-normalized URL can reach theimport(...)function. For example, passing something like./components/testnormalizespathto/root/directory/components/test, butimport(...)still receives./components/test.By using this behavior, it's possible to load arbitrary JavaScript by using the path like the following:
Since
resolve(...)resolves the filesystem path, not the URI, the above URI is treated as a relative path, butimport(...)sees it as an absolute URI, and loads it as a JavaScript.PoC
whoamiis written to/tmp/testDemonstration video: https://www.youtube.com/watch?v=FI6mN8WbcE4
Impact
Users who open a malicious web page in the browser while running the test locally are affected by this vulnerability, which results in the remote code execution from the malicious web page. Since web pages can send requests to arbitrary addresses, a malicious web page can repeatedly try to exploit this vulnerability, which then triggers the exploit when the test server starts.
CVE-2024-34343
Summary
The
navigateTofunction attempts to blockthejavascript:protocol, but does not correctly use API's provided byunjs/ufo. This library also contains parsing discrepancies.Details
The function first tests to see if the specified URL has a protocol. This uses the unjs/ufo package for URL parsing. This function works effectively, and returns true for a
javascript:protocol.After this, the URL is parsed using the
parseURLfunction. This function will refuse to parse poorly formatted URLs. Parsingjavascript:alert(1)returns null/"" for all values.Next, the protocol of the URL is then checked using the
isScriptProtocolfunction. This function simply checks the input against a list of protocols, and does not perform any parsing.The combination of refusing to parse poorly formatted URLs, and not performing additional parsing means that script checks fail as no protocol can be found. Even if a protocol was identified, whitespace is not stripped in the
parseURLimplementation, bypassing theisScriptProtocolchecks.Certain special protocols are identified at the top of
parseURL. Inserting a newline or tab into this sequence will block the special protocol check, and bypass the latter checks.PoC
POC - https://stackblitz.com/edit/nuxt-xss-navigateto?file=app.vue
Attempt payload X, then attempt payload Y.
Impact
XSS, access to cookies, make requests on user's behalf.
Recommendations
As always with these bugs, the
URLconstructor provided by the browser is always the safest method of parsing a URL.Given the cross-platform requirements of nuxt/ufo a more appropriate solution is to make parsing consistent between functions, and to adapt parsing to be more consistent with the WHATWG URL specification.
Note
I've reported this vulnerability here as it is unclear if this is a bug in ufo or a misuse of the ufo library.
This ONLY has impact after SSR has occured, the
javascript:protocol within a location header does not trigger XSS.Release Notes
nuxt/nuxt (nuxt)
### [`v3.12.4`](https://togithub.com/nuxt/nuxt/releases/tag/v3.12.4) [Compare Source](https://togithub.com/nuxt/nuxt/compare/v3.12.3...v3.12.4) > 3.12.4 is the next regularly scheduled patch release. #### ๐ Changelog [compare changes](https://togithub.com/nuxt/nuxt/compare/v3.12.3...v3.12.4) ##### ๐ฅ Performance - **vite:** Start warmups after nitro build ([#27963](https://togithub.com/nuxt/nuxt/pull/27963)) - **vite:** Avoid extra resolve call for `resolveId` in layers ([#27971](https://togithub.com/nuxt/nuxt/pull/27971)) - **kit,nuxt,schema,vite,webpack:** Use explicit exports ([#27998](https://togithub.com/nuxt/nuxt/pull/27998)) ##### ๐ฉน Fixes - **schema:** Resolve public alias correctly ([#27975](https://togithub.com/nuxt/nuxt/pull/27975)) - **nuxt:** Omit rendering payload prefetch when `noScripts` ([#27972](https://togithub.com/nuxt/nuxt/pull/27972)) - **nuxt:** Add `/` as fallback if page can't be identified ([e6109b226](https://togithub.com/nuxt/nuxt/commit/e6109b226)) - **ui-templates:** Validate templates with `html-validate` ([#28024](https://togithub.com/nuxt/nuxt/pull/28024)) - **schema:** Don't constrain postcss plugin options ([#28045](https://togithub.com/nuxt/nuxt/pull/28045)) - **kit:** Remove exports from v4 branch ([5c8312e9b](https://togithub.com/nuxt/nuxt/commit/5c8312e9b)) - **nuxt:** Use `unhead` key for ad-hoc module options ([#28088](https://togithub.com/nuxt/nuxt/pull/28088)) - **nuxt:** Use native vue-router composables ([#28114](https://togithub.com/nuxt/nuxt/pull/28114)) - **kit:** Ensure `getNuxtVersion` returns `string` ([#28125](https://togithub.com/nuxt/nuxt/pull/28125)) - **nuxt:** Always prerender at least one page with crawler ([#28131](https://togithub.com/nuxt/nuxt/pull/28131)) - **nuxt:** Consider doc `scroll-padding-top` in scrollBehavior ([#28083](https://togithub.com/nuxt/nuxt/pull/28083)) - **nuxt:** Only warn when `useAsyncData` returns undefined ([#28154](https://togithub.com/nuxt/nuxt/pull/28154)) - **nuxt:** Revert change to `getCachedData` null response ([d10cea11b](https://togithub.com/nuxt/nuxt/commit/d10cea11b)) - **schema:** Don't use `app/` as `srcDir` if it doesn't exist ([#28176](https://togithub.com/nuxt/nuxt/pull/28176)) - **kit:** Normalise `serverDir` within layers using v4 compat ([#28177](https://togithub.com/nuxt/nuxt/pull/28177)) - **nuxt:** Allow `getCachedData` to return undefined ([#28187](https://togithub.com/nuxt/nuxt/pull/28187)) - **nuxt:** Use `addEventListener` to register cookie store listener ([#28193](https://togithub.com/nuxt/nuxt/pull/28193)) - **nuxt:** Merge route meta properties with scanned meta ([#28170](https://togithub.com/nuxt/nuxt/pull/28170)) - **nuxt:** Prevent duplicate `set-cookie` headers ([#28211](https://togithub.com/nuxt/nuxt/pull/28211)) ##### ๐ Refactors - **schema,vite,webpack:** Rework `postcss` module loading ([#27946](https://togithub.com/nuxt/nuxt/pull/27946)) - **nuxt:** Remove `_registeredComponents` from ssrContext ([#27819](https://togithub.com/nuxt/nuxt/pull/27819)) - **nuxt:** Use `errx` to handle dev log traces ([#28027](https://togithub.com/nuxt/nuxt/pull/28027)) ##### ๐ Documentation - Fix link ([83bd4fde9](https://togithub.com/nuxt/nuxt/commit/83bd4fde9)) - Fix Cloudflare spelling ([#27989](https://togithub.com/nuxt/nuxt/pull/27989)) - Update example to use `nuxtApp.runWithContext` ([#28000](https://togithub.com/nuxt/nuxt/pull/28000)) - Remove deprecated `pending` variable from data fetching docs ([#28011](https://togithub.com/nuxt/nuxt/pull/28011)) - Clarify xrsp danger ([#28053](https://togithub.com/nuxt/nuxt/pull/28053)) - Deprecate pending and emphasis undefined ([#28113](https://togithub.com/nuxt/nuxt/pull/28113)) - Update phrasing in route announcer ([#28108](https://togithub.com/nuxt/nuxt/pull/28108)) - Use code groups for install commands in module guide ([#28094](https://togithub.com/nuxt/nuxt/pull/28094)) - Capitalize text ([#28056](https://togithub.com/nuxt/nuxt/pull/28056)) - Mention content in upgrade guide v4 folder structure ([#28090](https://togithub.com/nuxt/nuxt/pull/28090)) - Remove a resolved issue from view transition docs ([#28091](https://togithub.com/nuxt/nuxt/pull/28091)) - Clarify navigateTo is not for nitro routes ([#28092](https://togithub.com/nuxt/nuxt/pull/28092)) - Warn about nested islands ([#28062](https://togithub.com/nuxt/nuxt/pull/28062)) - Add info about `layers/` directory ([#28128](https://togithub.com/nuxt/nuxt/pull/28128)) - Codemods for migrating to Nuxt 4 ([#28072](https://togithub.com/nuxt/nuxt/pull/28072)) ##### โ Tests - Add `typeCheck` test in minimal build ([#28166](https://togithub.com/nuxt/nuxt/pull/28166)) ##### ๐ค CI - Run prepare step before linting docs ([f8fbefb42](https://togithub.com/nuxt/nuxt/commit/f8fbefb42)) - Run prepare step before linting docs ([d629b82b3](https://togithub.com/nuxt/nuxt/commit/d629b82b3)) ##### โค๏ธ Contributors - Daniel Roe ([@danielroe](https://togithub.com/danielroe)) - arshcodemod ([@arshcodemod](https://togithub.com/arshcodemod)) - xjccc ([@xjccc](https://togithub.com/xjccc)) - Julien Huang ([@huang-julien](https://togithub.com/huang-julien)) - BoogieBen ([@boogie-ben](https://togithub.com/boogie-ben)) - Santiago A ([@santiagoaloi](https://togithub.com/santiagoaloi)) - Bobbie Goede ([@BobbieGoede](https://togithub.com/BobbieGoede)) - John Tanzer ([@moshetanzer](https://togithub.com/moshetanzer)) - Thomas ([@ThomasWT](https://togithub.com/ThomasWT)) - [@beer](https://togithub.com/beer) ([@iiio2](https://togithub.com/iiio2)) - Dominic ([@rexhent](https://togithub.com/rexhent)) - Alex Liu ([@Mini-ghost](https://togithub.com/Mini-ghost)) - Florian Metz ([@Timeraa](https://togithub.com/Timeraa)) - Liran Tal ([@lirantal](https://togithub.com/lirantal)) - Daniel Kelly ([@danielkellyio](https://togithub.com/danielkellyio)) - Daniel Flanagan ([@FlantasticDan](https://togithub.com/FlantasticDan)) - ๅฑฑๅน่ฒๅพกๅฎ ([@KazariEX](https://togithub.com/KazariEX)) - izzy goldman ([@izzygld](https://togithub.com/izzygld)) - Anthony Fu ([@antfu](https://togithub.com/antfu)) ### [`v3.12.3`](https://togithub.com/nuxt/nuxt/releases/tag/v3.12.3) [Compare Source](https://togithub.com/nuxt/nuxt/compare/v3.12.2...v3.12.3) > 3.12.3 is the next regularly scheduled patch release. #### ๐ Changelog [compare changes](https://togithub.com/nuxt/nuxt/compare/v3.12.2...v3.12.3) ##### ๐ฅ Performance - **nuxt,vite:** Use native fs utils rather than `fs-extra` ([#27787](https://togithub.com/nuxt/nuxt/pull/27787)) - **schema:** Use `chokidar` when a custom `srcDir` is provided ([#27871](https://togithub.com/nuxt/nuxt/pull/27871)) - **nuxt:** Ensure `prefetchComponents` is treeshaken on server ([#27905](https://togithub.com/nuxt/nuxt/pull/27905)) ##### ๐ฉน Fixes - **nuxt:** Flag async data promise as cancelled only if defined ([#27690](https://togithub.com/nuxt/nuxt/pull/27690)) - **schema:** Handle backwards compat for `dir.app` ([0c73cb734](https://togithub.com/nuxt/nuxt/commit/0c73cb734)) - **nuxt:** Support hoisting types of subpath imports ([#27720](https://togithub.com/nuxt/nuxt/pull/27720)) - **nuxt:** Resolve routes when `navigateTo` called with `open` ([#27742](https://togithub.com/nuxt/nuxt/pull/27742)) - **nuxt:** Handle subpaths more correctly ([d7402a799](https://togithub.com/nuxt/nuxt/commit/d7402a799)) - **nuxt:** Delay navigation until user input is acknowledged ([#27743](https://togithub.com/nuxt/nuxt/pull/27743)) - **nuxt:** Resolve aliases used in nitro plugin paths ([#27741](https://togithub.com/nuxt/nuxt/pull/27741)) - **schema:** Do not use full path assets/public aliases ([d0518650f](https://togithub.com/nuxt/nuxt/commit/d0518650f)) - **nuxt:** Defer registering inp handler until nuxt is mounted ([866a5319a](https://togithub.com/nuxt/nuxt/commit/866a5319a)) - **nuxt:** Add `refresh` type in server component refs ([#27778](https://togithub.com/nuxt/nuxt/pull/27778)) - **nuxt:** Extract all-literal page meta ([#27821](https://togithub.com/nuxt/nuxt/pull/27821)) - **kit:** Handle loading nuxt 4+ ([cf251bd48](https://togithub.com/nuxt/nuxt/commit/cf251bd48)) - **nuxt:** Handle external links to named route objects ([#27829](https://togithub.com/nuxt/nuxt/pull/27829)) - **nuxt:** Use URL to encode redirected URLs ([#27822](https://togithub.com/nuxt/nuxt/pull/27822)) - **nuxt:** Don't use app version when verifying nuxt deps ([#27864](https://togithub.com/nuxt/nuxt/pull/27864)) - **nuxt:** Prompt to set compatibility date with latest nitro ([#27893](https://togithub.com/nuxt/nuxt/pull/27893)) - **nuxt:** Add `#vue-router` alias for backwards compat ([#27896](https://togithub.com/nuxt/nuxt/pull/27896)) - **nuxt:** Move app augments to core `nuxt` types ([#27900](https://togithub.com/nuxt/nuxt/pull/27900)) - **nuxt:** Pass augmented pages to child paths ([ecb35d3a2](https://togithub.com/nuxt/nuxt/commit/ecb35d3a2)) - **nuxt:** Use pascal name when loading server component ([#27928](https://togithub.com/nuxt/nuxt/pull/27928)) - **nuxt:** Improve async data warning ([#27874](https://togithub.com/nuxt/nuxt/pull/27874), [#27934](https://togithub.com/nuxt/nuxt/pull/27934)) - **nuxt:** Allow configuring server components in modules ([#27936](https://togithub.com/nuxt/nuxt/pull/27936)) - **vite:** Omit css `?raw` from head when in dev mode ([#27940](https://togithub.com/nuxt/nuxt/pull/27940)) - **kit,nuxt:** Ensure webworker types are available ([4cab71d66](https://togithub.com/nuxt/nuxt/commit/4cab71d66)) - **nuxt:** Seed crawler when prerendering pages ([#27955](https://togithub.com/nuxt/nuxt/pull/27955)) - **vite:** Fix type issue with legacy dev bundler ([f9fa1a3e9](https://togithub.com/nuxt/nuxt/commit/f9fa1a3e9)) - **nuxt:** Improve dx around compatibility date prompt ([#27965](https://togithub.com/nuxt/nuxt/pull/27965)) ##### ๐ Refactors - **kit,nuxt:** Use `performance.now` to measure time ([d14f7ec46](https://togithub.com/nuxt/nuxt/commit/d14f7ec46)) ##### ๐ Documentation - Add referral query variable to Vue School Links ([#27670](https://togithub.com/nuxt/nuxt/pull/27670)) - Fix variable name ([#27675](https://togithub.com/nuxt/nuxt/pull/27675)) - Clarify how transitions are configured globally ([#27679](https://togithub.com/nuxt/nuxt/pull/27679)) - Remove outdated recommendation ([#27691](https://togithub.com/nuxt/nuxt/pull/27691)) - Add `refreshCookie` on `useCookie` doc page ([#27744](https://togithub.com/nuxt/nuxt/pull/27744)) - Sync changes from `main` branch ([e7fbc9f81](https://togithub.com/nuxt/nuxt/commit/e7fbc9f81)) - Remove outdated tip ([#27773](https://togithub.com/nuxt/nuxt/pull/27773)) - Warn about awaiting `useFetch`/`AsyncData` in wrappers ([#27785](https://togithub.com/nuxt/nuxt/pull/27785)) - Update some code groups with package manager examples ([#27791](https://togithub.com/nuxt/nuxt/pull/27791)) - Hint to use runtime config ([#27859](https://togithub.com/nuxt/nuxt/pull/27859)) - Use internal link ([#27883](https://togithub.com/nuxt/nuxt/pull/27883)) - Update links to `vue-router` docs ([#27895](https://togithub.com/nuxt/nuxt/pull/27895)) - Use internal link ([#27894](https://togithub.com/nuxt/nuxt/pull/27894)) - Remove warning about type checking ([#27911](https://togithub.com/nuxt/nuxt/pull/27911)) - `compatibilityVersion` is available in the latest release ([#27919](https://togithub.com/nuxt/nuxt/pull/27919)) - Update roadmap + readme ([748bc751d](https://togithub.com/nuxt/nuxt/commit/748bc751d)) - Update `Nuxt 3` -> `Nuxt` or `Nuxt 3+` ([3c16c890c](https://togithub.com/nuxt/nuxt/commit/3c16c890c)) - Update reference to nightly release for testing nuxt 4 ([5d2dc9714](https://togithub.com/nuxt/nuxt/commit/5d2dc9714)) - Remove duplicate server-side notice in runtime config ([#27929](https://togithub.com/nuxt/nuxt/pull/27929)) - Warn about ref unwrapping when auto-importing `ref`s ([#27933](https://togithub.com/nuxt/nuxt/pull/27933)) - Mention layers in directory guide ([c222fe7aa](https://togithub.com/nuxt/nuxt/commit/c222fe7aa)) ##### ๐ก Chore - Use absolute urls for sources to assets in readme ([5ef305cec](https://togithub.com/nuxt/nuxt/commit/5ef305cec)) - Use relative links and update in build script ([7dd15186e](https://togithub.com/nuxt/nuxt/commit/7dd15186e)) - Use backup file extension ([a42a3869b](https://togithub.com/nuxt/nuxt/commit/a42a3869b)) - Allow changelogs with breaking changes ([e11587189](https://togithub.com/nuxt/nuxt/commit/e11587189)) - Allow major bumps ([dea0b86c7](https://togithub.com/nuxt/nuxt/commit/dea0b86c7)) - Add `4x` tag for v4 nightly releases ([9d5dd5494](https://togithub.com/nuxt/nuxt/commit/9d5dd5494)) - **vite:** Restore utils required for `dev-bundler` ([e3448fa0d](https://togithub.com/nuxt/nuxt/commit/e3448fa0d)) - Remove nitro/h3 from renovate, and reenable vitejs/vue ([9037b0d2c](https://togithub.com/nuxt/nuxt/commit/9037b0d2c)) - Improve type safety with indexed access ([#27626](https://togithub.com/nuxt/nuxt/pull/27626)) - Add [@danielroe](https://togithub.com/danielroe) to code owners ([7fa957729](https://togithub.com/nuxt/nuxt/commit/7fa957729)) - Remove renovate configuration from `2.x` branch ([8003cf72f](https://togithub.com/nuxt/nuxt/commit/8003cf72f)) - Remove issue template for 2.x ([9f9fb9251](https://togithub.com/nuxt/nuxt/commit/9f9fb9251)) - Remove unused variable ([f07969d88](https://togithub.com/nuxt/nuxt/commit/f07969d88)) ##### โ Tests - **schema:** Normalize snapshot paths for windows ([#27654](https://togithub.com/nuxt/nuxt/pull/27654)) - **nuxt:** Normalize paths for windows ([#27653](https://togithub.com/nuxt/nuxt/pull/27653)) - Bump timeout for node-compat test ([228b8b889](https://togithub.com/nuxt/nuxt/commit/228b8b889)) - Slightly improve test reliability ([#27811](https://togithub.com/nuxt/nuxt/pull/27811)) ##### ๐ค CI - Update changelog from 3.x branch updates ([2b6967fbb](https://togithub.com/nuxt/nuxt/commit/2b6967fbb)) - Add 3x tag instead ([c0ef279f2](https://togithub.com/nuxt/nuxt/commit/c0ef279f2)) - Run workflows against 3.x branch as well ([31255a14d](https://togithub.com/nuxt/nuxt/commit/31255a14d)) - Use correct SHA calculation for release-pr action ([#27604](https://togithub.com/nuxt/nuxt/pull/27604)) - Resolve bash syntax error ([#27789](https://togithub.com/nuxt/nuxt/pull/27789)) - Only run scorecards against `main` branch ([7abd982f8](https://togithub.com/nuxt/nuxt/commit/7abd982f8)) - Raise renovate prs against 3.x branch too ([f176c150a](https://togithub.com/nuxt/nuxt/commit/f176c150a)) - Ignore `@vitejs/plugin-vue` again ([56660cbdd](https://togithub.com/nuxt/nuxt/commit/56660cbdd)) - Prevent more than one release from occurring at same time ([71705550f](https://togithub.com/nuxt/nuxt/commit/71705550f)) - Don't run changelog update on 2.x branch ([1be639364](https://togithub.com/nuxt/nuxt/commit/1be639364)) ##### โค๏ธ Contributors - Daniel Roe ([@danielroe](https://togithub.com/danielroe)) - Typed SIGTERM ([@typed-sigterm](https://togithub.com/typed-sigterm)) - Seno ([@s-en-o](https://togithub.com/s-en-o)) - Julien Huang ([@huang-julien](https://togithub.com/huang-julien)) - Michael Brevard ([@GalacticHypernova](https://togithub.com/GalacticHypernova)) - Ryota Watanabe ([@wattanx](https://togithub.com/wattanx)) - Martin Masevski ([@Archetipo95](https://togithub.com/Archetipo95)) - Alex Liu ([@Mini-ghost](https://togithub.com/Mini-ghost)) - Bochkarev Ivan ([@Ibochkarev](https://togithub.com/Ibochkarev)) - Alexander Lichter ([@manniL](https://togithub.com/manniL)) - Dominic ([@rexhent](https://togithub.com/rexhent)) - Aviv Keller ([@RedYetiDev](https://togithub.com/RedYetiDev)) - Maxime Pauvert ([@maximepvrt](https://togithub.com/maximepvrt)) - Daniel Kelly ([@danielkellyio](https://togithub.com/danielkellyio)) - Damian Gลowala ([@DamianGlowala](https://togithub.com/DamianGlowala)) - Idorenyin Udoh ([@idorenyinudoh](https://togithub.com/idorenyinudoh)) ### [`v3.12.2`](https://togithub.com/nuxt/nuxt/releases/tag/v3.12.2) [Compare Source](https://togithub.com/nuxt/nuxt/compare/v3.12.1...v3.12.2) > 3.12.2 is the a regularly scheduled patch release. #### โ Upgrading As usual, our recommendation for upgrading is to run: ```sh npx nuxi@latest upgrade --force ``` This will refresh your lockfile as well, and ensures that you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem. #### ๐ Changelog [compare changes](https://togithub.com/nuxt/nuxt/compare/v3.12.1...v3.12.2) ##### ๐ฅ Performance - **kit:** Deduplicate layers before resolving config ([#27582](https://togithub.com/nuxt/nuxt/pull/27582)) - **webpack:** Decrease assets map iterations ([d929cd4ef](https://togithub.com/nuxt/nuxt/commit/d929cd4ef)) - **kit:** Various performance improvements ([#27600](https://togithub.com/nuxt/nuxt/pull/27600)) - **vite:** Various performance improvements ([#27601](https://togithub.com/nuxt/nuxt/pull/27601)) - **nuxt:** Don't wait for key deps check ([#27638](https://togithub.com/nuxt/nuxt/pull/27638)) ##### ๐ฉน Fixes - **nuxt:** Call `onNuxtReady` callback without arguments ([#27428](https://togithub.com/nuxt/nuxt/pull/27428)) - **schema:** Don't narrow head string types to literals ([#27540](https://togithub.com/nuxt/nuxt/pull/27540)) - **schema:** `app/` dir backwards compatibility ([#27529](https://togithub.com/nuxt/nuxt/pull/27529)) - **nuxt:** Manually assign payload reactivity when `ssr: false` ([#27542](https://togithub.com/nuxt/nuxt/pull/27542)) - **nuxt:** Only log warning once per `runtimeConfig` key ([9e56b60c6](https://togithub.com/nuxt/nuxt/commit/9e56b60c6)) - **nuxt:** Overwrite `#app/defaults` rather than augmenting ([#27567](https://togithub.com/nuxt/nuxt/pull/27567)) - **nuxt:** Export `useRouteAnnouncer` ([#27562](https://togithub.com/nuxt/nuxt/pull/27562)) - **nuxt:** Remove backticks around runtimeConfig warning log ([#27549](https://togithub.com/nuxt/nuxt/pull/27549)) - **nuxt:** Close top-level watcher on nuxt 'close' ([#27571](https://togithub.com/nuxt/nuxt/pull/27571)) - **nuxt:** Handle tsx code when extracting pageMeta/routeRules ([#27583](https://togithub.com/nuxt/nuxt/pull/27583)) - **nuxt:** Handle more edge cases with external/custom links ([#27487](https://togithub.com/nuxt/nuxt/pull/27487)) - **nuxt:** Preserve route metadata assigned outside page ([#27587](https://togithub.com/nuxt/nuxt/pull/27587)) - **nuxt:** Use portal to sync nitro/nuxt runtimeConfig + routeRules ([#27596](https://togithub.com/nuxt/nuxt/pull/27596)) - **nuxt,schema:** Add types for `_installedModules` ([e4bfea642](https://togithub.com/nuxt/nuxt/commit/e4bfea642)) - **nuxt:** Include build-time pages in prerender routes ([#27569](https://togithub.com/nuxt/nuxt/pull/27569)) - **nuxt:** Warn when async data doesn't return a value ([#27599](https://togithub.com/nuxt/nuxt/pull/27599)) - **nuxt:** Replace deprecated `app.rootId` with `app.rootAttrs.id` ([#27630](https://togithub.com/nuxt/nuxt/pull/27630)) - **nuxt:** Add `mergeProps` import in islands transform ([#27622](https://togithub.com/nuxt/nuxt/pull/27622)) - **nuxt:** Reset cookie timeoutLength after expiration ([#27632](https://togithub.com/nuxt/nuxt/pull/27632)) - **nuxt:** Add missing island uid for selective client components ([#27633](https://togithub.com/nuxt/nuxt/pull/27633)) - **schema,vite:** Respect `vite.cacheDir` if defined ([#27628](https://togithub.com/nuxt/nuxt/pull/27628)) - **nuxt:** Unregister hooks the moment `close` is called ([#27637](https://togithub.com/nuxt/nuxt/pull/27637)) - **nuxt:** Add missing script stubs ([#27640](https://togithub.com/nuxt/nuxt/pull/27640)) - **nuxt:** Only inject root path in prerender ([44cada95a](https://togithub.com/nuxt/nuxt/commit/44cada95a)) - **nuxt:** Reduce usage of cjs utilities ([#27642](https://togithub.com/nuxt/nuxt/pull/27642)) - **nuxt:** Add `/` even if pages module isn't enabled ([dabcb5ecc](https://togithub.com/nuxt/nuxt/commit/dabcb5ecc)) ##### ๐ Documentation - Add warning about bridge migration with `head` ([#27575](https://togithub.com/nuxt/nuxt/pull/27575)) - Update compatibility example ([4b28d2628](https://togithub.com/nuxt/nuxt/commit/4b28d2628)) - Document new `clear()` function added in 3.11 ([#27615](https://togithub.com/nuxt/nuxt/pull/27615)) - String vs object errors + accessing data of server-thrown errors ([#27398](https://togithub.com/nuxt/nuxt/pull/27398)) - Correct Cloudflare deployment recommendations ([#27641](https://togithub.com/nuxt/nuxt/pull/27641)) ##### ๐ก Chore - Add extra types for empty array definitions ([02945b9fa](https://togithub.com/nuxt/nuxt/commit/02945b9fa)) - Remove stub types file for `webpack-virtual-modules` ([58dd7f3a6](https://togithub.com/nuxt/nuxt/commit/58dd7f3a6)) - Lint ([cb77ddc30](https://togithub.com/nuxt/nuxt/commit/cb77ddc30)) ##### โ Tests - Add type test for nuxt module resolved types ([115fc2d18](https://togithub.com/nuxt/nuxt/commit/115fc2d18)) ##### ๐ค CI - Improve generated changelog ([d20266961](https://togithub.com/nuxt/nuxt/commit/d20266961)) ##### โค๏ธ Contributors - Daniel Roe ([@danielroe](https://togithub.com/danielroe)) - Julien Huang ([@huang-julien](https://togithub.com/huang-julien)) - Alexandru Ungureanu ([@unguul](https://togithub.com/unguul)) - Josh Dean ([@jdbdnz](https://togithub.com/jdbdnz)) - Yusuf Mansur รzer ([@ymansurozer](https://togithub.com/ymansurozer)) - Matteo Rigoni ([@Rigo-m](https://togithub.com/Rigo-m)) - Leo Osa ([@leoosa](https://togithub.com/leoosa)) - Levi (Nguyแป n Lฦฐฦกng Huy) ([@huynl-96](https://togithub.com/huynl-96)) - David Nahodyl ([@Smef](https://togithub.com/Smef)) - Michael Brevard ([@GalacticHypernova](https://togithub.com/GalacticHypernova)) - garthreckers ([@garthreckers](https://togithub.com/garthreckers)) - Valerii Strilets ([@letstri](https://togithub.com/letstri)) - Okuto Oyama ([@yamanoku](https://togithub.com/yamanoku)) - Harlan Wilton ([@harlan-zw](https://togithub.com/harlan-zw)) ### [`v3.12.1`](https://togithub.com/nuxt/nuxt/releases/tag/v3.12.1) [Compare Source](https://togithub.com/nuxt/nuxt/compare/v3.12.0...v3.12.1) > 3.12.1 is a hotfix release to address a typo in the nuxt/script stub auto-imports. #### ๐ Changelog [compare changes](https://togithub.com/nuxt/nuxt/compare/v3.12.0...v3.12.1) ##### ๐ฉน Fixes - **nuxt:** Update registry list for `@nuxt/scripts` ([0252000d7](https://togithub.com/nuxt/nuxt/commit/0252000d7)) ##### ๐ Refactors - **schema:** Use `CompatibilityDateSpec` ([#27521](https://togithub.com/nuxt/nuxt/pull/27521)) ##### ๐ Documentation - Update more references to v3.12 ([1d2eee00d](https://togithub.com/nuxt/nuxt/commit/1d2eee00d)) - Mention 3.12 for testing nuxt 4 ([#27525](https://togithub.com/nuxt/nuxt/pull/27525)) ##### ๐ก Chore - Fix release script ([7777f0564](https://togithub.com/nuxt/nuxt/commit/7777f0564)) - Lint ([24b8533e7](https://togithub.com/nuxt/nuxt/commit/24b8533e7)) - Bump `nuxi` dependency ([#27526](https://togithub.com/nuxt/nuxt/pull/27526)) ##### โ Tests - Update scrolling test ([52b85a886](https://togithub.com/nuxt/nuxt/commit/52b85a886)) ##### โค๏ธ Contributors - Daniel Roe ([@danielroe](https://togithub.com/danielroe)) - Pooya Parsa ([@pi0](https://togithub.com/pi0)) - Alexander Lichter ([@manniL](https://togithub.com/manniL)) ### [`v3.12.0`](https://togithub.com/nuxt/nuxt/releases/tag/v3.12.0) [Compare Source](https://togithub.com/nuxt/nuxt/compare/v3.11.2...v3.12.0) #### ๐ Highlights We're on the road to the release of Nuxt 4, but we've not held back in Nuxt v3.12. A huge thank you to the 75+ Nuxt contributors and community members who have been part of this release. โค๏ธ ##### ๐ Testing Nuxt 4 changes Nuxt 4 is on the horizon, and it's now possible to test out the behaviour changes that will be coming in the next major release ([#26925](https://togithub.com/nuxt/nuxt/pull/26925)) by setting an option in your `nuxt.config` file: ```ts export default defineNuxtConfig({ future: { compatibilityVersion: 4, }, }) ``` As we've been merging PRs for Nuxt 4, we've been enabling them behind this flag. As much as possible we're aiming for backwards compatibility - our test matrix is running the same fixtures in both v3 and v4 compatibility mode. There is a lot to say here, with 10+ different PRs and behaviour changes documented and testable, but for full details, including migration steps, see [the v4 upgrade documentation](https://nuxt.com/docs/getting-started/upgrade#testing-nuxt-4). We'd be very grateful for early testing of what's coming in Nuxt 4! ๐ ##### ๐ Nuxt Scripts auto-install We've been gradually working to release [Nuxt Scripts](https://scripts.nuxt.com/). It's currently in public preview, but we're near a public release, so we've added some stubs for composables that (when used) will prompt installing the `@nuxt/scripts` module. ๐ Watch out for the launch - and an article explaining more! ##### ๐ Layer auto-registration and bugfixes Just like `~/modules`, any layers within your project in the `~/layers` directory will now be automatically registered as layers in your project ([#27221](https://togithub.com/nuxt/nuxt/pull/27221)). We also now correctly load layer dependencies, which should resolve a range of issues with monorepos and git installations ([#27338](https://togithub.com/nuxt/nuxt/pull/27338)). ##### ๐ Built-in accessibility improvements We now have a built-in [`Configuration
๐ Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
๐ฆ Automerge: Enabled.
โป Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
๐ Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.