fix(deps): update root

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@antfu/eslint-config	2.10.0 → 2.27.3
@nuxt/kit (source)	^3.11.1 → ^3.21.10
@nuxt/module-builder	^0.5.5 → ^0.8.4
@nuxt/schema (source)	^3.11.1 → ^3.21.10
@nuxt/test-utils	^3.12.0 → ^3.23.0
@types/node (source)	^20.11.30 → ^20.19.43
@vitejs/plugin-vue (source)	^5.0.4 → ^5.2.4
@vitest/coverage-v8 (source)	^1.4.0 → ^1.6.1
bumpp	^9.4.0 → ^9.11.1
eslint (source)	^8.57.0 → ^8.57.1
lint-staged	^15.2.2 → ^15.5.2
playwright-core (source)	^1.42.1 → ^1.62.1
simple-git-hooks	^2.11.1 → ^2.13.1
typescript (source)	^5.4.3 → ^5.9.3
unconfig (source)	^0.3.11 → ^0.6.1
unplugin-vue-macros (source)	^2.7.13 → ^2.14.5
vue (source)	^3.4.21 → ^3.5.40

---

Release Notes

antfu/eslint-config (@​antfu/eslint-config)

v2.27.3

Compare Source

   🐞 Bug Fixes

• Upgrade eslint-plugin-import-x  -  by @​antfu (6a224)

    View changes on GitHub

v2.27.2

Compare Source

   🚀 Features

• Formatters support SVG  -  by @​yunsii and @​antfu in #​591 (12718)

   🐞 Bug Fixes

• Use fork of eslint-plugin-import-x  -  by @​antfu (78d52)

    View changes on GitHub

v2.27.1

Compare Source

   🐞 Bug Fixes

• Override type-aware rules properly  -  by @​ryoppippi and @​antfu in #​585 (35f67)

    View changes on GitHub

v2.27.0

Compare Source

   🚀 Features

• Print hint message when running in editor  -  by @​antfu (c6210)

   🐞 Bug Fixes

• isInEditorEnv should be false when in git hooks, close #​589  -  by @​antfu in #​589 (b60bf)

    View changes on GitHub

v2.26.1

Compare Source

No significant changes

    View changes on GitHub

v2.26.0

Compare Source

   🐞 Bug Fixes

• ignoresTypeAware reslove, fix #​578  -  by @​antfu in #​578 (e5ca2)
• Check packages existence in local scope  -  by @​paescuj and @​antfu in #​583 (12fd8)

    View changes on GitHub

v2.25.2

Compare Source

   🐞 Bug Fixes

• Migrate plugin eslint-comments  -  by @​ntnyq in #​577 (015e2)

    View changes on GitHub

v2.25.1

Compare Source

   🐞 Bug Fixes

• Migrate to new vitest plugin, close #​576  -  by @​antfu in #​576 (5e465)

    View changes on GitHub

v2.25.0

Compare Source

   🐞 Bug Fixes

• Default prettier printWidth: 120 not work as expected  -  by @​HADB in #​573 (8942c)

    View changes on GitHub

v2.24.1

Compare Source

   🚀 Features

• Upgrade @typescript-eslint to v8 stable  -  by @​antfu (572b0)

    View changes on GitHub

v2.24.0

Compare Source

   🚀 Features

• Upgrade @types/eslint  -  by @​antfu (1bf41)

    View changes on GitHub

v2.23.2

Compare Source

No significant changes

    View changes on GitHub

v2.23.1

Compare Source

   🐞 Bug Fixes

• Remove deprecated 'ts/prefer-ts-expect-error' rule  -  by @​andylou0102 and AndyLuo in #​549 (22517)
• Delete svelte/valid-compile rule from eslint-plugin-svelte  -  by @​ryoppippi in #​552 (6e6cd)
• Use fixable: true  -  by @​hyoban in #​554 (9d53b)

    View changes on GitHub

v2.23.0

Compare Source

   🚀 Features

• Introduce type options, enable ts/explicit-function-return-type for lib  -  by @​antfu (3dd7b)

   🐞 Bug Fixes

• Enable eslint-config-flat-gitignore even if .gitignore is not in cwd  -  by @​lachlancollins in #​547 (c118b)
• Use a fork of eslint-plugin-unused-imports  -  by @​antfu (79442)

    View changes on GitHub

v2.22.4

Compare Source

   🐞 Bug Fixes

• typescript: Remove string[] from tsconfigPath as not supported in v8  -  by @​RayGuo-ergou in #​545 (8c9e3)

    View changes on GitHub

v2.22.3

Compare Source

   🐞 Bug Fixes

• Add .svelte-kit to ignored paths  -  by @​lachlancollins in #​542 (94fd0)
• TsconifgPath configuration  -  by @​vaiil in #​541 (e1a9d)

    View changes on GitHub

v2.22.2

Compare Source

   🚀 Features

• Add isolatedDeclarations into the order array  -  by @​LoTwT in #​537 (80597)

   🐞 Bug Fixes

• typescript: Allow description for ts-expect-error in `ban-ts-c…  -  by @​kevinmarrec and @​antfu in #​517 (bf7a5)

    View changes on GitHub

v2.22.1

Compare Source

No significant changes

    View changes on GitHub

v2.22.0

Compare Source

   🚀 Features

• Use ts-eslint beta  -  by @​antfu in #​520 (c29ac)
• Add name to ignore config  -  by @​antfu (48bcd)

   🐞 Bug Fixes

• Relax ts/no-empty-object-type rule  -  by @​antfu (692e7)
• Disable ts/no-unused-expressions in markdown  -  by @​antfu (64894)
• Avoid using name in ignores  -  by @​antfu (d7b06)

    View changes on GitHub

v2.21.3

Compare Source

No significant changes

    View changes on GitHub

v2.21.2

Compare Source

   🚀 Features

• Add nvim support for isInEditor  -  by @​ryoppippi in #​507 (8f992)
• typescript:
  • Add 'ts/return-await' rule  -  by @​ryoppippi in #​509 (498cb)
  • Add ts/switch-exhaustiveness-check rule  -  by @​ryoppippi in #​508 (33c63)
  • Add 'ts/promise-function-async' to type aware rule  -  by @​ryoppippi in #​511 (e7cd2)

   🐞 Bug Fixes

• Peer dependency version of svelte-eslint-parser  -  by @​thenbe in #​504 (435e1)
• Ignore vite timestamp file  -  by @​CofCat456 in #​515 (8f36c)

    View changes on GitHub

v2.21.1

Compare Source

   🚀 Features

• Add 'contributors' to sort  -  by @​christopher-buss in #​500 and #​501 (6cde4)

   🐞 Bug Fixes

• Option glob pattern for .d.mts  -  by @​antfu (a2ca9)

    View changes on GitHub

v2.21.0

Compare Source

   🐞 Bug Fixes

• Only enable ts rules for ts files, fix #​498  -  by @​antfu in #​498 (87142)
• Include .d.mts and .d.cts  -  by @​antfu (0582c)
• Disbale type-aware in astro, handle formatter overrides with stylistic  -  by @​tinchoz49 and @​antfu in #​493 (e3230)
• Include .jsx files when the options set to true  -  by @​antfu (96aff)

    View changes on GitHub

v2.20.0

Compare Source

   🚀 Features

• Update astro plugin to v1.0  -  by @​tinchoz49 and @​antfu in #​492 (49a9d)

    View changes on GitHub

v2.19.2

Compare Source

   🚀 Features

• typescript: Add strict-boolean-expressions rule  -  by @​ryoppippi in #​490 (c0426)

   🐞 Bug Fixes

• TsconfigPath undefined  -  by @​tinchoz49 in #​491 (8c473)

    View changes on GitHub

v2.19.1

Compare Source

   🚀 Features

• Add jsx support in react without config.  -  by @​eastonzh in #​481 (87af9)
• cli: Add validation for CSS-related files  -  by @​pudon in #​478 (6ada3)

    View changes on GitHub

v2.19.0

Compare Source

   🚀 Features

• Update plugins  -  by @​antfu (56cde)
• Use antfu/curly to replace curly  -  by @​antfu (42a90)

    View changes on GitHub

v2.18.1

Compare Source

   🚀 Features

• Update plugins  -  by @​antfu (5071f)

    View changes on GitHub

v2.18.0

Compare Source

   🚀 Features

• Add regexp plugin and enable by default  -  by @​antfu (1e189)
• Support xml  -  by @​zanfee and @​antfu in #​472 (19b4e)

    View changes on GitHub

v2.17.0

Compare Source

   🚀 Features

• Update stylistic and ts-eslint  -  by @​antfu (25c11)

    View changes on GitHub

v2.16.4

Compare Source

No significant changes

    View changes on GitHub

v2.16.3

Compare Source

   🚀 Features

• Update deps  -  by @​antfu (1a25b)

    View changes on GitHub

v2.16.2

Compare Source

No significant changes

    View changes on GitHub

v2.16.1

Compare Source

   🐞 Bug Fixes

• Lock ts-eslint to 7.7 for now  -  by @​antfu (844ff)

    View changes on GitHub

v2.16.0

Compare Source

   🚀 Features

• Add eslint-plugin-command  -  by @​antfu (20ea2)

   🐞 Bug Fixes

• react: Improve option for react-refresh, aware Remix and Next.js  -  by @​antfu and @​hyoban in #​461 (24d4f)

    View changes on GitHub

v2.15.0

Compare Source

   🚨 Breaking Changes

• Migrate from eslint-plugin-react to eslint react  -  by @​hyoban in #​453 (86a74)

    View changes on GitHub

v2.14.0

Compare Source

   🚀 Features

• Support lessOpinionated option  -  by @​antfu (4b87c)

    View changes on GitHub

v2.13.4

Compare Source

   🚀 Features

• Improve types support  -  by @​antfu (6a7df)
• svelte: Add support for typing according to sveltejs/rfcs#38  -  by @​kelvindecosta in #​450 and #​38 (e0752)

   🐞 Bug Fixes

• File pattern for htm files  -  by @​Bernankez in #​447 (b6e9a)

    View changes on GitHub

v2.13.3

Compare Source

   🐞 Bug Fixes

• Don't create new test plugin for every run  -  by @​antfu (2bc6f)

    View changes on GitHub

v2.13.2

Compare Source

   🐞 Bug Fixes

• Typegen  -  by @​antfu (47e4a)

    View changes on GitHub

v2.13.1

Compare Source

   🚀 Features

• Improve no-unused-vars options  -  by @​antfu (1e091)
• Update deps  -  by @​antfu (48660)

    View changes on GitHub

v2.13.0

Compare Source

   🚀 Features

• Support solid.js  -  by @​subframe7536 and @​antfu in #​441 (64061)

    View changes on GitHub

v2.12.2

Compare Source

   🚀 Features

• Try inspector build  -  by @​antfu (72a2c)

    View changes on GitHub

v2.12.1

Compare Source

   🐞 Bug Fixes

• Move no-new-symbol to no-new-native-nonconstructor  -  by @​antfu (a278b)

    View changes on GitHub

v2.12.0

Compare Source

   🚀 Features

• Update names for all config items  -  by @​antfu (9de13)

    View changes on GitHub

v2.11.6

Compare Source

   🚀 Features

• Generate types for core rules as well, resolve #​439  -  by @​antfu in #​439 (5ab92)

    View changes on GitHub

v2.11.5

Compare Source

   🐞 Bug Fixes

• Consistent on config names  -  by @​antfu (cb509)

    View changes on GitHub

v2.11.4

Compare Source

   🐞 Bug Fixes

• Lower peer-deps requirement to eslint-plugin-svelte, fix #​437  -  by @​antfu in #​437 (0b364)
• cli: Make frameworks not required  -  by @​antfu (914bf)

    View changes on GitHub

v2.11.3

Compare Source

   🚀 Features

• More relax types for merging  -  by @​antfu (ac1b7)

    View changes on GitHub

v2.11.2

Compare Source

No significant changes

    View changes on GitHub

v2.11.1

Compare Source

   🚀 Features

• Improve types  -  by @​antfu (445aa)

    View changes on GitHub

v2.11.0

Compare Source

   🚀 Features

• Improve types for rules  -  by @​antfu (4ff20)

    View changes on GitHub

v2.10.1

Compare Source

No significant changes

    View changes on GitHub

nuxt/nuxt (@​nuxt/kit)

v3.21.10

Compare Source

⚠️ This is a security release. We recommend upgrading as soon as possible with npx nuxt upgrade --dedupe.

It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.

If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.

Full details: Nuxt Security Patch Releases and GitHub Security Advisories.

👉 Changelog

compare changes

🩹 Fixes

• nuxt: Clear hide/reset timeouts in set() (#​35534)
• nuxt: Preserve trailing slash in NuxtLink href when unset (#​35501)
• vite: Resolve SSR inlined CSS module class name mismatch (#​35610)
• nuxt: Sync layout meta during middleware on SSR (#​35633)
• nuxt: Update client URL to match SSR on fatal middleware error (#​35637)
• nuxt: Watch external component directories in development (#​35652)
• nuxt: Don't cross-pollute useAsyncData cache on reactive key change (#​35656)
• nuxt: Return global route for useRoute in detached effect scope (#​35659)
• nuxt: Ignore custom name or path when reusing an existing page in pages:extend (#​35661)
• nuxt: Preserve explicit useFetch method inference (#​35671)
• nuxt: Correct default export detection in plugin metadata (#​35676)
• nuxt: Reload real page module on HMR of JSX render-function pages (#​35678)
• vite: Ensure server sourcemap-preserver plugin actually runs (#​35680)
• nuxt: Resolve @unhead/vue/* from nuxt's dependency tree (#​35690)
• nuxt: Don't apply scroll behaviour after a subsequent nav (#​35719)
• vite: Preserve css suffix when extracting ssr inline styles (#​35714)
• nuxt: Don't exclude client entry module from style extraction (#​35720)
• kit: Avoid mutating layer configs when resolving options (#​35729)
• nuxt: Generate layout types even when pages module is disabled (#​35717)
• nitro: Skip resource hints for stylesheets already rendered as blocking links (#​35691)
• nuxt: Revalidate cached route payloads instead of using force-cache (#​35672)
• nuxt: Preserve query params in cached payload extraction (#​35696)
• rspack,webpack: Resolve loaders and runtime deps from nuxt dirs (#​35568)
• nuxt: Render client components in nested server components (#​35669)
• nuxt: Remove dev error overlay when error is cleared (#​35821)
• rspack,webpack: Resolve bundled postcss defaults from builder (#​35823)
• schema: Normalise slashes in app.buildAssetsDir (#​35833)
• nuxt: Case-fold route rule keys to match folded lookups (619963309)
• nitro: Require loopback peer for chrome devtools workspace endpoint (00f71bb65)
• nitro: Bound island props and v-for to prevent unauthenticated DoS (668cdfdfd)
• nuxt: Reject reserved template island prop under runtime compiler (5b60017f7)
• nuxt: Reject top-level as prop for islands (00a2b0494)

📖 Documentation

• Document relative baseURL workarounds (#​34004)
• Warn about runtimeCompiler security best practices (b76c1a8bd)
• Warn about validating server component props (f6d72628d)

✅ Tests

• Guard against transient undefined _route in gotoPath (5391e7e6a)
• Raise route-HMR polling timeout to reduce e2e flakiness (cbc757c63)
• kit: Scope loadNuxt temp dir so it doesn't delete sibling fixtures (72e4b5578)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Florian Heuberger (@​Flo0806)
• Matej Černý (@​cernymatej)
• bdbch (@​bdbch)
• Elecmonkey (@​elecmonkey)
• Ryota Watanabe (@​wattanx)
• kealan (@​KealanAU)
• Julien Huang (@​huang-julien)
• Luke Nelson (@​luc122c)
• Harlan Wilton (@​harlan-zw)
• Mateleo (@​Mateleo)
• lutejka (@​lutejka)
• Darlan José Batista do Prado (@​DarlanPrado)
• Max (@​onmax)
• Sushant (@​sushantguri)
• raminjafary (@​raminjafary)

v3.21.9

Compare Source

3.21.9 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes

• vite: Use spa entry for vite-node fallback (3.x) (c8410a16a)
• kit,nuxt: Pass error as cause when we re-throw (#​35387)
• vite: Inline CSS for lazy components imported from #components (#​35215)
• nuxt: Validate <ClientOnly> fallback tag name (#​35325)
• vite: Extract server page CSS when inlineStyles is disabled (#​35209)
• nitro: Include nested layers in nitro transforms (#​35327)
• nitro: Export empty styles object with ssr: false (#​35330)
• nuxt: Emit auto-import paths as files, not directories (#​35333)
• nuxt: Suppress spurious slot warning in NuxtPage during nav (#​35335)
• vite: Preserve backslash separators in windows named pipe path (#​35336)
• nuxt: Detach in-flight promise on useAsyncData teardown (#​35328)
• nuxt: Respect per-page keepalive set via definePageMeta (#​34526)
• nuxt: Align useFetch error type with runtime (#​35346)
• nuxt: Unwrap getter body in useFetch (#​35343)
• rspack,webpack: Strip invalid webpack PURE annotations (#​35386)
• nuxt: Guard against -1 when unregistering a router hook (#​35391)
• nuxt: Clean up load/error listeners in preloadPayload (#​35392)
• nuxt: Avoid idle wait when refreshing data after hydration (#​35358)
• nuxt: Ensure page:start finishes before page:finish starts (#​35408)
• nuxt: Preserve plugin navigation during app boot (#​35344)
• vite: Add extension to vite-node-runner virtual import (e81a0c484)
• nuxt: Make virtual module IDs stable across hosts (#​35317)
• nuxt: Hash serialized island props (#​35356)
• vite: Avoid emitted ssr styles file name collisions (#​35432)
• nuxt: Avoid syncing route too early when reused page remounts (#​35440)
• nuxt: Keep nested layout on deferred route during suspended layout switch (#​35443)
• vite: Set define for NODE_ENV and __VUE_PROD_DEVTOOLS__ (#​35444)
• nuxt: Restore deferred query route before page is mounted (#​35442)
• nuxt: Make islands hash backwards-compatible (#​35452)
• nuxt: Pass nuxt rootDir to typed-router context (#​35565)
• nitro: Only reload nitro after initial nitro build (6ba8e26a5)
• schema: Enable HMR for defineNuxtComponent in JSX (#​35620)
• schema: Resolve Vite cache directory from workspace (#​35626)
• nitro: Write prerender cache files atomically (#​35619)
• nuxt: Apply latest navigation on concurrent navigateTo in built-in router (#​35631)

📖 Documentation

• Improving testing documentation for better understanding (#​35526)
• Add tip about prerendering registration for pages (#​35635)
• Clarify useFetch custom data error (#​35647)
• Drop reference to non-existent section (bd1943d04)
• Update link to /3.x slug (71bdb972d)

🏡 Chore

• Allow node version updates (#​35297)

✅ Tests

• Assert dev css delivery transport for server pages (9851e993b)
• Count only render-blocking stylesheet links for page styles (b0e895a7f)
• Await expectNoClientErrors (afffe7f09)

🤖 CI

• Handle missing base branch (for stacked prs) (13a933f8a)
• Unlink issues from autoclosed PRs (#​35615)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Florian Heuberger (@​Flo0806)
• Mateleo (@​Mateleo)
• Luke Nelson (@​luc122c)
• Darlan José Batista do Prado (@​DarlanPrado)
• Julien Huang (@​huang-julien)
• skoenfaelt (@​skoenfaelt)
• Anoesj Sadraee (@​Anoesj)
• raminjafary ([@​raminjafary](https://redirect.github.com/ramin

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every 8 months on the first day of the month"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.