fix(deps): update root

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@antfu/eslint-config	1.0.0-beta.18 → 1.2.1
@nuxt/kit (source)	^3.7.4 → ^3.21.10
@nuxt/module-builder	^0.5.2 → ^0.8.4
@nuxt/schema (source)	^3.7.4 → ^3.21.10
@nuxt/test-utils	^3.7.4 → ^3.23.0
@vitejs/plugin-vue (source)	^4.4.0 → ^4.6.2
@vue-macros/volar (source)	^0.16.0 → ^0.30.15
@vue/test-utils	^2.4.1 → ^2.4.11
bumpp	^9.2.0 → ^9.11.1
defu	^6.1.2 → ^6.1.7
eslint (source)	8.50.0 → 8.57.1
plausible-tracker	^0.3.8 → ^0.3.9
typescript (source)	^5.2.2 → ^5.9.3
unconfig (source)	^0.3.11 → ^0.6.1
unplugin-vue-macros (source)	^2.6.1 → ^2.14.5
vite-plugin-dts (source)	^3.6.0 → ^3.9.1
vue (source)	^3.3.4 → ^3.5.40

---

Release Notes

antfu/eslint-config (@​antfu/eslint-config)

v1.2.1

Compare Source

   🐞 Bug Fixes

• Update @stylistic/eslint-plugin  -  by @​antfu (e71ec)

    View changes on GitHub

v1.2.0

Compare Source

   🚀 Features

• Use builtin config from stylistic  -  by @​antfu (a6f6a)

    View changes on GitHub

v1.1.4

Compare Source

   🐞 Bug Fixes

• Compactible with latest eslint-plugin-antfu  -  by @​antfu (c0700)

    View changes on GitHub

v1.1.3

Compare Source

   🚀 Features

• Add more ignores  -  by @​tomgao365 in #​321 (8d4da)
• Enable antfu/indent-binary-ops  -  by @​antfu (d36c4)

   🐞 Bug Fixes

• Turn off no-lone-blocks in markdown  -  by @​antfu (cce69)

    View changes on GitHub

v1.1.2

Compare Source

   🐞 Bug Fixes

• Release rules in some conditions  -  by @​antfu (718fc)

    View changes on GitHub

v1.1.1

Compare Source

   🚀 Features

• CLI for quick scaffolding  -  by @​injurka, ivan, Injurka and @​antfu in #​277 (2ee5a)

   🐞 Bug Fixes

• Disable import/newline-after-import in markdown  -  by @​antfu (23351)

    View changes on GitHub

v1.1.0

Compare Source

   🚨 Breaking Changes

• Move the optional sort-keys plugin to perfectionist, close #​295  -  by @​antfu in #​295 (9fa74)

   🐞 Bug Fixes

• Disable style/object-property-newline in favor of antfu/consistent-list-newline  -  by @​antfu (2f51b)

    View changes on GitHub

v1.0.0

Compare Source

Breaking Changes

• Use ESLint Flat config, users need to migrate to the new config style as well
• @antfu/eslint-config-* are packages all dropped, as @antfu/eslint-config provides much better composability now.
• @antfu/eslint-config-react is removed, but JSX formatting support is enabled by default now.
• ESLINT_TSCONFIG no longer works, use the typescript option in eslint.config.js instead
• Requires ESLint v8
• Rename plugin prefixes
  • @typescript-eslint/* -> ts/
  • n/* -> node/*
  • etc.

---

Generated changelog:

   🚨 Breaking Changes

• Use flat config  -  by @​antfu in #​250 (3ad62)
• New config factory instead of presets  -  by @​antfu (9ee68)
• Rename plugin prefixes for consistency  -  by @​antfu (f31a8)
• De-monorepo  -  by @​antfu (5c3ce)
• Use unified stylistic rules  -  by @​antfu (0ce3a)
• Make all configs function for consistency and immutability  -  by @​antfu (11e31)
• Rename typescriptWithLanguageServer to typescriptWithTypes  -  by @​antfu (ffe00)
• Set plugin alias of yml/ to yaml/  -  by @​antfu (917dd)
• Fix type aware rules, merge typescriptWithTypes to typescript  -  by @​antfu (3fae7)

   🚀 Features

• Ship types, and a combine util  -  by @​antfu (000a2)
• Make it side-effects free  -  by @​antfu (70fc8)
• Enable antfu/consistent-object-newline  -  by @​antfu (e3b3a)
• Support passing flat config to the first arg  -  by @​antfu (ce925)
• Support reading .gitignore by default, close #​254  -  by @​antfu in #​254 (2f35d)
• Expose globs  -  by @​antfu (05073)
• Support rules override, close #​255  -  by @​antfu in #​255 (39353)
• Granular stylistic control  -  by @​antfu (30c87)
• Add componentExts to top level config  -  by @​antfu (2080b)
• Add eslint-plugin-vitest  -  by @​antfu (002bb)
• Use ts parser even for JS, for better language compatibility  -  by @​antfu (e0757)
• Add name for each config item  -  by @​antfu (d4cfe)
• Update stylistic plugins  -  by @​antfu (9326e)
• Re-organize tsconfig sort  -  by @​antfu (1261b)
• Add style/jsx-quotes rule  -  by @​antfu (5291c)
• Ban declarations in ts file  -  by @​so1ve in #​264 (a76fd)
• Allow customize indent and quotes  -  by @​antfu (bbac1)
• Type support for rules  -  by @​antfu (44745)
• Add types for antfu/  -  by @​antfu (64e3f)
• Bring back reportUnusedDisableDirectives  -  by @​antfu (6320c)
• Enable basic jsx stylistic rules, close #​185  -  by @​antfu in #​185 (2dfb5)
• Enable no-import-type-side-effects, close #​227  -  by @​antfu in #​227 (cb4b7)
• Update jsx default config  -  by @​promise96319 and @​antfu in #​281 (987b9)
• Add optional sort-keys plugin  -  by @​antfu (f8ae1)
• Typescript.tsconfigPath array support  -  by @​rost-git and @​antfu in #​306 (54652)

   🐞 Bug Fixes

• Move stylistic files  -  by @​antfu (7070d)
• Stylistic overrides  -  by @​antfu (60746)
• Disable ts/no-invalid-void-type  -  by @​antfu (db397)
• Improve rules  -  by @​antfu (9ffcf)
• Ship cjs build as well  -  by @​antfu (f0b67)
• Disable comma-dangle in markdown  -  by @​antfu (34bbd)
• Install plugins globally for easy overrides  -  by @​antfu (6a72b)
• Remove jsdoc/no-types rule  -  by @​antfu (91dee)
• Disable type aware rules in markdown  -  by @​antfu (edb7f)
• Update style/quotes  -  by @​antfu (5f554)
• Allow Function type for ts/ban-types  -  by @​antfu (6a4cf)
• Disable few rules  -  by @​antfu (4da0b)
• Disable jsdoc/valid-types  -  by @​antfu (d1024)
• Ignores  -  by @​antfu (ae3e6)
• Add lockfile glob for bun  -  by @​rubiin in #​262 (7efac)
• Yaml indent  -  by @​so1ve in #​267 (757bb)
• Disable no-restricted-syntax in d.ts  -  by @​antfu (d98a8)
• Enforce name casing for unregistered components  -  by @​vaibhav11s in #​289 (ba704)
• Improve typescript options type  -  by @​antfu (8b5cb)
• Add default extraFileExtensions to type aware rules  -  by @​antfu (0a9bc)
• Prop names should always use camelCase during declaration.  -  by @​kaivanwong in #​293 (1c322)
• Use "source.fixAll.eslint" to avoid builtin autofixes dropping code  -  by @​Dimava in #​299 (33554)
• Remove no-void rule, close #​298  -  by @​antfu in #​298 (90b36)
• Revert #​289  -  by @​qin-guan in #​302 and #​289 (52b4f)
• jsonc: Indent config  -  by @​antfu (45e30)
• jsx: Turn off style/jsx-child-element-spacing to avoid conflicts  -  by @​antfu (f4a07)
• style/quotes: Disable avoidEscape for consistency  -  by @​antfu (47657)
• unicorn: Rename prefer-text-content -> `prefer-dom-node-text-c…  -  by @​coderwyd in #​271 (87282)

    View changes on GitHub

v1.0.0-beta.29

Compare Source

   🐞 Bug Fixes

• Prop names should always use camelCase during declaration.  -  by @​kaivanwong in #​293 (1c322)
• Use "source.fixAll.eslint" to avoid builtin autofixes dropping code  -  by @​Dimava in #​299 (33554)
• Remove no-void rule, close #​298  -  by @​antfu in #​298 (90b36)

    View changes on GitHub

v1.0.0-beta.28

Compare Source

   🐞 Bug Fixes

• Enforce name casing for unregistered components  -  by @​vaibhav11s in #​289 (ba704)
• Improve typescript options type  -  by @​antfu (8b5cb)
• Add default extraFileExtensions to type aware rules  -  by @​antfu (0a9bc)

    View changes on GitHub

v1.0.0-beta.27

Compare Source

   🚀 Features

• Add optional sort-keys plugin  -  by @​antfu (f8ae1)

    View changes on GitHub

v1.0.0-beta.26

Compare Source

   🐞 Bug Fixes

• jsx: Turn off style/jsx-child-element-spacing to avoid conflicts  -  by @​antfu (f4a07)

    View changes on GitHub

v1.0.0-beta.25

Compare Source

   🚀 Features

• Enable no-import-type-side-effects, close #​227  -  by @​antfu in #​227 (cb4b7)
• Update jsx default config  -  by @​promise96319 and @​antfu in #​281 (987b9)

    View changes on GitHub

v1.0.0-beta.24

Compare Source

   🚀 Features

• Enable basic jsx stylistic rules, close #​185  -  by @​antfu in #​185 (2dfb5)

    View changes on GitHub

v1.0.0-beta.22

Compare Source

   🚀 Features

• Type support for rules  -  by @​antfu (44745)

   🐞 Bug Fixes

• unicorn: Rename prefer-text-content -> `prefer-dom-node-text-c…  -  by @​coderwyd in #​271 (87282)

    View changes on GitHub

v1.0.0-beta.21

Compare Source

   🐞 Bug Fixes

• Yaml indent  -  by @​so1ve in #​267 (757bb)
• Disable no-restricted-syntax in d.ts  -  by @​antfu (d98a8)

    View changes on GitHub

v1.0.0-beta.19

Compare Source

   🚀 Features

• Re-organize tsconfig sort  -  by @​antfu (1261b)
• Add style/jsx-quotes rule  -  by @​antfu (5291c)
• Ban declarations in ts file  -  by @​so1ve in #​264 (a76fd)
• Allow customize indent and quotes  -  by @​antfu (bbac1)

   🐞 Bug Fixes

• Add lockfile glob for bun  -  by @​rubiin in #​262 (7efac)
• style/quotes: Disable avoidEscape for consistency  -  by @​antfu (47657)

    View changes on GitHub

nuxt/nuxt (@​nuxt/kit)

v3.21.10

Compare Source

⚠️ This is a security release. We recommend upgrading as soon as possible with npx nuxt upgrade --dedupe.

It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.

If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.

Full details: Nuxt Security Patch Releases and GitHub Security Advisories.

👉 Changelog

compare changes

🩹 Fixes

• nuxt: Clear hide/reset timeouts in set() (#​35534)
• nuxt: Preserve trailing slash in NuxtLink href when unset (#​35501)
• vite: Resolve SSR inlined CSS module class name mismatch (#​35610)
• nuxt: Sync layout meta during middleware on SSR (#​35633)
• nuxt: Update client URL to match SSR on fatal middleware error (#​35637)
• nuxt: Watch external component directories in development (#​35652)
• nuxt: Don't cross-pollute useAsyncData cache on reactive key change (#​35656)
• nuxt: Return global route for useRoute in detached effect scope (#​35659)
• nuxt: Ignore custom name or path when reusing an existing page in pages:extend (#​35661)
• nuxt: Preserve explicit useFetch method inference (#​35671)
• nuxt: Correct default export detection in plugin metadata (#​35676)
• nuxt: Reload real page module on HMR of JSX render-function pages (#​35678)
• vite: Ensure server sourcemap-preserver plugin actually runs (#​35680)
• nuxt: Resolve @unhead/vue/* from nuxt's dependency tree (#​35690)
• nuxt: Don't apply scroll behaviour after a subsequent nav (#​35719)
• vite: Preserve css suffix when extracting ssr inline styles (#​35714)
• nuxt: Don't exclude client entry module from style extraction (#​35720)
• kit: Avoid mutating layer configs when resolving options (#​35729)
• nuxt: Generate layout types even when pages module is disabled (#​35717)
• nitro: Skip resource hints for stylesheets already rendered as blocking links (#​35691)
• nuxt: Revalidate cached route payloads instead of using force-cache (#​35672)
• nuxt: Preserve query params in cached payload extraction (#​35696)
• rspack,webpack: Resolve loaders and runtime deps from nuxt dirs (#​35568)
• nuxt: Render client components in nested server components (#​35669)
• nuxt: Remove dev error overlay when error is cleared (#​35821)
• rspack,webpack: Resolve bundled postcss defaults from builder (#​35823)
• schema: Normalise slashes in app.buildAssetsDir (#​35833)
• nuxt: Case-fold route rule keys to match folded lookups (619963309)
• nitro: Require loopback peer for chrome devtools workspace endpoint (00f71bb65)
• nitro: Bound island props and v-for to prevent unauthenticated DoS (668cdfdfd)
• nuxt: Reject reserved template island prop under runtime compiler (5b60017f7)
• nuxt: Reject top-level as prop for islands (00a2b0494)

📖 Documentation

• Document relative baseURL workarounds (#​34004)
• Warn about runtimeCompiler security best practices (b76c1a8bd)
• Warn about validating server component props (f6d72628d)

✅ Tests

• Guard against transient undefined _route in gotoPath (5391e7e6a)
• Raise route-HMR polling timeout to reduce e2e flakiness (cbc757c63)
• kit: Scope loadNuxt temp dir so it doesn't delete sibling fixtures (72e4b5578)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Florian Heuberger (@​Flo0806)
• Matej Černý (@​cernymatej)
• bdbch (@​bdbch)
• Elecmonkey (@​elecmonkey)
• Ryota Watanabe (@​wattanx)
• kealan (@​KealanAU)
• Julien Huang (@​huang-julien)
• Luke Nelson (@​luc122c)
• Harlan Wilton (@​harlan-zw)
• Mateleo (@​Mateleo)
• lutejka (@​lutejka)
• Darlan José Batista do Prado (@​DarlanPrado)
• Max (@​onmax)
• Sushant (@​sushantguri)
• raminjafary (@​raminjafary)

v3.21.9

Compare Source

3.21.9 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes

• vite: Use spa entry for vite-node fallback (3.x) (c8410a16a)
• kit,nuxt: Pass error as cause when we re-throw (#​35387)
• vite: Inline CSS for lazy components imported from #components (#​35215)
• nuxt: Validate <ClientOnly> fallback tag name (#​35325)
• vite: Extract server page CSS when inlineStyles is disabled (#​35209)
• nitro: Include nested layers in nitro transforms (#​35327)
• nitro: Export empty styles object with ssr: false (#​35330)
• nuxt: Emit auto-import paths as files, not directories (#​35333)
• nuxt: Suppress spurious slot warning in NuxtPage during nav (#​35335)
• vite: Preserve backslash separators in windows named pipe path (#​35336)
• nuxt: Detach in-flight promise on useAsyncData teardown (#​35328)
• nuxt: Respect per-page keepalive set via definePageMeta (#​34526)
• nuxt: Align useFetch error type with runtime (#​35346)
• nuxt: Unwrap getter body in useFetch (#​35343)
• rspack,webpack: Strip invalid webpack PURE annotations (#​35386)
• nuxt: Guard against -1 when unregistering a router hook (#​35391)
• nuxt: Clean up load/error listeners in preloadPayload (#​35392)
• nuxt: Avoid idle wait when refreshing data after hydration (#​35358)
• nuxt: Ensure page:start finishes before page:finish starts (#​35408)
• nuxt: Preserve plugin navigation during app boot (#​35344)
• vite: Add extension to vite-node-runner virtual import (e81a0c484)
• nuxt: Make virtual module IDs stable across hosts (#​35317)
• nuxt: Hash serialized island props (#​35356)
• vite: Avoid emitted ssr styles file name collisions (#​35432)
• nuxt: Avoid syncing route too early when reused page remounts (#​35440)
• nuxt: Keep nested layout on deferred route during suspended layout switch (#​35443)
• vite: Set define for NODE_ENV and __VUE_PROD_DEVTOOLS__ (#​35444)
• nuxt: Restore deferred query route before page is mounted (#​35442)
• nuxt: Make islands hash backwards-compatible (#​35452)
• nuxt: Pass nuxt rootDir to typed-router context (#​35565)
• nitro: Only reload nitro after initial nitro build (6ba8e26a5)
• schema: Enable HMR for defineNuxtComponent in JSX (#​35620)
• schema: Resolve Vite cache directory from workspace (#​35626)
• nitro: Write prerender cache files atomically (#​35619)
• nuxt: Apply latest navigation on concurrent navigateTo in built-in router (#​35631)

📖 Documentation

• Improving testing documentation for better understanding (#​35526)
• Add tip about prerendering registration for pages (#​35635)
• Clarify useFetch custom data error (#​35647)
• Drop reference to non-existent section (bd1943d04)
• Update link to /3.x slug (71bdb972d)

🏡 Chore

• Allow node version updates (#​35297)

✅ Tests

• Assert dev css delivery transport for server pages (9851e993b)
• Count only render-blocking stylesheet links for page styles (b0e895a7f)
• Await expectNoClientErrors (afffe7f09)

🤖 CI

• Handle missing base branch (for stacked prs) (13a933f8a)
• Unlink issues from autoclosed PRs (#​35615)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Florian Heuberger (@​Flo0806)
• Mateleo (@​Mateleo)
• Luke Nelson (@​luc122c)
• Darlan José Batista do Prado (@​DarlanPrado)
• Julien Huang (@​huang-julien)
• skoenfaelt (@​skoenfaelt)
• Anoesj Sadraee (@​Anoesj)
• raminjafary (@​raminjafary)
• Kurt Medley (@​HeavyMedl)
• isksss (@​isksss)
• Alexander Lichter (@​TheAlexLichter)
• Damian Głowala (@​DamianGlowala)
• Sami El Achi (@​samiashi)

v3.21.8

Compare Source

3.21.8 is a hotfix release to address an issue running the dev server on MacOS.

👉 Changelog

compare changes

🩹 Fixes

• vite: Shorter socket name for macOs with tmp fallback (#​35265)
• kit: Respect type option in findPath (#​35272)
• deps: Update nuxt/scripts presets (ff6b060dd)

📖 Documentation

• Change null to undefined in data-fetching docs to match actual types (#​35301)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Ali Mahmmoud (@​AliMahmoudDev)
• Quentin Macq (@​quentinmcq)
• Eduardo San Martin Morote (@​posva)

v3.21.7

Compare Source

3.21.7 is the a security hotfix release.

👉 make sure to check https://github.com/nuxt/nuxt/security/advisories to view open advisories resolved by this release.

👉 Changelog

compare changes

🩹 Fixes

• nitro: Assign noSSR before deciding payload extraction (#​35108)
• vite: Avoid filtering out dirs with shared prefix from allowDirs (#​35112)
• nuxt: Use resolve from pathe for buildCache path boundary check (#​35111)
• nuxt: Prevent sibling-directory traversal in test component wrapper (#​35110)
• nitro: Pass event data to isValid in dev clipboard-copy listener (#​35109)
• nuxt: Validate protocols in reloadNuxtApp path before reload (#​35115)
• vite: Resolve vite clientServer with ssr: false (#​34959)
• vite: Prefix public asset virtuals with null byte (38d330179)
• nuxt: Handle missing payload in chunkError listener (#​35155)
• vite: Close vite dev server on nuxt close (d007d7060)
• kit,nuxt: Handle cancelling prompts to install packages (59821a5ca)
• nuxt: Await in-lifght template generation when closing nuxt (#​35181)
• webpack: Surface compilation errors when stats.toString is empty (71dccff2b)
• kit: Improve TS extension stripping/substitutions (#​35233)
• nuxt: Preserve .d.mts/.d.cts in resolveTypePaths (#​35235)
• nuxt: Reject prototype-chain keys in the island registry (#​35205)
• nitro: Gate chrome devtools workspace endpoint to local requests (#​35201)
• nuxt: Escape props in <NuxtClientFallback> ssr output (#​35199)
• nuxt: Apply isScriptProtocol guard to navigateTo open option (#​35206)
• rspack,webpack: Require loopback host when missing same-origin signals (#​35200)
• nuxt: Absolutely resolve defu in app config template (40bedf0db)
• nuxt: Match route rules case-insensitively to mirror vue-router (3f3e3fa7b)
• nuxt: Escape <NoScript> slot content (7fea9fd68)
• nuxt: Block path-normalization open redirect in navigateTo (1f2dd5e78)
• nuxt: Reject cross-origin paths in reloadNuxtApp (6497d99dd)
• vite: Bind vite-node IPC to a permissioned filesystem socket (c293bf950)
• nuxt: Reject script-capable protocols in <NuxtLink> href (53284043d)
• nuxt: Clarify page and layout usage warnings (#​35184)
• nuxt: Do not absolutely resolve defu (d11d7b1b5)

📖 Documentation

• Edit for clarity and grammar (#​35214)
• Add dedicated module dependencies page (#​35171)

🏡 Chore

• Use execFileSync for safety in release scripts (9a455a658)
• Assert there is always a tag (8da21fba8)
• Fix type in test (bc2837125)
• Fix lychee dynamic composable exclude (#​35119)
• Add autofix action tag in comment (70eba297f)
• Update renovate minimum release age (27a6821a1)

✅ Tests

• Update test for js payload rendering (b51a80840)
• Improve reliability of hmr test (0078499f0)

🤖 CI

• Always run all tests for 4.x/3.x (0519c0ade)
• Update to agentscan v1.8.0 (#​35120)
• Automatically close PRs from automated accounts (#​35161)
• Migrate from tibdex (6277aedcb)
• Disable provenance-change enforcement in dependency-review (1d4910eed)
• Add zizmor github actions check (#​35089)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Matej Černý (@​cernymatej)
• anton-gor-dev (@​anton-gor-dev)
• Julien Huang (@​huang-julien)
• David Stack ([@​davidstackio](https://redirect.

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every 8 months on the first day of the month"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.