chore(deps): update dependency nuxt to v4.6.4 #3135

2026-11-05T22:02:53Z

renovate commented

2026-11-05 22:02:53 +00:00

This PR contains the following updates:

Package	Change	Age	Confidence
nuxt (source)	`4.6.3` → `4.6.4`

Release Notes

nuxt/nuxt (nuxt)

`v4.6.4`

Compare Source

4.6.4 is a security release. It fixes eight advisories in Nuxt and pulls in nitropack 2.13.6, which fixes three more in Nitro. We recommend upgrading as soon as you can.

⚠️ Behaviour changes

These probably won't affect most apps, but it's worth flagging anyway:

Error details in production. When a page fails to render on the server, the error page and the payload now only carry message and data of errors you create with createError. Everything else is stripped.
Dev server Host checks. Webpack and rspack dev servers now reject requests with an unexpected Host header, as Vite already does. If you use a custom hostname or tunnel, you'll need to add it to the new devServer.allowedHosts option.
workspaceDir detection. When workspaceDir isn't set, Nuxt now only widens it past rootDir to an explicit workspace root or the closest git repository.
Nitropack cached routes. cache, swr and isr route rules now only cache GET and HEAD requests, and no longer store responses that set a cookie or send Cache-Control: private or no-store. Wildcard proxy and redirect rules also reject requests whose resolved target would leave the rule's scope.
Route rules and encoded slashes. Route rules now match paths that contain encoded slashes, so /api%2Fadmin is covered by a /api/** rule.

👉 Changelog

compare changes

🩹 Fixes

nitro,nuxt: require unrouting 0.3.2 (768d21368)
nitro: preserve wildcard tails in case-insensitive route rules (bf31e4cd8)
nitro: require nitropack 2.13.6 (1b13c6981)
nitro: keep leading double slash in renderer request path (75c12c6fb)
nuxt: use unambiguous encoding for island hash (6f1b93c64)
vite-server: resolve wildcard redirect tails from the matched segments (1e7dfa6a7)
nuxt: do not expose details of untrusted thrown errors (8c56b71e4)
nuxt: strip trailing slashes in linear time (97424dd21)
nitro,webpack: include hosts the CLI allows after loading the config (8c11d965d)
webpack: skip hot middleware for forbidden dev requests (3c9645326)
rspack,webpack: reject unexpected Host headers in dev middleware (f8d64c9aa)
schema,nitro,vite: add devServer.allowedHosts (3e1c7964e)
nitro,nuxt: match route rules for paths with encoded slashes (084396b10)
schema: only widen workspace dir to a declared workspace root (89d3306d1)
nitro: only trust x-forwarded-proto in when opted-in (#36818)
nitro: stream the body read through a nuxt/server handler (#36817)
kit: suggest the specific fix when loading falls back to jiti (24d75659d)
vite: use a single type checker (#36774)
nitro,vite: remove windows + virtual dev ssr css links after hydration (#36765)
nitro,vite: dedupe dev css by module node (#36420)
nuxt: avoid hoisting setup-only values from definePageMeta (#36751)
nuxt: only match hydration modifiers after lazy prefix (#36750)
kit,nitro,nuxt: make emitted tsconfig/types stable across reruns (#36747)
nuxt: render inlined component styles after stylesheet links (#36714)
webpack: use valid devtool for hidden client sourcemaps in dev (#36555)

📖 Documentation

clarify template dependency regeneration (#36766)
revise README structure and headings (#36772)
link the Nuxt DevTools docs on nuxt.com (#36769)
warn against spreading untrusted objects onto server components (1225ca7ff)
update anchors for flat heading ids (#36664)

🏡 Chore

add 1000-row listing routes to the benchmark (c852d871f)
add client page weight and browser timing suites (#36788)

✅ Tests

update bundle size snapshot (7528c3ce6)
list new main-only diagnostic codes (545b5934c)
tolerate node 26 proxy inspect output (40f72b40b)
normalise rolldown comment (861e153dd)
improve benchmark tests (#36745)

🤖 CI

check unversioned docs links against branch docs version (d093c88b1)
skip unneeded checks for release prs (4b90681bd)
skip benchmarks in merge groups (6428070e0)
re-enable codspeed ⚡ (bc17c03d1)

❤️ Contributors

Daniel Roe (@danielroe)
Max (@onmax)
Sébastien Chopin (@atinux)
saini-25 (@saini-25)
Baptiste Leproux (@larbish)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [nuxt](https://nuxt.com) ([source](https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt)) | [`4.6.3` → `4.6.4`](https://renovatebot.com/diffs/npm/nuxt/4.6.3/4.6.4) | ![age](https://developer.mend.io/api/mc/badges/age/npm/nuxt/4.6.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/nuxt/4.6.3/4.6.4?slim=true) | --- ### Release Notes <details> <summary>nuxt/nuxt (nuxt)</summary> ### [`v4.6.4`](https://github.com/nuxt/nuxt/releases/tag/v4.6.4) [Compare Source](https://github.com/nuxt/nuxt/compare/v4.6.3...v4.6.4) > 4.6.4 is a security release. It fixes [eight advisories in Nuxt](https://github.com/nuxt/nuxt/security/advisories) and pulls in `nitropack` 2.13.6, which fixes [three more in Nitro](https://github.com/nitrojs/nitro/security/advisories). We recommend upgrading as soon as you can. #### ⚠️ Behaviour changes These probably won't affect most apps, but it's worth flagging anyway: 1. **Error details in production.** When a page fails to render on the server, the error page and the payload now only carry message and data of errors you create with `createError`. Everything else is stripped. 2. **Dev server `Host` checks.** Webpack and rspack dev servers now reject requests with an unexpected `Host` header, as Vite already does. If you use a custom hostname or tunnel, you'll need to add it to the new `devServer.allowedHosts` option. 3. **`workspaceDir` detection.** When `workspaceDir` isn't set, Nuxt now only widens it past `rootDir` to an explicit workspace root or the closest git repository. 4. **Nitropack cached routes.** `cache`, `swr` and `isr` route rules now only cache `GET` and `HEAD` requests, and no longer store responses that set a cookie or send `Cache-Control: private` or `no-store`. Wildcard `proxy` and `redirect` rules also reject requests whose resolved target would leave the rule's scope. 5. **Route rules and encoded slashes.** Route rules now match paths that contain encoded slashes, so `/api%2Fadmin` is covered by a `/api/**` rule. #### 👉 Changelog [compare changes](https://github.com/nuxt/nuxt/compare/v4.6.3...v4.6.4) ##### 🩹 Fixes - **nitro,nuxt:** require unrouting 0.3.2 ([`768d21368`](https://github.com/nuxt/nuxt/commit/768d21368)) - **nitro:** preserve wildcard tails in case-insensitive route rules ([`bf31e4cd8`](https://github.com/nuxt/nuxt/commit/bf31e4cd8)) - **nitro:** require nitropack 2.13.6 ([`1b13c6981`](https://github.com/nuxt/nuxt/commit/1b13c6981)) - **nitro:** keep leading double slash in renderer request path ([`75c12c6fb`](https://github.com/nuxt/nuxt/commit/75c12c6fb)) - **nuxt:** use unambiguous encoding for island hash ([`6f1b93c64`](https://github.com/nuxt/nuxt/commit/6f1b93c64)) - **vite-server:** resolve wildcard redirect tails from the matched segments ([`1e7dfa6a7`](https://github.com/nuxt/nuxt/commit/1e7dfa6a7)) - **nuxt:** do not expose details of untrusted thrown errors ([`8c56b71e4`](https://github.com/nuxt/nuxt/commit/8c56b71e4)) - **nuxt:** strip trailing slashes in linear time ([`97424dd21`](https://github.com/nuxt/nuxt/commit/97424dd21)) - **nitro,webpack:** include hosts the CLI allows after loading the config ([`8c11d965d`](https://github.com/nuxt/nuxt/commit/8c11d965d)) - **webpack:** skip hot middleware for forbidden dev requests ([`3c9645326`](https://github.com/nuxt/nuxt/commit/3c9645326)) - **rspack,webpack:** reject unexpected Host headers in dev middleware ([`f8d64c9aa`](https://github.com/nuxt/nuxt/commit/f8d64c9aa)) - **schema,nitro,vite:** add `devServer.allowedHosts` ([`3e1c7964e`](https://github.com/nuxt/nuxt/commit/3e1c7964e)) - **nitro,nuxt:** match route rules for paths with encoded slashes ([`084396b10`](https://github.com/nuxt/nuxt/commit/084396b10)) - **schema:** only widen workspace dir to a declared workspace root ([`89d3306d1`](https://github.com/nuxt/nuxt/commit/89d3306d1)) - **nitro:** only trust `x-forwarded-proto` in when opted-in ([#36818](https://github.com/nuxt/nuxt/issues/36818)) - **nitro:** stream the body read through a `nuxt/server` handler ([#36817](https://github.com/nuxt/nuxt/issues/36817)) - **kit:** suggest the specific fix when loading falls back to jiti ([`24d75659d`](https://github.com/nuxt/nuxt/commit/24d75659d)) - **vite:** use a single type checker ([#36774](https://github.com/nuxt/nuxt/issues/36774)) - **nitro,vite:** remove windows + virtual dev ssr css links after hydration ([#36765](https://github.com/nuxt/nuxt/issues/36765)) - **nitro,vite:** dedupe dev css by module node ([#36420](https://github.com/nuxt/nuxt/issues/36420)) - **nuxt:** avoid hoisting setup-only values from `definePageMeta` ([#36751](https://github.com/nuxt/nuxt/issues/36751)) - **nuxt:** only match hydration modifiers after lazy prefix ([#36750](https://github.com/nuxt/nuxt/issues/36750)) - **kit,nitro,nuxt:** make emitted tsconfig/types stable across reruns ([#36747](https://github.com/nuxt/nuxt/issues/36747)) - **nuxt:** render inlined component styles after stylesheet links ([#36714](https://github.com/nuxt/nuxt/issues/36714)) - **webpack:** use valid devtool for hidden client sourcemaps in dev ([#36555](https://github.com/nuxt/nuxt/issues/36555)) ##### 📖 Documentation - clarify template dependency regeneration ([#36766](https://github.com/nuxt/nuxt/issues/36766)) - revise README structure and headings ([#36772](https://github.com/nuxt/nuxt/issues/36772)) - link the Nuxt DevTools docs on nuxt.com ([#36769](https://github.com/nuxt/nuxt/issues/36769)) - warn against spreading untrusted objects onto server components ([`1225ca7ff`](https://github.com/nuxt/nuxt/commit/1225ca7ff)) - update anchors for flat heading ids ([#36664](https://github.com/nuxt/nuxt/issues/36664)) ##### 🏡 Chore - add 1000-row listing routes to the benchmark ([`c852d871f`](https://github.com/nuxt/nuxt/commit/c852d871f)) - add client page weight and browser timing suites ([#36788](https://github.com/nuxt/nuxt/issues/36788)) ##### ✅ Tests - update bundle size snapshot ([`7528c3ce6`](https://github.com/nuxt/nuxt/commit/7528c3ce6)) - list new main-only diagnostic codes ([`545b5934c`](https://github.com/nuxt/nuxt/commit/545b5934c)) - tolerate node 26 proxy inspect output ([`40f72b40b`](https://github.com/nuxt/nuxt/commit/40f72b40b)) - normalise rolldown comment ([`861e153dd`](https://github.com/nuxt/nuxt/commit/861e153dd)) - improve benchmark tests ([#36745](https://github.com/nuxt/nuxt/issues/36745)) ##### 🤖 CI - check unversioned docs links against branch docs version ([`d093c88b1`](https://github.com/nuxt/nuxt/commit/d093c88b1)) - skip unneeded checks for release prs ([`4b90681bd`](https://github.com/nuxt/nuxt/commit/4b90681bd)) - skip benchmarks in merge groups ([`6428070e0`](https://github.com/nuxt/nuxt/commit/6428070e0)) - re-enable codspeed ⚡ ([`bc17c03d1`](https://github.com/nuxt/nuxt/commit/bc17c03d1)) ##### ❤️ Contributors - Daniel Roe ([@danielroe](https://github.com/danielroe)) - Max ([@onmax](https://github.com/onmax)) - Sébastien Chopin ([@atinux](https://github.com/atinux)) - saini-25 ([@saini-25](https://github.com/saini-25)) - Baptiste Leproux ([@larbish](https://github.com/larbish)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate added 1 commit 2026-11-05 22:02:53 +00:00

chore(deps): update dependency nuxt to v4.6.4

renovate/stability-days Updates have met minimum release age requirement

Details

dancefinder-app / build (pull_request) Successful in 8m4s

Details

dancefinder-app / deploy-prod-frostmoln (pull_request) Skipped

Details

b5887c9963

renovate scheduled this pull request to auto merge when all checks succeed 2026-11-05 22:02:53 +00:00

renovate merged commit bd2e00e94a into main

2026-11-05 22:10:59 +00:00

renovate deleted branch renovate/nuxtjs-monorepo

2026-11-05 22:10:59 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dancefinder/dancefinder-app#3135