chore(deps): update devdependency nuxt to v3 [security] #327
Conversation
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
added
chore
dependencies
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
WalkthroughThe update to the Changes
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Outside diff range, codebase verification and nitpick comments (1)
packages/nuxt-typed-vuex/package.json (1)
43-43: Verify compatibility of@nuxt/typeswith Nuxt 3.The
peerDependenciessection still references@nuxt/typesversion^2.15.8, which is intended for Nuxt 2 and may not be compatible with Nuxt 3. Ensure that the correct version of@nuxt/typesor the appropriate package for Nuxt 3 type definitions is used to avoid potential issues.
packages/nuxt-typed-vuex/package.json:@nuxt/typesversion^2.15.8examples/nuxt/package.json:@nuxt/typesversionlatestexamples/nuxt-ts/package.json:@nuxt/typesversionlatestAnalysis chain
Verify compatibility of
@nuxt/typeswith Nuxt 3.The
peerDependenciessection still references@nuxt/typesversion^2.15.8, which may not be compatible with Nuxt 3. Ensure that the correct version of@nuxt/typesis used to avoid potential issues.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify compatibility of `@nuxt/types` with Nuxt 3. # Test: Search for `@nuxt/types` usage. Expect: No compatibility issues with Nuxt 3. rg --type json '@nuxt/types'Length of output: 699
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (1)
- packages/nuxt-typed-vuex/package.json (1 hunks)
Additional comments not posted (1)
packages/nuxt-typed-vuex/package.json (1)
43-43: Updatenuxtdependency to version 3.The
nuxtdependency has been updated from^2.15.8to^3.0.0. This update addresses security vulnerability CVE-2024-34343 and introduces significant architectural changes.
renovate
bot
force-pushed
the
renovate/npm-nuxt-vulnerability
branch
from
2e7aaab
to
990c910
Compare
|
New and removed dependencies detected. Learn more about Socket for GitHub ↗︎
|
This PR contains the following updates:
^2.18.1->^3.0.0GitHub Vulnerability Alerts
CVE-2024-34343
Summary
The
navigateTofunction attempts to blockthejavascript:protocol, but does not correctly use API's provided byunjs/ufo. This library also contains parsing discrepancies.Details
The function first tests to see if the specified URL has a protocol. This uses the unjs/ufo package for URL parsing. This function works effectively, and returns true for a
javascript:protocol.After this, the URL is parsed using the
parseURLfunction. This function will refuse to parse poorly formatted URLs. Parsingjavascript:alert(1)returns null/"" for all values.Next, the protocol of the URL is then checked using the
isScriptProtocolfunction. This function simply checks the input against a list of protocols, and does not perform any parsing.The combination of refusing to parse poorly formatted URLs, and not performing additional parsing means that script checks fail as no protocol can be found. Even if a protocol was identified, whitespace is not stripped in the
parseURLimplementation, bypassing theisScriptProtocolchecks.Certain special protocols are identified at the top of
parseURL. Inserting a newline or tab into this sequence will block the special protocol check, and bypass the latter checks.PoC
POC - https://stackblitz.com/edit/nuxt-xss-navigateto?file=app.vue
Attempt payload X, then attempt payload Y.
Impact
XSS, access to cookies, make requests on user's behalf.
Recommendations
As always with these bugs, the
URLconstructor provided by the browser is always the safest method of parsing a URL.Given the cross-platform requirements of nuxt/ufo a more appropriate solution is to make parsing consistent between functions, and to adapt parsing to be more consistent with the WHATWG URL specification.
Note
I've reported this vulnerability here as it is unclear if this is a bug in ufo or a misuse of the ufo library.
This ONLY has impact after SSR has occured, the
javascript:protocol within a location header does not trigger XSS.Release Notes
nuxt/nuxt (nuxt)
v3.12.4Compare Source
👉 Changelog
compare changes
🔥 Performance
resolveIdin layers (#27971)🩹 Fixes
noScripts(#27972)/as fallback if page can't be identified (e6109b226)html-validate(#28024)unheadkey for ad-hoc module options (#28088)getNuxtVersionreturnsstring(#28125)scroll-padding-topin scrollBehavior (#28083)useAsyncDatareturns undefined (#28154)getCachedDatanull response (d10cea11b)app/assrcDirif it doesn't exist (#28176)serverDirwithin layers using v4 compat (#28177)getCachedDatato return undefined (#28187)addEventListenerto register cookie store listener (#28193)set-cookieheaders (#28211)💅 Refactors
postcssmodule loading (#27946)_registeredComponentsfrom ssrContext (#27819)errxto handle dev log traces (#28027)📖 Documentation
nuxtApp.runWithContext(#28000)pendingvariable from data fetching docs (#28011)layers/directory (#28128)✅ Tests
typeChecktest in minimal build (#28166)🤖 CI
❤️ Contributors
v3.12.3Compare Source
👉 Changelog
compare changes
🔥 Performance
fs-extra(#27787)chokidarwhen a customsrcDiris provided (#27871)prefetchComponentsis treeshaken on server (#27905)🩹 Fixes
dir.app(0c73cb734)navigateTocalled withopen(#27742)refreshtype in server component refs (#27778)#vue-routeralias for backwards compat (#27896)nuxttypes (#27900)?rawfrom head when in dev mode (#27940)💅 Refactors
performance.nowto measure time (d14f7ec46)📖 Documentation
refreshCookieonuseCookiedoc page (#27744)mainbranch (e7fbc9f81)useFetch/AsyncDatain wrappers (#27785)vue-routerdocs (#27895)compatibilityVersionis available in the latest release (#27919)Nuxt 3->NuxtorNuxt 3+(3c16c890c)refs (#27933)🏡 Chore
4xtag for v4 nightly releases (9d5dd5494)dev-bundler(e3448fa0d)2.xbranch (8003cf72f)✅ Tests
🤖 CI
mainbranch (7abd982f8)@vitejs/plugin-vueagain (56660cbdd)❤️ Contributors
v3.12.2Compare Source
✅ Upgrading
As usual, our recommendation for upgrading is to run:
This will refresh your lockfile as well, and ensures that you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.
👉 Changelog
compare changes
🔥 Performance
🩹 Fixes
onNuxtReadycallback without arguments (#27428)app/dir backwards compatibility (#27529)ssr: false(#27542)runtimeConfigkey (9e56b60c6)#app/defaultsrather than augmenting (#27567)useRouteAnnouncer(#27562)_installedModules(e4bfea642)app.rootIdwithapp.rootAttrs.id(#27630)mergePropsimport in islands transform (#27622)vite.cacheDirif defined (#27628)closeis called (#27637)/even if pages module isn't enabled (dabcb5ecc)📖 Documentation
head(#27575)clear()function added in 3.11 (#27615)🏡 Chore
webpack-virtual-modules(58dd7f3a6)✅ Tests
🤖 CI
❤️ Contributors
v3.12.1Compare Source
👉 Changelog
compare changes
🩹 Fixes
@nuxt/scripts(0252000d7)💅 Refactors
CompatibilityDateSpec(#27521)📖 Documentation
🏡 Chore
nuxidependency (#27526)✅ Tests
❤️ Contributors
v3.12.0Compare Source
👀 Highlights
We're on the road to the release of Nuxt 4, but we've not held back in Nuxt v3.12. A huge thank you to the 75+ Nuxt contributors and community members who have been part of this release. ❤️
🚀 Testing Nuxt 4 changes
Nuxt 4 is on the horizon, and it's now possible to test out the behaviour changes that will be coming in the next major release (#26925) by setting an option in your
nuxt.configfile:As we've been merging PRs for Nuxt 4, we've been enabling them behind this flag. As much as possible we're aiming for backwards compatibility - our test matrix is running the same fixtures in both v3 and v4 compatibility mode.
There is a lot to say here, with 10+ different PRs and behaviour changes documented and testable, but for full details, including migration steps, see the v4 upgrade documentation.
We'd be very grateful for early testing of what's coming in Nuxt 4! 🙏
📜 Nuxt Scripts auto-install
We've been gradually working to release Nuxt Scripts. It's currently in public preview, but we're near a public release, so we've added some stubs for composables that (when used) will prompt installing the
@nuxt/scriptsmodule.👉 Watch out for the launch - and an article explaining more!
🌈 Layer auto-registration and bugfixes
Just like
~/modules, any layers within your project in the~/layersdirectory will now be automatically registered as layers in your project (#27221).We also now correctly load layer dependencies, which should resolve a range of issues with monorepos and git installations (#27338).
🌐 Built-in accessibility improvements
We now have a built-in
<NuxtRouteAnnouncer>component and correspondinguseRouteAnnouncercomposable, which will be added by default to new Nuxt templates going forward.For full details, see the original PR (#25741) and documentation.
We're continuing to work on
nuxt/a11y- expect to hear more on that in future!🔥 Performance improvements
We've landed some performance improvements as well, many of which are behind the
compatibilityVersion: 4flag, such as a move away from deeply reactive asyncData payloads.Significant improvements include deduplicating modules (#27475) - which will apply mostly to layer users who specify modules in their layers. In one project, we saw 30s+ improvement in starting Nuxt.
We've also improved Vite dev server start up time by excluding common ESM dependencies from pre-bundling, and would suggest module authors consider doing the same (#27372).
We improved chunk determinism, so sequential builds should be less likely to have completely different chunk hashes (#27258).
And we tree shake more client-only composables from your server builds (#27044), and have reduced the size of server component payloads (#26863).
👨👩👧👦 Multi-app support
We've landed a couple of changes that take us toward a place of supporting multi-app natively in Nuxt, including a
multiAppexperimental flag (#27291) and the ability to have multiple Nuxt app instances running in parallel at runtime (#27068).While it's not yet ready, please do follow along on the tracker issue, and feel free to pitch in if this is interesting to you.
⛑️ DX wins
We now serialise more things in your dev server logs, including VNodes (#27309) and URLs. We also addressed a bug that could lead to a frozen dev server.
When accessing private runtime config in the browser, we now let you know with a more informative error message (#26441).
🪨 Stabilising features
We've removed some experimental options that have been stabilised and which we feel no longer need to be configurable:
experimental.treeshakeClientOnly(enabled by default since v3.0.0)experimental.configSchema(enabled by default since v3.3.0)experimental.polyfillVueUseHead(disabled since v3.4.0) - implementable in user-land with pluginexperimental.respectNoSSRHeader(disabled since v3.4.0) - implementable in user-land with server middlewareWe've also enabled
scanPageMetaby default (#27134). This pulls out any page metadata in yourdefinePageMetamacro, and makes it available to modules (like@nuxtjs/i18n) so they can augment it.This unlocks much better module/typed routing integration, but has a potential performance cost - so please file an issue if you experience any problems.
💪 Type improvements
We now have support for typed
#fallbackslots in server components (#27097).We've also improved some defaults in your generated
tsconfig.json, including settingmodule: 'preserve'if you have a locally installed TypeScript v5.4 version (see docs) - see #26667, #27485.📦 Module author/power user improvements
We have shipped a range of type improvements for module authors, including:
installModule(#26744)onPrehydratehook for hooking into the browser hydration cycle (#27037)useRuntimeConfigandupdateRuntimeConfigutils (#27117)🎨 Inlined UI templates
If you previously used
@nuxt/ui-templatesthen it may be worth knowing that we have moved them from a separate repository into the nuxt/nuxt monorepo. (This is purely a refactor rather than a change, although you can expect some new designs for Nuxt v4.)✅ Upgrading
As usual, our recommendation for upgrading is to run:
This will refresh your lockfile as well, and ensures that you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.
👉 Changelog
compare changes
🚀 Enhancements
useRequestURL(#26687)imports.scanoption (#26576)<NuxtRouteAnnouncer>anduseRouteAnnouncer(#25741)resolvePathandfindPath(#26465)useLinkfromNuxtLink(#26522)future.compatibilityVersion(#26925)app.rootAttrsandteleportAttrs(#27014)cookieStoreby default (f597ca59a)onUpdatedandonUnmountedon server (#27044)nuxt/scriptson usage (#27010)<NuxtPage>(#27050)renderSSRHeadOptionsconfig forunhead(#26989)onPrehydratelifecycle hook (#27037)#fallbackslot to server components types (#27097)useRuntimeConfigandupdateRuntimeConfigutils (#27117)layers/directory (#27221)appIdand improve chunk determinism (#27258)multiAppflag (#27291)compatibilityVersion(#27305)URLserialiser for dev server logs (a549b46e9)this.$route(#27313)installModule(#26744).withfor better module options types (#26850)compatibilityDateflag for future (#27512)🔥 Performance
asyncDatawatch when unmounted (#26821)ssrContext.stylesreference (from unusedvue-style-loader) (2d1ab61b2)shallowReactive(#27214)🩹 Fixes
getCachedDatafrom shaping type ofuseAsyncData(#25946)hasSuffix(#26725)moduleDetectionto 'force' (#26667)nuxt._ignoreafter all modules run (#26680)v-forto slot in islands (#26880)_scopeis active before callingrunfunction (#26756, #26904)enabledisfalse(#26906)lang="ts"(#26912)updateAppConfig(#26949)useStateinNuxtClientFallbacksetup function (#26928).jsextension from template imports (0d4a622f3)runWithContext(#26976)app.vueexists inrootDir(1af81ed0f)URLconstructor to resolve external protocols (5f0693a69)URLfor parsing URLs rather thanparseURL(ea22d3f98)process.*flags (#27089)NuxtTeleportIslandComponent(#27093)spaLoadingTemplatefunction (0e12b6eb8)jitiand not file URL (#27252)buildIdin schema (#27274)locationheader innavigateTo(#27280)undefinedrather thannullfor data fetching defaults (#27294)app.cdnURLfor extracted payloads (#26668)VNodereviver & don't deduplicate dev logs (#27309)app.configfiles in nitro build (#27342)app.config.d.ts(#27350)optimizeDepsin ssr (#27356)hmr.serveris set (#27326)appoptions (#27478)app.headarrays (#27480)tsconfig.json(#27485)buildAssetsDirin island teleport dev chunk (#27469)module: preserveunelss ts v5.4 is installed (b08dfc98b)pages:extendhook (#27134)esnexttarget (7bb02735e)booleanvalue fordedupein v4 compat (#27511)scopeIdto server components (#27497)💅 Refactors
📖 Documentation
dependsOnworks not just for parallel plugins (#26707)--presetflag fornuxi build(#26759)useFetch(#26748)callWithNuxt(#26771)srcDirdescription mentioning deprecatedstatic/directory (#26804)pageReffrom a child page (#26806)pendingvalue in data fetching composables (#26766)@vue/test-utilsgetting started guide (#26205)a->an(#26856)usePreviewModeexplanation (#26602)defineConfig(a60de743a)@sinceannotations to exported functions (#25365).eslintrc.jstoeslint.config.js(#27020)future.compatibilityVersion(e7789a257)nuxi init(#27051)ignorePrefixto clarify ignored files (#27065)app.config.tsto nuxt 4 testing/migration (#27164)useFetchrecipe ([#&Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.