chore(deps): update nuxtjs monorepo to v3.21.10

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@nuxt/kit (source)	3.21.6 → 3.21.10
@nuxt/schema (source)	3.21.6 → 3.21.10

---

Release Notes

nuxt/nuxt (@​nuxt/kit)

v3.21.10

Compare Source

⚠️ This is a security release. We recommend upgrading as soon as possible with npx nuxt upgrade --dedupe.

It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.

If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.

Full details: Nuxt Security Patch Releases and GitHub Security Advisories.

👉 Changelog

compare changes

🩹 Fixes

• nuxt: Clear hide/reset timeouts in set() (#​35534)
• nuxt: Preserve trailing slash in NuxtLink href when unset (#​35501)
• vite: Resolve SSR inlined CSS module class name mismatch (#​35610)
• nuxt: Sync layout meta during middleware on SSR (#​35633)
• nuxt: Update client URL to match SSR on fatal middleware error (#​35637)
• nuxt: Watch external component directories in development (#​35652)
• nuxt: Don't cross-pollute useAsyncData cache on reactive key change (#​35656)
• nuxt: Return global route for useRoute in detached effect scope (#​35659)
• nuxt: Ignore custom name or path when reusing an existing page in pages:extend (#​35661)
• nuxt: Preserve explicit useFetch method inference (#​35671)
• nuxt: Correct default export detection in plugin metadata (#​35676)
• nuxt: Reload real page module on HMR of JSX render-function pages (#​35678)
• vite: Ensure server sourcemap-preserver plugin actually runs (#​35680)
• nuxt: Resolve @unhead/vue/* from nuxt's dependency tree (#​35690)
• nuxt: Don't apply scroll behaviour after a subsequent nav (#​35719)
• vite: Preserve css suffix when extracting ssr inline styles (#​35714)
• nuxt: Don't exclude client entry module from style extraction (#​35720)
• kit: Avoid mutating layer configs when resolving options (#​35729)
• nuxt: Generate layout types even when pages module is disabled (#​35717)
• nitro: Skip resource hints for stylesheets already rendered as blocking links (#​35691)
• nuxt: Revalidate cached route payloads instead of using force-cache (#​35672)
• nuxt: Preserve query params in cached payload extraction (#​35696)
• rspack,webpack: Resolve loaders and runtime deps from nuxt dirs (#​35568)
• nuxt: Render client components in nested server components (#​35669)
• nuxt: Remove dev error overlay when error is cleared (#​35821)
• rspack,webpack: Resolve bundled postcss defaults from builder (#​35823)
• schema: Normalise slashes in app.buildAssetsDir (#​35833)
• nuxt: Case-fold route rule keys to match folded lookups (619963309)
• nitro: Require loopback peer for chrome devtools workspace endpoint (00f71bb65)
• nitro: Bound island props and v-for to prevent unauthenticated DoS (668cdfdfd)
• nuxt: Reject reserved template island prop under runtime compiler (5b60017f7)
• nuxt: Reject top-level as prop for islands (00a2b0494)

📖 Documentation

• Document relative baseURL workarounds (#​34004)
• Warn about runtimeCompiler security best practices (b76c1a8bd)
• Warn about validating server component props (f6d72628d)

✅ Tests

• Guard against transient undefined _route in gotoPath (5391e7e6a)
• Raise route-HMR polling timeout to reduce e2e flakiness (cbc757c63)
• kit: Scope loadNuxt temp dir so it doesn't delete sibling fixtures (72e4b5578)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Florian Heuberger (@​Flo0806)
• Matej Černý (@​cernymatej)
• bdbch (@​bdbch)
• Elecmonkey (@​elecmonkey)
• Ryota Watanabe (@​wattanx)
• kealan (@​KealanAU)
• Julien Huang (@​huang-julien)
• Luke Nelson (@​luc122c)
• Harlan Wilton (@​harlan-zw)
• Mateleo (@​Mateleo)
• lutejka (@​lutejka)
• Darlan José Batista do Prado (@​DarlanPrado)
• Max (@​onmax)
• Sushant (@​sushantguri)
• raminjafary (@​raminjafary)

v3.21.9

Compare Source

3.21.9 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes

• vite: Use spa entry for vite-node fallback (3.x) (c8410a16a)
• kit,nuxt: Pass error as cause when we re-throw (#​35387)
• vite: Inline CSS for lazy components imported from #components (#​35215)
• nuxt: Validate <ClientOnly> fallback tag name (#​35325)
• vite: Extract server page CSS when inlineStyles is disabled (#​35209)
• nitro: Include nested layers in nitro transforms (#​35327)
• nitro: Export empty styles object with ssr: false (#​35330)
• nuxt: Emit auto-import paths as files, not directories (#​35333)
• nuxt: Suppress spurious slot warning in NuxtPage during nav (#​35335)
• vite: Preserve backslash separators in windows named pipe path (#​35336)
• nuxt: Detach in-flight promise on useAsyncData teardown (#​35328)
• nuxt: Respect per-page keepalive set via definePageMeta (#​34526)
• nuxt: Align useFetch error type with runtime (#​35346)
• nuxt: Unwrap getter body in useFetch (#​35343)
• rspack,webpack: Strip invalid webpack PURE annotations (#​35386)
• nuxt: Guard against -1 when unregistering a router hook (#​35391)
• nuxt: Clean up load/error listeners in preloadPayload (#​35392)
• nuxt: Avoid idle wait when refreshing data after hydration (#​35358)
• nuxt: Ensure page:start finishes before page:finish starts (#​35408)
• nuxt: Preserve plugin navigation during app boot (#​35344)
• vite: Add extension to vite-node-runner virtual import (e81a0c484)
• nuxt: Make virtual module IDs stable across hosts (#​35317)
• nuxt: Hash serialized island props (#​35356)
• vite: Avoid emitted ssr styles file name collisions (#​35432)
• nuxt: Avoid syncing route too early when reused page remounts (#​35440)
• nuxt: Keep nested layout on deferred route during suspended layout switch (#​35443)
• vite: Set define for NODE_ENV and __VUE_PROD_DEVTOOLS__ (#​35444)
• nuxt: Restore deferred query route before page is mounted (#​35442)
• nuxt: Make islands hash backwards-compatible (#​35452)
• nuxt: Pass nuxt rootDir to typed-router context (#​35565)
• nitro: Only reload nitro after initial nitro build (6ba8e26a5)
• schema: Enable HMR for defineNuxtComponent in JSX (#​35620)
• schema: Resolve Vite cache directory from workspace (#​35626)
• nitro: Write prerender cache files atomically (#​35619)
• nuxt: Apply latest navigation on concurrent navigateTo in built-in router (#​35631)

📖 Documentation

• Improving testing documentation for better understanding (#​35526)
• Add tip about prerendering registration for pages (#​35635)
• Clarify useFetch custom data error (#​35647)
• Drop reference to non-existent section (bd1943d04)
• Update link to /3.x slug (71bdb972d)

🏡 Chore

• Allow node version updates (#​35297)

✅ Tests

• Assert dev css delivery transport for server pages (9851e993b)
• Count only render-blocking stylesheet links for page styles (b0e895a7f)
• Await expectNoClientErrors (afffe7f09)

🤖 CI

• Handle missing base branch (for stacked prs) (13a933f8a)
• Unlink issues from autoclosed PRs (#​35615)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Florian Heuberger (@​Flo0806)
• Mateleo (@​Mateleo)
• Luke Nelson (@​luc122c)
• Darlan José Batista do Prado (@​DarlanPrado)
• Julien Huang (@​huang-julien)
• skoenfaelt (@​skoenfaelt)
• Anoesj Sadraee (@​Anoesj)
• raminjafary (@​raminjafary)
• Kurt Medley (@​HeavyMedl)
• isksss (@​isksss)
• Alexander Lichter (@​TheAlexLichter)
• Damian Głowala (@​DamianGlowala)
• Sami El Achi (@​samiashi)

v3.21.8

Compare Source

3.21.8 is a hotfix release to address an issue running the dev server on MacOS.

👉 Changelog

compare changes

🩹 Fixes

• vite: Shorter socket name for macOs with tmp fallback (#​35265)
• kit: Respect type option in findPath (#​35272)
• deps: Update nuxt/scripts presets (ff6b060dd)

📖 Documentation

• Change null to undefined in data-fetching docs to match actual types (#​35301)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Ali Mahmmoud (@​AliMahmoudDev)
• Quentin Macq (@​quentinmcq)
• Eduardo San Martin Morote (@​posva)

v3.21.7

Compare Source

3.21.7 is the a security hotfix release.

👉 make sure to check https://github.com/nuxt/nuxt/security/advisories to view open advisories resolved by this release.

👉 Changelog

compare changes

🩹 Fixes

• nitro: Assign noSSR before deciding payload extraction (#​35108)
• vite: Avoid filtering out dirs with shared prefix from allowDirs (#​35112)
• nuxt: Use resolve from pathe for buildCache path boundary check (#​35111)
• nuxt: Prevent sibling-directory traversal in test component wrapper (#​35110)
• nitro: Pass event data to isValid in dev clipboard-copy listener (#​35109)
• nuxt: Validate protocols in reloadNuxtApp path before reload (#​35115)
• vite: Resolve vite clientServer with ssr: false (#​34959)
• vite: Prefix public asset virtuals with null byte (38d330179)
• nuxt: Handle missing payload in chunkError listener (#​35155)
• vite: Close vite dev server on nuxt close (d007d7060)
• kit,nuxt: Handle cancelling prompts to install packages (59821a5ca)
• nuxt: Await in-lifght template generation when closing nuxt (#​35181)
• webpack: Surface compilation errors when stats.toString is empty (71dccff2b)
• kit: Improve TS extension stripping/substitutions (#​35233)
• nuxt: Preserve .d.mts/.d.cts in resolveTypePaths (#​35235)
• nuxt: Reject prototype-chain keys in the island registry (#​35205)
• nitro: Gate chrome devtools workspace endpoint to local requests (#​35201)
• nuxt: Escape props in <NuxtClientFallback> ssr output (#​35199)
• nuxt: Apply isScriptProtocol guard to navigateTo open option (#​35206)
• rspack,webpack: Require loopback host when missing same-origin signals (#​35200)
• nuxt: Absolutely resolve defu in app config template (40bedf0db)
• nuxt: Match route rules case-insensitively to mirror vue-router (3f3e3fa7b)
• nuxt: Escape <NoScript> slot content (7fea9fd68)
• nuxt: Block path-normalization open redirect in navigateTo (1f2dd5e78)
• nuxt: Reject cross-origin paths in reloadNuxtApp (6497d99dd)
• vite: Bind vite-node IPC to a permissioned filesystem socket (c293bf950)
• nuxt: Reject script-capable protocols in <NuxtLink> href (53284043d)
• nuxt: Clarify page and layout usage warnings (#​35184)
• nuxt: Do not absolutely resolve defu (d11d7b1b5)

📖 Documentation

• Edit for clarity and grammar (#​35214)
• Add dedicated module dependencies page (#​35171)

🏡 Chore

• Use execFileSync for safety in release scripts (9a455a658)
• Assert there is always a tag (8da21fba8)
• Fix type in test (bc2837125)
• Fix lychee dynamic composable exclude (#​35119)
• Add autofix action tag in comment (70eba297f)
• Update renovate minimum release age (27a6821a1)

✅ Tests

• Update test for js payload rendering (b51a80840)
• Improve reliability of hmr test (0078499f0)

🤖 CI

• Always run all tests for 4.x/3.x (0519c0ade)
• Update to agentscan v1.8.0 (#​35120)
• Automatically close PRs from automated accounts (#​35161)
• Migrate from tibdex (6277aedcb)
• Disable provenance-change enforcement in dependency-review (1d4910eed)
• Add zizmor github actions check (#​35089)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Matej Černý (@​cernymatej)
• anton-gor-dev (@​anton-gor-dev)
• Julien Huang (@​huang-julien)
• David Stack (@​davidstackio)
• Noah3521 (@​Noah3521)
• Matteo Gabriele (@​MatteoGabriele)
• Mohit Kumar (@​mohitkum4r)
• Florian Heuberger (@​Flo0806)

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • "every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.