v4.6.3 is the next patch release.
π Changelog
π¨ Security fixes
- vite: do not read files named in client error reports (
63299e13c) - GHSA-x287-wcfc-q46c - vite: deny dev server access to nitro dev output (
c7e204ec6) - GHSA-648h-gw55-m2g7 - vite: deny serving generated app secret in dev (
16dfdc2a9) - GHSA-3xf4-9g3c-4h4w - nitro,nuxt: handle dot segments in request paths (
440250d97) - GHSA-9v7c-q64q-vv33 - nuxt: apply redirect route rules to page islands (
b20372dbe) - GHSA-2fxj-c3j7-rr69
π₯ Performance
- vite: skip compiling plain style blocks in the server build (#36711)
- nitro,nuxt,rspack,webpack: bundle esm vue + reuse caches (#36710)
- vite: avoid quadratic nested dir check for
fs.allow(#36702) - nuxt: server render internal custom links without RouterLink (#36707)
- nuxt: skip unneeded typed routes generation (#36645)
π©Ή Fixes
- nitro: don't share prerender hints with self-fetched requests (#36705)
- nuxt: defer app scope cleanup on external navigation (#36713)
- nuxt: prevent useCookie CookieStore sync from rewriting with refresh (#36673)
- nuxt: only return redirects from
navigateTowhile middleware runs (#36650) - nuxt: remove purged entries from
_asyncData(#36709) - vite: skip quoted
import.metakeys + limit replace to client dev (#36703) - nuxt: hide RouteLocationRaw from navigateTo's public return type (#36691)
- nuxt: tree-shake auto-imported
#appcomposables (#36696) - nuxt: don't treat constrained route rules as covering dynamic pages (#36701)
- nuxt: include
shared/in build cache hash (#36704) - nuxt: hash keyed function ids + page import names relative to
rootDir(#36697) - nuxt: encode page paths before matching route rule keys (#36683)
- nuxt: handle rejected
updateCallbackDoneof aborted view transition (#36639) - ui-templates: keep loading shader proportions on narrow screens (#36654)
- nuxt: reject case-dependent route rule constraints w/
sensitive: false(#36708) - nuxt: don't case-fold regex constraints in route rule keys (#36694)
- nuxt: normalise page prefix when finding route rule exceptions (#36685)
- vite: mirror ssr invalidations for created and deleted files (
634cba64c) - nitro: keep
noScriptswildcard patterns single-segment (fa323db7d) - deps: update unrouting to v0.3.1 (#36663)
- nuxt: avoid self-referencing
nuxt/schemaaugmentation (#36633) - nuxt: let nightly runtime resolve its own
nuxt/*imports (#36632) - nuxt: don't warn for vite+
vite.configfiles (#36628) - kit: keep generated declaration first in tsconfig
include(#36627) - nuxt: clamp numeric
v-forsources in island renders at render time (#36623) - rspack,webpack: register vue-loader plugin only once per config (#36622)
- nitro: abort the portable request when the client disconnects (#36652)
- deps: update nitropack to 2.13.5 + drop obsolete workarounds (#36649)
π Documentation
- note provide/inject limit in server components (#35837)
- use American spelling in a few guides (#36706)
- document controlling prefetch hints via
build:manifesthook (#36695) - update StackBlitz link to point to version 4 (#36674)
- link to the 2.x docs (#36640)
- clarify that island props must be validated before iteration (
4b12d15c9)
β Tests
- list
NUXT_B4023as main-only (4fd54ff9a) - wait for leave transition before each scroll behaviour test (
453406999) - vite: assert spa server bundle does not ship the app (#36699)
- nuxt: cover route rule coverage under a base url (#36682)
- list
NUXT_B9006as main-only (e107e0f40)
π€ CI
- only run full checks for the last merge queue entry (
132698a46) - run a reduced matrix in the merge queue (
7d228ba4b) - compare merge queue changes against the base branch (
bad8c3637) - notify resolved issues after publishing a release (
9d47884f3) - remove broken ai-moderator and ecosystem-ci trigger workflows (
1d89ad434)
π New Contributors
- rynx.z (@rynx-cc)
- Felix Fang (@FelixFangX)
- Volkan Akyel (@volkanakyel)
- Gareth (@0xgdr)
β€οΈ Contributors
- Daniel Roe (@danielroe)
- rynx.z (@rynx-cc)
- Felix Fang (@FelixFangX)
- Max (@onmax)
- Volkan Akyel (@volkanakyel)
- Bochkarev Ivan (@Ibochkarev)
- Gareth (@0xgdr)
- Hugo (@HugoRCD)
- SΓ©bastien Chopin (@atinux)
- Eduardo San Martin Morote (@posva)
- Baptiste Leproux (@larbish)
- Benjamin Canac (@benjamincanac)