Skip to content

chore(deps): update all non-major dependencies - #150

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#150
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@iconify-json/fluent-emoji-flat ^1.2.5 → ^1.2.6 age confidence devDependencies patch
@iconify-json/lucide ^1.2.114 → ^1.2.149 age confidence dependencies patch 1.2.150
@iconify-json/simple-icons ^1.2.87 → ^1.2.101 age confidence dependencies patch
@iconify-json/vscode-icons ^1.2.59 → ^1.2.94 age confidence devDependencies patch 1.2.95
@nuxt/content (source) ^3.14.0 → ^3.16.2 age confidence dependencies minor
@nuxt/eslint (source) ^1.16.0 → ^1.17.0 age confidence devDependencies minor
@nuxt/hints 1.1.3 → 1.1.5 age confidence dependencies patch
@nuxt/image (source) ^2.0.0 → ^2.2.1 age confidence dependencies minor
@nuxt/scripts (source) 1.2.1 → 1.3.12 age confidence dependencies minor
@nuxt/ui (source) ^4.9.0 → ^4.12.0 age confidence dependencies minor
@shikijs/engine-javascript (source) ^4.2.0 → ^4.5.0 age confidence dependencies minor
@unhead/vue (source) ^2.1.15 → ^2.1.17 age confidence dependencies patch
@vueuse/nuxt (source) ^14.3.0 → ^14.4.0 age confidence dependencies minor
actions/checkout v6.0.3 → v6.1.0 age confidence action minor
actions/download-artifact v8.0.1 → v8.0.2 age confidence action patch
eslint (source) ^10.5.0 → ^10.14.0 age confidence devDependencies minor
github/gh-aw-actions v0.80.9 → v0.93.6 age confidence action minor
pnpm (source) 10.34.4 → 10.34.9 age confidence packageManager patch
posthog-js (source) ^1.393.0 → ^1.444.0 age confidence dependencies minor
tailwindcss (source) ^4.3.1 → ^4.3.3 age confidence dependencies patch
vue-tsc (source) ^3.3.5 → ^3.3.14 age confidence devDependencies patch
zod (source) ^4.4.3 → ^4.6.7 age confidence dependencies minor

Release Notes

nuxt/content (@​nuxt/content)

v3.16.2

Compare Source

Bug Fixes
Performance Improvements

v3.16.1

Compare Source

Features
  • add content.llms option to disable the nuxt-llms integration (#​3843) (656a5ce)
Bug Fixes

v3.16.0

Compare Source

Bug Fixes
  • avoid install prompt in non-interactive environments (#​3833) (2d0e84b)
  • ContentRenderer: keep async component identity stable across re-resolves (#​3835) (dcf86e6)
  • improve generated git cache key (#​3839) (d1e353e)
  • module: keep content templates when building with _prepare (#​3837) (e390c3b)
  • nuxthub: handle object form of hub.db (#​3822) (8841abc)
  • query: tolerate trailing slashes in path-based lookups (#​3838) (220d392)
  • runtime: use dynamic import for #content/adapter to prevent prerender failure (#​3830) (400390a)
  • use UTC getters in formatDate/formatDateTime to prevent timezone drift (#​3782) (9f1f89a)

v3.15.2

Compare Source

Bug Fixes
  • dev: ignore temporary files in content source paths (#​3784) (a019e70)
  • security: reject SQL function calls in query WHERE clauses (#​3819) (847d523)

v3.15.1

Compare Source

Bug Fixes

v3.15.0

Compare Source

Features
Bug Fixes
  • content: support validator detection with pnpm enableGlobalVirtualStore (#​3791) (6b2720b)
  • hmr: update all matching collections when a file changes (#​3802) (06f8edb)
  • search: softer heading-level boost curve and tuned defaults (#​3801) (00d25a5)
  • vercel: use tmp directory to clone contents (#​3810) (793d59a)
nuxt/eslint (@​nuxt/eslint)

v1.17.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
nuxt/hints (@​nuxt/hints)

v1.1.5

Compare Source

🩹 Fixes
  • html-validate: Wrap validation in a try/catch (#​377)
  • Support app baseURL (#​392)
  • lazy-load: Wrap imported components inside setup to support circular imports (#​393)
❤️ Contributors

v1.1.4

Compare Source

🚀 Enhancements
  • Make devtools header sticky (#​364)
🩹 Fixes
  • Override nuxt core deps in pnpm workspace (#​368)
  • Use preemptuive in createRouter (#​367)
🏡 Chore
  • Configure vite optimizeDeps and bump deps in .nuxtrc (#​365)
❤️ Contributors
nuxt/image (@​nuxt/image)

v2.2.1

Compare Source

v2.2.1 is a security release.

🚨 Security

This release fixes a vulnerability in the /_ipx image transformation route. ipx was affected by an integer overflow when decoding a multi-page image, so a crafted source image could corrupt memory in the server process with a single unauthenticated request (GHSA-qf89-6xm4-66wm; our advisory for the @nuxt/image side is GHSA-p5vf-pjf5-ggj3). Sites where an attacker cannot control any image source are not affected.

@nuxt/image now requires ipx ^4.1.0, which rejects oversized multi-page images with a 400 before decoding them. ipx is an optional dependency, so after upgrading run npm ls ipx to confirm a patched version resolves.

Behaviour change: /_ipx now only accepts common web image formats as input (JPEG, PNG, WebP, GIF, SVG, AVIF, HEIC) and responds 403 to anything else, before decoding it. If you transform other formats (for example TIFF), list them with the new image.ipx.allowedInputFormats option. For sources you do not fully trust, also consider image.ipx.restrictDecoders, which blocks the decoders of every other format for the whole process.

👉 Changelog

compare changes

🩹 Fixes
  • ipx: require patched ipx and restrict input formats for /_ipx route (GHSA-p5vf-pjf5-ggj3) (750a4f0)
  • ipx: use IPXFetchHandler so srvx/node is not required at runtime (#​2336)
  • ipx: import NitroRuntimeConfig from nitropack/types (#​2354)
🎉 New Contributors
❤️ Contributors

v2.2.0

Compare Source

v2.2.0 is the next minor release.

👉 Changelog

compare changes

🚀 Enhancements
🩹 Fixes
  • use explicit imports in nitro v2 server runtime (#​2347)
  • directus: remove deprecated sharpen option (#​2294)
🏡 Chore
  • exempt first-party packages from pnpm minimumReleaseAge (#​2306)
✅ Tests
  • increase e2e provider test timeout to 60s (#​2350)
🤖 CI
  • only run release workflows in nuxt org (#​2296)
  • use pnpm/setup and devEngines (#​2332)
  • only fail fast in merge groups (de96294)
❤️ Contributors

v2.1.0

Compare Source

v2.1.0 is the next minor release.

👀 Highlights

Nuxt Image 2.1 ships eight new image providers, a major upgrade to our image processing engine, and a bunch of fixes across existing providers.

🖼️ IPX v4

Under the hood, we've upgraded to IPX v4 which brings significant improvements:

  • Smaller bundles: IPX is now ESM-only with reduced dependency size
  • Stronger SVG security: SVG sanitization now always runs, regardless of optimization settings. This fixes a potential XSS vector where svgo: false would return untouched SVGs. The sanitizer now removes SMIL attribute injection, foreign content (<foreignObject>, <iframe>, etc.), and unsafe URIs across all elements
  • New image modifiers: opacity, brightness, saturation, hue, lightness, autoorient, dilate, erode, clahe, and linear
  • Better error messages: Invalid modifier arguments now return 400 errors with clear messages instead of cryptic 500s
  • Custom URL parsing: IPX now supports custom URL formats via the parseURL option
🌐 New Providers

This release adds support for eight new image optimization services:

🔧 Provider Improvements
  • Directus: Added support for sharp transforms and a key modifier for named presets (#​2207)
  • Sanity: Support for absolute URLs with automatic project/dataset extraction (#​2274), and a configurable baseURL for custom CDN setups (#​2273)
  • AWS Amplify & Vercel: minimumCacheTTL is now configurable (#​2278)
📦 Type Exports

NuxtImgProps and NuxtPictureProps are now exported from the runtime, making it easier to type your own components that wrap <NuxtImg> or <NuxtPicture> (#​2115).

import type { NuxtImgProps, NuxtPictureProps } from '#image'

👉 Changelog

compare changes

🚀 Enhancements
  • deps: migrate to ipx v4 (#​2094)
  • provider: add EdgeOne Pages provider (#​2173)
  • imgproxy: add provider (#​2117)
  • directus: add sharp transforms & key modifier (#​2207)
  • sanity: support absolute URLs with project and dataset extraction (#​2274)
  • awsAmplify,vercel: make minimumCacheTTL configurable (#​2278)
  • sanity: add configurable baseURL option to Sanity provider (#​2273)
  • runtime: export Picture and Image props types (#​2115)
  • umbraco: add image provider (#​2165)
  • flyimg: add Flyimg built-in provider (#​2125)
  • cloudflareimages: add new provider (#​2100)
  • builderio: add Builder.io Image API provider (#​2050)
  • picsum: add Lorem Picsum placeholder image provider (#​2106)
  • supabase: add image provider (#​2027)
🩹 Fixes
  • flyimg: encode all # characters in color values (137ee63)
  • remove duplicated provider key in generated image options (#​2279)
  • nuxt-picture: align preload link type with unhead v3 (#​2254)
  • github: set max size of 460 (7e561f6)
  • umbraco: shallow clone modifiers before modifying (237e480)
  • cloudflare: add baseURL for urls with no operations (#​2162)
  • nuxt-img: set imagesrcset preload when densities are set w/o sizes (#​2176)
  • fastly: handle absolute URLs and merge preexisting query params (#​2140)
  • ipx: merge user-defined runtimeConfig.ipx with defaults (#​2134)
  • directus: add withoutEnlargement modifier type (#​2133)
  • shopify: merge preexisting query params with modifiers (#​2135)
  • reduce max-width breakpoint values by 1px (#​2132)
  • netlifyImageCdn,netlifyLargeMedia: set netlify remote_images config (#​2086)
  • deduplicate formats (#​2038)
  • sanitise custom provider import names (#​2092)
  • guard access from layer.config.image (23b8cef)
  • bunny: merge query params with existing image src (#​2054)
  • do not shadow custom provider types with builtins (#​2016)
  • nuxt-picture: allow data-* in imgAttrs (#​2017)
  • resolve public/ dir in relation to rootDir (3e07761)
📖 Documentation
  • sanity: document baseURL option (6f59ab1)
  • shopify: update NuxtImg syntax to use v-bind for modifiers (#​2277)
  • update list of auto-detected providers (#​2147)
  • add sharp cross-platform installation section (#​2142)
  • add preload example for NuxtImg (#​2124)
  • exempt patterns from cf _routes.json (#​2136)
  • update placeholder attributes in <NuxtImg /> example (#​2074)
  • add nuxt.care health badge (93de8a9)
  • update docus and add mcp name (#​2080)
  • reference from Vercel's Edge Network to Vercel's CDN for image optimization. (2deacc0)
  • fix Nuxt badge icon (#​2049)
  • update installation warning (#​2061)
  • fix storyblok links (#​2046)
  • add deno example (#​2012)
📦 Build
  • deps: bump serialize-javascript from 7.0.4 to 7.0.5 (#​2249)
  • deps: bump js-cookie from 3.0.5 to 3.0.7 (#​2248)
  • deps: bump ws from 8.17.1 to 8.20.1 (#​2246)
  • deps: bump h3 from 1.15.6 to 1.15.9 (#​2177)
  • deps: bump h3 from 1.15.4 to 1.15.5 (#​2085)
🏡 Chore
  • run module prepare in prepack (97d3758)
  • move consola to dev dependencies (#​2275)
  • migrate to pnpm v11 (#​2236)
  • migrate resolutions to pnpm-workspace.yaml (9b80ce6)
  • migrate npm badges and links to npmx.dev (fd87f7d)
  • remove unused slot-related code from <NuxtPicture> (#​2145)
  • update lint scripts in package.json (#​2139)
  • remove deprecated github silent config (#​2026)
  • revert pnpm trust policy and restore provenance action (13b88c1)
  • update pnpm to 10.21 and enable trust policy (03b5ef4)
🤖 CI
  • add workflow to comment on issues resolved in the latest release (e529f37)
  • improve workflows (#​2288)
  • migrate to uppt (#​2286)
  • migrate agentscan-action to v2 (2f8b332)
  • add agent-scan workflow to flag bot-authored PRs (23ee710)
  • add merge group config (#​2137)
  • rename workflow (777239c)
  • avoid checkout for reproduction comment (a200dae)
  • pin github actions to full-length commit shas (f60d0f7)
  • unpin workflow (d1cb12b)
  • try pinning (09e5efb)
  • update var (402c729)
  • use new shared dependency review workflow (906111c)
🎉 New Contributors
❤️ Contributors
nuxt/scripts (@​nuxt/scripts)

v1.3.12

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.3.11

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.3.10

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.3.9

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.3.8

Compare Source

   🐞 Bug Fixes
  • registry: Don't declare the global Window via extends (1.x backport)  -  by @​harlan-zw, Togetic and Claude Opus 5 (1M context) in #​880 (be0ce)
    View changes on GitHub

v1.3.7

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.3.6

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.3.5

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.3.4

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.3.3

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.3.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.3.1

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.3.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
nuxt/ui (@​nuxt/ui)

v4.12.0

Compare Source

Features
Bug Fixes
  • App: forward nonce prop (#​7137) (9271533)
  • Chart: render tooltip above center slot (5cf6b3a)
  • ChatMessages/ChatPromptSubmit: add accessible names to icon buttons (#​7153) (3cd30e0)
  • ColorModeButton: resolve label after mount (#​7167) (9a12b1f)
  • components: localize hardcoded accessibility labels (#​7177) (fc7137c)
  • components: prevent empty trailing slot when loading (#​7027) (1f46ce1)
  • components: spin trailing loading icon with avatar (#​7168) (2fc9ba0)
  • ContentSearch/DashboardSearch: handle undefined selection when an item is toggled off (#​7170) (14f13af)
  • ContentToc: raise list min height (#​7113) (2b535b0)
  • Drawer: don't disable body pointer events with noBodyStyles (#​7150) (04f253e)
  • Drawer: emit after:leave and after:enter when the animation ends ([#​7107](https://redirec

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 11 times, most recently from ca1aa21 to 2ef8077 Compare July 6, 2026 09:12
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 7 times, most recently from c51113b to 8e88122 Compare July 9, 2026 05:53
Copilot AI requested a review from TechWatching July 9, 2026 08:19
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 10 times, most recently from f20e9fe to f12fb65 Compare July 12, 2026 11:47
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 14 times, most recently from 71b931a to 764831a Compare July 25, 2026 09:56
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 14 times, most recently from 976b9be to 4bd3867 Compare July 31, 2026 19:49
@renovate

renovate Bot commented Sep 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json
npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm warn Unknown project config "shamefully-hoist". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code EALLOWREMOTE
npm error Fetching packages of type "remote" have been disabled
npm error Refusing to fetch "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.3.tgz"
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-10-31T21_42_18_305Z-debug-0.log

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@TechWatching TechWatching Awaiting requested review from TechWatching

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants