chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: nuxt.

Updates nuxt from 4.4.8 to 4.5.1

Release notes

Sourced from nuxt's releases.

v4.5.1

⚠️ This is a security release. We recommend upgrading as soon as possible with npx nuxt upgrade --dedupe.

It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, cross-user payload disclosure on cached pages, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.

If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.

If you use the cache, swr or isr route rules, purge any CDN or edge cache after upgrading; a leaked _payload.json may already be cached upstream.

Full details: Nuxt Security Patch Releases and GitHub Security Advisories.

👉 Changelog

compare changes

🔥 Performance

• nitro: Replace island teleports in a single html pass (#35515)
• nuxt: Add vue.optionsApi and disable it for v5+ (#35791)
• nuxt: Without pages, skip client plugins that require routing (#35794)
• nuxt: Skip payload revival plugin when ssr: false (#35782)

🩹 Fixes

• nitro: Read rspack dev output fs lazily for server entry (#35740)
• rspack,webpack: Resolve loaders and runtime deps from nuxt dirs (#35568)
• nuxt: Return global route for useRoute in detached effect scope (#35659)
• nuxt: Ignore custom name or path when reusing an existing page in pages:extend (#35661)
• nuxt: Render client components in nested server components (#35669)
• nuxt: Preserve explicit useFetch method inference (#35671)
• nuxt: Revalidate cached route payloads instead of using force-cache (#35672)
• nuxt: Correct default export detection in plugin metadata (#35676)
• nuxt: Clear hide/reset timeouts in set() (#35534)
• kit,nuxt,rspack,schema,webpack: Add .mts file extension in resolver (#33845)
• nuxt: Preserve trailing slash in NuxtLink href when unset (#35501)
• nuxt: Don't cross-pollute useAsyncData cache on reactive key change (#35656)
• nuxt: Filter plugin dependencies by build target (#35682)
• nuxt: Reload real page module on HMR of JSX render-function pages (#35678)
• nuxt: Resolve @unhead/vue/* from nuxt's dependency tree (#35690)
• kit: Surface module load errors instead of masking as missing (#35497)
• nuxt: Type auto-imported $fetch with nitro's $Fetch (#35704)
• nuxt: Don't reference app config sources in shared and node tsconfigs (#35673)
• vite: Resolve SSR inlined CSS module class name mismatch (#35610)
• nuxt: Generate layout types even when pages module is disabled (#35717)
• nitro: Skip resource hints for stylesheets already rendered as blocking links (#35691)
• kit: Dedupe layers that are both auto-scanned and explicitly extended (#35712)
• nuxt: Don't apply scroll behaviour after a subsequent nav (#35719)
• vite: Ensure server sourcemap-preserver plugin actually runs (#35680)
• vite: Preserve css suffix when extracting ssr inline styles (#35714)
• nuxt: Watch external component directories in development (#35652)
• nuxt: Don't exclude client entry module from style extraction (#35720)
• nuxt: Amend cleanup command in NUXT_B7014 error message (#35735)
• nuxt: Only pull in vue-router when there are island pages (#35739)
• vite: Suppress external warnings for internal vite-node paths (#35744)

... (truncated)

Commits

• 452dd50 v4.5.1
• 581651f fix(nuxt): reject top-level as prop for islands
• ee6c846 fix(nuxt): reject reserved template island prop under runtime compiler
• ad624a7 fix(nuxt): case-fold route rule keys to match folded lookups
• 4e35ae9 fix(nitro): bound island props and v-for to prevent unauthenticated DoS
• 352135f fix(nuxt): remove dev error overlay when error is cleared (#35821)
• b1a8e93 fix(nitro,nuxt,vite): dedupe and normalise global css links in dev (#35834)
• df55902 fix(nuxt): convert inline route rules exactly or drop with a warning (#35455)
• 083b750 fix(nuxt): warn when an imports preset from cannot be resolved (#35799)
• 61eb637 perf(nuxt): skip payload revival plugin when ssr: false (#35782)
• Additional commits viewable in compare view

Updates @nuxt/devtools from 3.2.4 to 3.4.2

Release notes

Sourced from @​nuxt/devtools's releases.

v3.4.2

   🐞 Bug Fixes

• devtools: Update client for unhead v3 and restore $fetch types  -  by @​antfu in nuxt/devtools#1077 (0fcb5)
• ui-kit: Dedupe mkdist so dist ships .vue SFCs  -  by @​antfu in nuxt/devtools#1078 (48a93)

    View changes on GitHub

v3.4.1

   🐞 Bug Fixes

• devtools: Prevent StateEditor from freezing the page on live state  -  by @​antfubot in nuxt/devtools#1058 (06249)

    View changes on GitHub

v3.4.0

   🚀 Features

• Upgrade @vitejs/devtools-kit to v0.4.10  -  by @​antfu (5cea1)

   🐞 Bug Fixes

• devtools: Continue hardening the RPC surface  -  by @​antfubot in nuxt/devtools#1049 (7f072)

    View changes on GitHub

v3.3.1

No significant changes

    View changes on GitHub

v3.3.0

   🐞 Bug Fixes

• devtools: Require dev auth token for openInEditor and options RPC methods  -  by @​antfubot in nuxt/devtools#1039 (a7b27)

    View changes on GitHub

v3.2.6

   🐞 Bug Fixes

• Nuxt api url  -  by @​antfu (1f0b2)

    View changes on GitHub

Changelog

Sourced from @​nuxt/devtools's changelog.

3.4.2 (2026-08-22)

Bug Fixes

• devtools: update client for unhead v3 and restore $fetch types (#1077) (0fcb59a)
• ui-kit: dedupe mkdist so dist ships .vue SFCs (#1078) (48a93c7)

3.4.1 (2026-08-04)

Bug Fixes

• devtools: prevent StateEditor from freezing the page on live state (#1058) (0624919)

3.4.0 (2026-07-29)

Bug Fixes

• devtools: continue hardening the RPC surface (#1049) (7f072dc)

Features

• upgrade @vitejs/devtools-kit to v0.4.10 (5cea1a1)

3.3.1 (2026-07-24)

3.3.0 (2026-07-24)

Bug Fixes

• devtools: require dev auth token for openInEditor and options RPC methods (#1039) (a7b2718)

3.2.6 (2026-07-17)

Bug Fixes

... (truncated)

Commits

• a9f5ab6 chore: release v3.4.2
• 0fcb59a fix(devtools): update client for unhead v3 and restore $fetch types (#1077)
• 39a6dbb chore: release v3.4.1
• e2de554 chore: update deps
• 0624919 fix(devtools): prevent StateEditor from freezing the page on live state (#1058)
• 0ceaa45 chore: release v3.4.0
• 5cea1a1 feat: upgrade @vitejs/devtools-kit to v0.4.10
• 7f072dc fix(devtools): continue hardening the RPC surface (#1049)
• 9a2da33 chore: release v3.3.1
• 12eb2a3 chore: release v3.3.0
• Additional commits viewable in compare view

Updates svgo from 4.0.1 to 4.1.0

Release notes

Sourced from svgo's releases.

v4.1.0

This minor release upgrades the SAX parser and introduces stricter XML validation. It also includes important security hardening for removeScripts, dependency updates, and improvements to the test and regression infrastructure.

Support SVGO

If SVGO is valuable to you or your organization, please consider supporting the project on OpenCollective. Your sponsorship helps fund ongoing maintenance and security work.

Stricter XML validation

SVGO now uses sax 1.6.1, upgraded from 1.5.0 (#2257).

The new parser version validates numeric character references against the ranges permitted by XML. Invalid references are now rejected in both text and attributes, including:

• disallowed control characters such as &[#1](https://github.com/svg/svgo/issues/1);, , and ;
• UTF-16 surrogate code points such as �;
• invalid XML code points such as .

Valid boundary values—including U+0020, U+D7FF, U+E000, U+FFFD, and characters through U+10FFFF—remain supported.

Parser failures are consistently exposed as SvgoParserError errors with an Invalid character entity reason.

This is an intentional behavior change: malformed SVGs that were previously accepted may now produce a parser error, while valid XML documents are unaffected.

Security

The removeScripts plugin has been hardened against several script-execution bypasses:

• Filters executable data: URLs containing HTML, XHTML, or SVG documents while preserving inert data such as PNG images, and filters legacy vbscript: URLs (#2263).
• Sanitizes content inside SVG <foreignObject> elements by removing HTML event-handler attributes, srcdoc, and executable URLs from action, data, formaction, href, and src, while preserving non-executable HTML and visual content (#2264).
• Recognizes namespace-prefixed SVG <a> elements and removes ASCII tabs and newlines before checking URL schemes, preventing values such as java&[#9](https://github.com/svg/svgo/issues/9);script: from bypassing detection while preserving elements in unrelated custom namespaces (#2268).

These changes address:

• GHSA-4vpr-x523-8j87
• GHSA-w27v-7q3p-w38r

Dependencies

• Upgraded css-select to v6 and css-what to v7, and updated SVGO's custom selector adapter for css-select v6 (#2244).

Project maintenance

@​TrySound is back as an active SVGO maintainer.

Many thanks to @​KTibow, @​SethFalco, and @​XhmikosR for maintaining and improving SVGO over the past several years.

Full Changelog: svg/svgo@v4.0.2...v4.1.0

v4.0.2

... (truncated)

Commits

• 5765cbe chore: prepare v4.1.0 release (#2275)
• 3db3ef3 fix(removeScripts): handle anchor URL bypasses (#2268)
• 4e9b9ae chore: cache regression screenshots (#2267)
• d55270c chore(regression): migrate comparison workers to Tinypool (#2266)
• fd51e47 fix(removeScripts): sanitize foreignObject content (#2264)
• dcaf957 chore: optimize fixtures in a bounded worker pool (#2265)
• a354293 fix(removeScripts): filter executable data URLs (#2263)
• 4e0d2ac ci(typecheck): return typechecking on CI
• 0b97fed test(typescript): drop tsd for vitest type testing API
• f6e8ae1 chore(pnpm): drop package.json#pnpm.onlyBuiltDependencies
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for svgo since your current version.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	useclassy-com	d063d79	Sep 05 2026, 09:56 PM