note: la synthèse et les notes de version sont en anglais
note: pas de synthèse pour cette release digest
Les releases digest sont listées sans synthèse. Les notes de version originales de cette version sont ci-dessous.
release-notesgithub.com/nuxt/nuxt · 70 lignes
- > ⚠️ **This is a security release.** We recommend upgrading as soon as possible with `npx nuxt upgrade --dedupe`.
- It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, and dev server path disclosure. Refreshing your lockfile also pulls in `@nuxt/devtools@3.3.1`, which fixes a separate critical development-only RCE.
- If you already upgraded for the earlier route rule advisory ([CVE-2026-53721](https://github.com/nuxt/nuxt/security/advisories/GHSA-mm7m-92g8-7m47)), you still need this release: one of the fixes addresses a regression introduced by that fix.
- Full details: [Nuxt Security Patch Releases](https://nuxt.com/blog/v4-5-security) and [GitHub Security Advisories](https://github.com/nuxt/nuxt/security/advisories).
- ## 👉 Changelog
- [compare changes](https://github.com/nuxt/nuxt/compare/v3.21.9...v3.21.10)
- ### 🩹 Fixes
- - **nuxt:** Clear hide/reset timeouts in set() ([#35534](https://github.com/nuxt/nuxt/pull/35534))
- - **nuxt:** Preserve trailing slash in NuxtLink href when unset ([#35501](https://github.com/nuxt/nuxt/pull/35501))
- - **vite:** Resolve SSR inlined CSS module class name mismatch ([#35610](https://github.com/nuxt/nuxt/pull/35610))
- - **nuxt:** Sync layout meta during middleware on SSR ([#35633](https://github.com/nuxt/nuxt/pull/35633))
- - **nuxt:** Update client URL to match SSR on fatal middleware error ([#35637](https://github.com/nuxt/nuxt/pull/35637))
- - **nuxt:** Watch external component directories in development ([#35652](https://github.com/nuxt/nuxt/pull/35652))
- - **nuxt:** Don't cross-pollute useAsyncData cache on reactive key change ([#35656](https://github.com/nuxt/nuxt/pull/35656))
- - **nuxt:** Return global route for `useRoute` in detached effect scope ([#35659](https://github.com/nuxt/nuxt/pull/35659))
- - **nuxt:** Ignore custom `name` or `path` when reusing an existing page in `pages:extend` ([#35661](https://github.com/nuxt/nuxt/pull/35661))
- - **nuxt:** Preserve explicit `useFetch` method inference ([#35671](https://github.com/nuxt/nuxt/pull/35671))
- - **nuxt:** Correct default export detection in plugin metadata ([#35676](https://github.com/nuxt/nuxt/pull/35676))
- - **nuxt:** Reload real page module on HMR of JSX render-function pages ([#35678](https://github.com/nuxt/nuxt/pull/35678))
- - **vite:** Ensure server sourcemap-preserver plugin actually runs ([#35680](https://github.com/nuxt/nuxt/pull/35680))
- - **nuxt:** Resolve `@unhead/vue/*` from nuxt's dependency tree ([#35690](https://github.com/nuxt/nuxt/pull/35690))
- - **nuxt:** Don't apply scroll behaviour after a subsequent nav ([#35719](https://github.com/nuxt/nuxt/pull/35719))
- - **vite:** Preserve css suffix when extracting ssr inline styles ([#35714](https://github.com/nuxt/nuxt/pull/35714))
- - **nuxt:** Don't exclude client entry module from style extraction ([#35720](https://github.com/nuxt/nuxt/pull/35720))
- - **kit:** Avoid mutating layer configs when resolving options ([#35729](https://github.com/nuxt/nuxt/pull/35729))
- - **nuxt:** Generate layout types even when pages module is disabled ([#35717](https://github.com/nuxt/nuxt/pull/35717))
- - **nitro:** Skip resource hints for stylesheets already rendered as blocking links ([#35691](https://github.com/nuxt/nuxt/pull/35691))
- - **nuxt:** Revalidate cached route payloads instead of using `force-cache` ([#35672](https://github.com/nuxt/nuxt/pull/35672))
- - **nuxt:** Preserve query params in cached payload extraction ([#35696](https://github.com/nuxt/nuxt/pull/35696))
- - **rspack,webpack:** Resolve loaders and runtime deps from nuxt dirs ([#35568](https://github.com/nuxt/nuxt/pull/35568))
- - **nuxt:** Render client components in nested server components ([#35669](https://github.com/nuxt/nuxt/pull/35669))
- - **nuxt:** Remove dev error overlay when error is cleared ([#35821](https://github.com/nuxt/nuxt/pull/35821))
- - **rspack,webpack:** Resolve bundled postcss defaults from builder ([#35823](https://github.com/nuxt/nuxt/pull/35823))
- - **schema:** Normalise slashes in `app.buildAssetsDir` ([#35833](https://github.com/nuxt/nuxt/pull/35833))
- - **nuxt:** Case-fold route rule keys to match folded lookups ([619963309](https://github.com/nuxt/nuxt/commit/619963309))
- - **nitro:** Require loopback peer for chrome devtools workspace endpoint ([00f71bb65](https://github.com/nuxt/nuxt/commit/00f71bb65))
- - **nitro:** Bound island props and v-for to prevent unauthenticated DoS ([668cdfdfd](https://github.com/nuxt/nuxt/commit/668cdfdfd))
- - **nuxt:** Reject reserved `template` island prop under runtime compiler ([5b60017f7](https://github.com/nuxt/nuxt/commit/5b60017f7))
- - **nuxt:** Reject top-level `as` prop for islands ([00a2b0494](https://github.com/nuxt/nuxt/commit/00a2b0494))
- ### 📖 Documentation
- - Document relative baseURL workarounds ([#34004](https://github.com/nuxt/nuxt/pull/34004))
- - Warn about `runtimeCompiler` security best practices ([b76c1a8bd](https://github.com/nuxt/nuxt/commit/b76c1a8bd))
- - Warn about validating server component props ([f6d72628d](https://github.com/nuxt/nuxt/commit/f6d72628d))
- ### ✅ Tests
- - Guard against transient undefined `_route` in gotoPath ([5391e7e6a](https://github.com/nuxt/nuxt/commit/5391e7e6a))
- - Raise route-HMR polling timeout to reduce e2e flakiness ([cbc757c63](https://github.com/nuxt/nuxt/commit/cbc757c63))
- - **kit:** Scope loadNuxt temp dir so it doesn't delete sibling fixtures ([72e4b5578](https://github.com/nuxt/nuxt/commit/72e4b5578))
- ### ❤️ Contributors
- - Daniel Roe (@danielroe)
- - Florian Heuberger (@Flo0806)
- - Matej Černý (@cernymatej)
- - bdbch (@bdbch)
- - Elecmonkey (@elecmonkey)
- - Ryota Watanabe (@wattanx)
- - kealan (@KealanAU)
- - Julien Huang (@huang-julien)
- - Luke Nelson (@luc122c)
- - Harlan Wilton (@harlan-zw)
- - Mateleo (@Mateleo)
- - lutejka (@lutejka)
- - Darlan José Batista do Prado (@DarlanPrado)
- - Max (@onmax)
- - Sushant (@sushantguri)
- - raminjafary (@raminjafary)