[dependabot]

Bumps the npm group with 14 updates in the / directory:

Package	From	To
@nuxt/content	3.15.2	3.16.1
nuxt	4.5.2	4.6.0
shiki	4.4.2	4.5.0
vue	3.5.41	3.5.43
vue-router	5.2.0	5.4.0
@nuxt/test-utils	4.1.0	4.3.3
@vitejs/plugin-vue	6.0.8	6.0.9
@vue/test-utils	2.4.11	2.5.1
happy-dom	20.11.2	20.14.5
playwright-core	1.62.1	1.64.0
sanitize-html	2.17.6	2.18.0
@types/sanitize-html	2.16.1	2.16.2
vitest	4.1.10	5.0.3
yaml	2.9.0	2.9.1

Updates @nuxt/content from 3.15.2 to 3.16.1

Changelog

Sourced from @​nuxt/content's changelog.

3.16.1 (2026-09-21)

Features

• add content.llms option to disable the nuxt-llms integration (#3843) (656a5ce)

Bug Fixes

• security: avoid ReDoS in assertSafeQuery (#3851) (f8be485)

3.16.0 (2026-08-27)

Bug Fixes

• avoid install prompt in non-interactive environments (#3833) (2d0e84b)
• ContentRenderer: keep async component identity stable across re-resolves (#3835) (dcf86e6)
• improve generated git cache key (#3839) (d1e353e)
• module: keep content templates when building with _prepare (#3837) (e390c3b)
• nuxthub: handle object form of hub.db (#3822) (8841abc)
• query: tolerate trailing slashes in path-based lookups (#3838) (220d392)
• runtime: use dynamic import for #content/adapter to prevent prerender failure (#3830) (400390a)
• use UTC getters in formatDate/formatDateTime to prevent timezone drift (#3782) (9f1f89a)

Commits

• f0a2e2c chore(release): v3.16.1
• c2f3e70 chore: update test utils version
• 0402758 chore: upgrade deps & lockfile (#3857)
• f8be485 fix(security): avoid ReDoS in assertSafeQuery (#3851)
• 656a5ce feat: add content.llms option to disable the nuxt-llms integration (#3843)
• 850e3f0 chore(release): v3.16.0
• be97f81 chore: upgrade @nuxtjs/mdc
• ae50a2a chore: upgrade deps
• 9f1f89a fix: use UTC getters in formatDate/formatDateTime to prevent timezone drift (...
• d6dad02 chore: disable stale schedule
• Additional commits viewable in compare view

Updates nuxt from 4.5.2 to 4.6.0

Release notes

Sourced from nuxt's releases.

v4.6.0

v4.6.0 is the next minor release.

📣 Some news

🖥️ Nuxt CLI v4

Alongside the release of Nuxt v4.6, today also brings a new major release of the Nuxt CLI: @nuxt/cli v4. It ships as a dependency of nuxt, so you'll get it automatically when you upgrade.

Most of what's new is in nuxt dev:

• an interactive terminal UI, showing URLs, startup progress and keyboard shortcuts, with panels to dive into error logs, routes, network requests and more
• the dev server gives you more info, such as why it reloaded or restarted, which nuxt.config keys changed, where the time went during a slow start or build, and how long each module took to set up
• a CLI-level error channel rendered with my-bad (see below), powering things like automatically reloading when a syntax error in nuxt.config.ts is fixed
• a lock file in .nuxt/, which lets a second nuxt dev (say, one started by an agent) take over or defer to the one you started, and powers new nuxt curl and nuxt task commands that talk to the running server

There's also a new nuxt docs "<query>" search, and nuxt preview --takeover can replace a running preview server. And in general nuxt/cli is a lot smaller and starts a lot faster:

	v3.37	v4.0
@nuxt/cli install size	13.1 MB	3.5 MB	-73%
@nuxt/cli dependencies	70	31	-56%
nuxt dev: first paint	330 ms	50 ms	6.6x faster
nuxt dev: port bound	338 ms	104 ms	3.2x faster
nuxt dev: memory at rest (Linux)	630 MB	440 MB	-30%

Although this is a major version, none of the changes should be breaking for Nuxt v4 users: we require Node.js v22.21+, v24.11+ or v26+, we drop nuxt init and only support npm create nuxt@latest, and Nuxt 2 and @nuxt/bridge are no longer supported.

👉 Check out the full Nuxt CLI v4 release notes for everything that's changed.

💡 A server-agnostic Nuxt

The biggest thing about this release is our move towards making Nuxt server-agnostic.

I feel that freedom of choice is very much a fundamental value of the web, and one that unites the whole Nuxt team.

You can use pages/ (with vue-router) or not. You can use Vite, webpack or Rspack to bundle your code. You can pick from dozens of providers to deploy to, pick any image or font provider, choose any database adapter. In every case, the framework is the same.

The server side was different. #app composables imported h3 types, server code imported from h3 and nitropack, and every module that touched the server was tied to whichever major version of those packages Nuxt happened to depend on.

This has become particularly clear as we have been upgrading to new majors of h3 and nitro, which ship breaking changes with a cascading effect throughout the whole ecosystem.

👉 This release changes that.

Alongside explicitly defining our public API in nuxt/kit (which now does not refer to external packages), Nuxt now specifies our own types for the request event, route rules and typed $fetch, and we expose an import surface (nuxt/server) for the server utilities that will be needed by most apps.

This is the culmination of work we started almost a year ago, making it possible to use any server builder with Nuxt, not just Nitro (#33462).

... (truncated)

Commits

• 49da92f v4.6.0
• 052d82e chore(deps): update all non-major dependencies (4.x) (#36463)
• df46569 fix(nuxt): resolve anchor hrefs through the router (#36459)
• a66221f fix(nuxt): leave a newer async data entry alone when an old one is taken off ...
• f90115c fix(nuxt): await async layouts before navigation (#36454)
• b64d878 fix(nuxt,vite): show compile error overlay on client-only pages (#36444)
• 62ebbd9 fix(nuxt): keep CookieOptions compatible with cookie serialize options
• a2b9145 fix(kit,nuxt): preserve types when building into a relocated build dir (#36418)
• c4f1e97 feat(nuxt): add addon support to createUseFetch and createUseAsyncData (#...
• e003cd4 feat(nuxt,nitro,schema): add useServerHooks to nuxt/server
• Additional commits viewable in compare view

Updates shiki from 4.4.2 to 4.5.0

Release notes

Sourced from shiki's releases.

v4.5.0

   🚀 Features

• Emit an explicit color level from codeToANSI  -  by @​EvanProgramming in shikijs/shiki#1320 (b968e)
• transformers:
  • Add classActiveCode option to transformerNotationWordHighlight  -  by @​curiouscoder-cmd in shikijs/shiki#1201 (1e968)
  • Add transformerRenderLineNumber  -  by @​Divyapahuja31 and DIVYA PAHUJA in shikijs/shiki#1238 (02f05)

   🐞 Bug Fixes

• cli:
  • Fall back to 'text' when file/URL has no extension and no -…  -  by @​VeerShah41 in shikijs/shiki#1248 (c00e5)
  • Fall back to plaintext for unknown languages  -  by @​Jinjiang and @​antfubot in shikijs/shiki#1319 (4eb7c)
• primitive:
  • Dispose wasm memory for lazily embedded langs  -  by @​rgodha24 in shikijs/shiki#1322 (b5423)
  • Dedupe grammar injections on repeated language loads  -  by @​antlio and @​antfubot in shikijs/shiki#1318 (33678)
• stream:
  • Compile Solid renderer with babel-preset-solid  -  by @​BetterAndBetterII and @​antfu in shikijs/shiki#1309 (8724e)
• transformers:
  • Keep notations on content comment lines  -  by @​tianrking in shikijs/shiki#1308 (d25ab)
  • Handle split # and -- comments in rose-pine theme  -  by @​anandghegde in shikijs/shiki#1317 (63e6d)
• twoslash:
  • Avoid crash when @​errors nodes land past EOF  -  by @​Yahiro025, @​cursoragent and @​antfubot in shikijs/shiki#1316 (5c919)

   🏎 Performance

• engine-js: Reuse each regex's last search while tokenizing a line  -  by @​issacgerges and @​antfu in shikijs/shiki#1314 (2ef5e)
• stream: Group tokens by line in the React renderer  -  by @​CNSeniorious000 in shikijs/shiki#1311 (81200)
• vitepress-twoslash: Replace lz-string with lz-string-es  -  by @​antfubot in shikijs/shiki#1324 (2e170)

    View changes on GitHub

v4.4.3

   🚀 Features

• Update deps and grammar  -  by @​antfu (72f26)

   🐞 Bug Fixes

• vitepress-twoslash: Delay twoslash tooltip show by 200ms  -  by @​antfubot in shikijs/shiki#1306 (9f2aa)

    View changes on GitHub

Commits

• f7d0167 chore: release v4.5.0
• 48cd2cc chore: release v4.4.3
• See full diff in compare view

Updates vue from 3.5.41 to 3.5.43

Release notes

Sourced from vue's releases.

v3.5.43

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.42

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.43 (2026-09-17)

Bug Fixes

• compiler-sfc: ignore comment delimiters inside strings and url() when parsing css vars (#15548) (2fde323)
• compiler-sfc: prepend semicolon for await in switch case (#15498) (9a1df69), closes #15495
• compiler-sfc: restore await scope when leaving nested blocks (5409708), closes #15465
• compiler-sfc: reuse parsed parent configs across tsconfig walks (fix #15478) (#15480) (d6febaa)
• hydration: run leave hooks for hydration placeholders (#15431) (5dda192)
• reactivity: preserve readonly wrappers in array copy methods (#15469) (599f35b)
• runtime-core: unmount v-once children after parent rerenders (#15435) (d720338)
• shared: handle circular references in looseEqual (#15499) (718f782), closes #15496
• shared: preserve comment-like text in style values (#15471) (b9456cb)
• suspense: don't drop nested suspense patches during hydration (#15429) (76d42dc)
• suspense: keep the boundary pending while its branch is patched (#15411) (bfcfe9e), closes #7506
• suspense: patch a hydrating boundary's pending branch in place (#15432) (2cde6f7)
• suspense: unmount the DOM an interrupted async component claimed (#15430) (fb9b45c)
• types: keep optional props when a runtime prop uses a generic PropType (#15523) (243aabc), closes #9546

3.5.42 (2026-08-27)

Bug Fixes

• hydration: handle async component unmount before lazy hydration (#15252) (6e1814a)
• hydration: handle moving unresolved async fragment (#15263) (a72036f)
• runtime-core: avoid caching unmounted suspense children (#15291) (b535917), closes #15288
• runtime-core: keep .trim result when combined with .number v-model modifier (#15346) (f8d42e1)
• runtime-core: resolve $el for dev root comment fragment (#15313) (8654f35), closes #12680
• runtime-dom: support !important on CSS custom properties in style binding (#15348) (31da934)
• server-renderer: reject CR in attribute names (#15266) (a2b40db)
• shared: correctly compare Map and Set values (#15328) (ef82a26), closes #15320
• suspense: don't treat the leaving branch as the fallback while its mount is pending (#15333) (cd19745), closes #15332
• v-model: re-sync select when model is overridden in change handler (#15298) (6eaecc1), closes #10505

Commits

• 5be58b4 release: v3.5.43
• a0b61aa chore: remove and ignore generated git hooks
• 2fde323 fix(compiler-sfc): ignore comment delimiters inside strings and url() when pa...
• 599f35b fix(reactivity): preserve readonly wrappers in array copy methods (#15469)
• 55a2b45 chore(deps): update pnpm to v12 (#15439)
• 243aabc fix(types): keep optional props when a runtime prop uses a generic PropType (...
• 718f782 fix(shared): handle circular references in looseEqual (#15499)
• 9a1df69 fix(compiler-sfc): prepend semicolon for await in switch case (#15498)
• d6febaa fix(compiler-sfc): reuse parsed parent configs across tsconfig walks (fix #15...
• b9456cb fix(shared): preserve comment-like text in style values (#15471)
• Additional commits viewable in compare view

Updates vue-router from 5.2.0 to 5.4.0

Release notes

Sourced from vue-router's releases.

v5.4.0

   🚨 Breaking Changes

• experimental: Normalize query values to arrays  -  by @​posva in vuejs/router#2824 (f1fbc)

   🚀 Features

• Accept a prebuilt matcher in createRouter  -  by @​danielroe in vuejs/router#2804 (9de96)
• UseScrollRestoration and onRouteRendered  -  by @​posva in vuejs/router#2805 (e3dde)
• Diagnose experimental beforeEnter migration  -  by @​posva (b695c)
• experimental:
  • Warn about legacy optional param removal  -  by @​posva in vuejs/router#2818 (c2f92)
  • Extract hash params with definePage  -  by @​posva (dbf2d)
  • Configure required and default hash params  -  by @​posva (cef5c)
  • Never decode the hash, protect-only encoding  -  by @​posva in vuejs/router#2760 (aca2c)
  • Allow custom regexp for path params in definePage  -  by @​posva in vuejs/router#2822 (3a192)
• router:
  • Restore hashes and top by default  -  by @​posva (7c385)

   🐞 Bug Fixes

• Resolve experimental guard redirects against target on history navigation  -  by @​posva (2c5fb)
• experimental:
  • Keep declared case of static prefix in MatcherPatternPathStar.build()  -  by @​contactjawad in vuejs/router#2798 (4dc6b)
  • Make hash params optional and nullable  -  by @​posva (d9a4c)
  • Exclude defaults from required hash params  -  by @​posva (346e2)
  • Align hash parameter parsing with queries  -  by @​posva (cf251)
  • Keep last hash param instead of throwing  -  by @​posva (d1e8a)
  • Disallow required with a default for query params  -  by @​posva (f60e9)
  • Make query params with a default optional on push  -  by @​posva (fb604)
  • Do not inherit params, query, or hash on redirects  -  by @​posva (02a92)
• history:
  • Invalidate obsolete scroll positions  -  by @​posva and @​liuly0322 in vuejs/router#2814 (071f1)
• unplugin:
  • Sanitize named view in definePage import  -  by @​giaBaoJS in vuejs/router#2809 (0711d)
  • Keep hex character codes in param segments regexp  -  by @​kwy404 in vuejs/router#2811 (07663)

   🏎 Performance

• unplugin: Cache merged route overrides  -  by @​posva in vuejs/router#2821 (732b7)

    View changes on GitHub

v5.3.1

   🐞 Bug Fixes

• experimental: Handle non-string params for isActive  -  by @​posva (92cfd)

    View changes on GitHub

... (truncated)

Commits

• 596d481 release: vue-router@5.4.0
• 2970e8e chore: fix back extends
• 16a62f8 chore(deps): upgrade dependencies (#2828)
• b810a7e chore: remove unused types
• a0efbde docs: adapt
• 2c5fbd6 fix: resolve experimental guard redirects against target on history navigation
• 6ef3163 refactor: allow undefined on optional param
• 8e89a60 chore: comment
• 72ceb99 refactor: absolute position
• 57dd1d6 refactor: allow guards to return relative location
• Additional commits viewable in compare view

Updates @nuxt/test-utils from 4.1.0 to 4.3.3

Release notes

Sourced from @​nuxt/test-utils's releases.

v4.3.3

v4.3.3 is the next patch release.

👉 Changelog

compare changes

🔥 Performance

• use h3's toWebHandler instead of node-mock-http (abe8ad944)
• resolve h3 from the project (b5d802f03)
• replace estree-walker with oxc-walker (8e8ca5e8b)
• replace local-pkg with exsolve (38938a879)
• replace c12 with native dotenv parsing (26c72afa0)
• inline destr and scule usage (e4bfd2ebe)
• drop node-fetch-native polyfill (6b654de5c)
• replace nypm with package-manager-detector (#1828)

🩹 Fixes

• runtime-utils: type registerEndpoint against the project h3 (#1831)
• e2e: restore console after use nuxt kit (#1817)
• config: exclude aliased mock packages from optimizeDeps in browser mode (#1816)
• runtime: setup nuxt once per worker in no-isolate (#1821)
• browser: correct render helper options type (#1822)

🏡 Chore

• move vue to peer dependencies (e70592ffa)
• declare supported nuxt versions as peer dependency (b473892c9)

🤖 CI

• run tests in merge queues (0ad46c892)
• use pnpm/setup and devEngines (#1814)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Yoshihiro Yamaguchi (@​yamachi4416)

v4.3.2

v4.3.2 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes

... (truncated)

Commits

• 5498f4b v4.3.3 (#1815)
• 22da0ec fix(runtime-utils): type registerEndpoint against the project h3 (#1831)
• 37a4f7e fix(e2e): restore console after use nuxt kit (#1817)
• a0a45f9 chore(deps): update nuxt framework to v5.0.0-29846154.7802b2c2 (#1830)
• 2d14404 chore(deps): update all non-major dependencies (#1819)
• 76be5bf fix(config): exclude aliased mock packages from optimizeDeps in browser mode ...
• eb96489 chore(deps): update pnpm-workspace.overrides @​types/node to v24.19.0 (#1824)
• 9062ef9 chore(deps): update nitro to v2.0.1-rc.32 (#1823)
• 7ca0d4c fix(runtime): setup nuxt once per worker in no-isolate (#1821)
• bafda8c chore(deps): update vitest to v5.0.2 (#1825)
• Additional commits viewable in compare view

Updates @vitejs/plugin-vue from 6.0.8 to 6.0.9

Release notes

Sourced from @​vitejs/plugin-vue's releases.

plugin-vue@6.0.9

Please refer to CHANGELOG.md for details.

Changelog

Sourced from @​vitejs/plugin-vue's changelog.

6.0.9 (2026-09-14)

Bug Fixes

• deps: update all non-major dependencies (#812) (b2b559d)
• plugin-vue: initialize compiler correctly (#475) (127b03f)
• plugin-vue: transpile TS in templates with empty script block (#838) (189148e)

Miscellaneous Chores

• deps: update dependency obug to v3 (#846) (3180192)

Commits

• 822c69d release: plugin-vue@6.0.9
• 127b03f fix(plugin-vue): initialize compiler correctly (#475)
• 3180192 chore(deps): update dependency obug to v3 (#846)
• 189148e fix(plugin-vue): transpile TS in templates with empty script block (#838)
• b2b559d fix(deps): update all non-major dependencies (#812)
• See full diff in compare view

Updates @vue/test-utils from 2.4.11 to 2.5.1

Release notes

Sourced from @​vue/test-utils's releases.

v2.5.1

What's Changed

• fix: generic SFC findComponent types by @​simonyang08 in vuejs/test-utils#2934
• fix: share config across builds by @​cexbrayat in vuejs/test-utils#2937

New Contributors

• @​simonyang08 made their first contribution in vuejs/test-utils#2934

Full Changelog: vuejs/test-utils@v2.5.0...v2.5.1

v2.5.0

⚠️ Breaking change: Vue Test Utils no longer supports class components. See #2904.

What's Changed

• fix: keep re-rendering root component after another wrapper is mounted by @​lazerg in vuejs/test-utils#2890
• fix: correct summary element behavior by @​nn-morishita in vuejs/test-utils#2806
• fix: clear emitted event history for child components on unmount by @​ebiryu in vuejs/test-utils#2898
• chore!: drop class component support by @​cexbrayat in vuejs/test-utils#2904
• fix: expose defineExpose bindings on findComponent vm by @​adamberecz in vuejs/test-utils#2927

New Contributors

• @​MetRonnie made their first contribution in vuejs/test-utils#2885
• @​lazerg made their first contribution in vuejs/test-utils#2890
• @​bartlomieju made their first contribution in vuejs/test-utils#2892
• @​nn-morishita made their first contribution in vuejs/test-utils#2806
• @​ebiryu made their first contribution in vuejs/test-utils#2898
• @​chiaraani made their first contribution in vuejs/test-utils#2916
• @​souserge made their first contribution in vuejs/test-utils#2695
• @​adamberecz made their first contribution in vuejs/test-utils#2927

Full Changelog: vuejs/test-utils@v2.4.11...v2.5.0

Commits

• dcb5d6c v2.5.1 (#2945)
• 4d4f733 chore(deps): update all non-major dependencies (#2944)
• 9bd5eb7 chore(deps): update dependency oxfmt to v0.67.0 (#2943)
• e8abdb7 chore(deps): update vitest to v5 (#2942)
• 4f3a372 chore(deps): update pnpm to v12 (#2940)
• 84c7504 chore(deps): update pnpm/action-setup action to v6.1.0 (#2939)
• af30f8e chore(deps): update dependency oxfmt to v0.66.0 (#2938)
• 028e4c1 docs: explain global config sharing
• 261ac26 fix: share config across builds
• 133e80c fix: generic SFC findComponent types (#2934)
• Additional commits viewable in compare view

Updates happy-dom from 20.11.2 to 20.14.5

Release notes

Sourced from happy-dom's releases.

v20.14.5

👷‍♂️ Patch fixes

• Preserve character references in comment data - By @​hampustagerud in task #2409

v20.14.4

👷‍♂️ Patch fixes

• End comments at the first comment end tag when it overlaps a comment start tag - By @​hampustagerud in task #2407

v20.14.3

👷‍♂️ Patch fixes

• Avoids cloning all properties in CSSPropertyManager.toString - By @​erictheswift in task #2363

v20.14.2

👷‍♂️ Patch fixes

• Fixes regression where not all CSS variables where resolved in getComputedStyle() - By @​klaesra in task #2344

v20.14.1

👷‍♂️ Patch fixes

• Invalidate the computed style cache for the whole subtree - By @​matmannion and @​capricorn86 in task #2366

v20.14.0

🎨 Features

• Improves computed style cache - By @​capricorn86 in task #2357

v20.13.2

👷‍♂️ Patch fixes

• Fix problem with getComputedStyle with :host and :host-context selectors - By @​capricorn86 in task #2349

v20.13.1

👷‍♂️ Patch fixes

• GetComputedStyle should return inherited value when it is set to inherit - By @​capricorn86 in task #2347

v20.13.0

🎨 Features

• Adds support for :host psuedo query selector - By @​capricorn86 in task #2345

v20.12.2

👷‍♂️ Patch fixes

• Custom elements should be upgraded when connected to DOM - By @​capricorn86 in task #2342

v20.12.1

🎨 Features

• Adds support for kebab-case properties on CSSStyleDeclaration - By @​capricorn86 in task #2256
• Adds support for all Chromium CSS properties to CSSStyleDeclaration - By @​capricorn86 in task #2256
  • Downloads a list from the Chromium project when compiling

👷‍♂️ Patch fixes

• Fixes issue with parsing CSS fallback variables - By @​capricorn86 in task #2256

v20.12.0

... (truncated)

Commits

• 0d4cdbe fix: #2409 Preserve character references in comment data (#2410)
• 9c920a4 fix: #2407 End comments at the first comment end tag when it overlaps a com...
• 5fb1df3 fix: #2363 Avoids cloning all properties in CSSPropertyManager.toString() (...
• de0a1e9 fix: #2344 Resolve every var() in a value, not only the first one (#2395)
• 64b8b94 fix: #2366 Invalidate the computed style cache for the whole subtree (#2367)
• eac5a38 feat: #2357 Improves computed style cache (#2358)

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.