[dependabot]

Bumps the npm group with 15 updates in the / directory:

Package	From	To
@nuxt/content	3.15.2	3.16.2
nuxt	4.5.2	4.6.2
shiki	4.4.2	4.5.0
vue	3.5.41	3.5.44
vue-router	5.2.0	5.4.0
@nuxt/test-utils	4.1.0	4.3.4
@vitejs/plugin-vue	6.0.8	6.0.10
@vue/test-utils	2.4.11	2.5.1
happy-dom	20.11.2	21.0.4
nuxt-studio	1.7.0	1.8.0
playwright-core	1.62.1	1.64.1
sanitize-html	2.17.6	2.18.1
@types/sanitize-html	2.16.1	2.16.2
vitest	4.1.10	5.0.5
yaml	2.9.0	2.9.1

Updates @nuxt/content from 3.15.2 to 3.16.2

Changelog

Sourced from @​nuxt/content's changelog.

3.16.2 (2026-10-12)

Bug Fixes

• api: don't forward body headers to internal content requests (#3868) (ffa5ac3)
• cache: await development cache replacement (#3846) (75eff79)
• continue when package manager exits non-zero after installing (#3871) (ebfdc2c), closes #3849
• search: preserve word boundaries between block elements (#3861) (05a3074)
• security: accept only query-builder WHERE clauses (#3877) (9fae87e)
• security: standard quotes and block IN operator validate (#3862) (006d138)

Performance Improvements

• cache: avoid repeated cache index copies (#3847) (464fb16)
• navigation: skip unused leaf sibling searches (#3845) (6fc1e26)

3.16.1 (2026-09-21)

Features

• add content.llms option to disable the nuxt-llms integration (#3843) (656a5ce)

Bug Fixes

• security: avoid ReDoS in assertSafeQuery (#3851) (f8be485)

3.16.0 (2026-08-27)

Bug Fixes

• avoid install prompt in non-interactive environments (#3833) (2d0e84b)
• ContentRenderer: keep async component identity stable across re-resolves (#3835) (dcf86e6)
• improve generated git cache key (#3839) (d1e353e)
• module: keep content templates when building with _prepare (#3837) (e390c3b)
• nuxthub: handle object form of hub.db (#3822) (8841abc)
• query: tolerate trailing slashes in path-based lookups (#3838) (220d392)
• runtime: use dynamic import for #content/adapter to prevent prerender failure (#3830) (400390a)
• use UTC getters in formatDate/formatDateTime to prevent timezone drift (#3782) (9f1f89a)

Commits

• 762a4b1 chore(release): v3.16.2
• 9fae87e fix(security): accept only query-builder WHERE clauses (#3877)
• ebfdc2c fix: continue when package manager exits non-zero after installing (#3871)
• c256408 chore(deps): update nuxt framework to ^4.6.1 (#3867)
• 3f81b70 chore: upgrade deps (#3869)
• ffa5ac3 fix(api): don't forward body headers to internal content requests (#3868)
• 05a3074 fix(search): preserve word boundaries between block elements (#3861)
• 006d138 fix(security): standard quotes and block IN operator validate (#3862)
• 75eff79 fix(cache): await development cache replacement (#3846)
• 6fc1e26 perf(navigation): skip unused leaf sibling searches (#3845)
• Additional commits viewable in compare view

Updates nuxt from 4.5.2 to 4.6.2

Release notes

Sourced from nuxt's releases.

v4.6.2

v4.6.2 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes

• nitro: apply useHeadSafe rules to server island head (493565e99)
• nitro-server: read router params from the path h3 matched (010f6b43d)
• nitro: match server route rules case-insensitively unless routing is sensitive (f6cfee52c)
• nuxt: resolve rooted paths through the URL parser (#36617)
• nuxt: resolve empty route types in shared context (#36576)
• nitro: preserve server tsconfig with relocated build dir (#36494)
• nuxt: fix scroll offset for IDs starting with numbers (#36524)
• kit: do not exclude module directories with a dot in their name from app tsconfig (#36331)
• nuxt: detect vapor slots with rawVaporSlotKey from vue (#36614)
• nuxt: keep middleware layout when restoring deferred prerendered route (#36560)
• schema: provide default value for experimental.typescriptPlugin (#36561)
• vite: only replay compile error overlays to newly loaded pages (#36611)
• nuxt: re-export AnyFetchPath for emitted server route types (#36610)
• vite: warm up the dev ssr entry from a nitro plugin (#36615)
• nitro: avoid unused h3 imports in nuxt/server runtime (#36609)
• vite-server: scope asset url helpers to the build (#36591)
• nuxt: resolve nuxt/app to the app's runtime (#36587)
• kit: lowercase filename-derived handler method on nitro v2 (#36567)
• nuxt,nitro: normalise string/array appMiddleware (#36565)
• nitro: pass response headers to render:response listeners (#36583)
• vite: resolve inlined vue to its bundler build in dev (#36569)
• nuxt: don't start a page transition with no page to leave (#36535)
• nuxt: preserve error state on aborted or cancelled navigation (#36546)
• vite,nitro: link null-byte virtual css through /@id/ in dev (#36549)
• kit: resolve module dependencies from the declaring module (#36542)
• nitro: only disable h3 + nitro presets when nitroAutoImports is off (#36548)
• nitro,vite: don't access unspecified dependencies (#36541)
• nitro: don't inline deps under absolute transpile dirs (#36540)
• vite-server: respect spa loading template location (#36536)

💅 Refactors

• webpack,rspack: inline friendly errors plugin (#36568)

📖 Documentation

• remove DeepWiki badge (#36616)
• rename H(TTP) to HTTP (#36559)
• mention proxy route rule (4a529be68)
• reference definePlugin and defineNitroPlugin in server plugin tip (64b8e0334)
• open a PR to list a module (e551df267)

... (truncated)

Commits

• 026e993 v4.6.2 (#36545)
• fb01db4 chore: fix knip, eslint and type import failures in ci
• 552f97f fix(nuxt): resolve rooted paths through the URL parser (#36617)
• bfee0ff fix(nuxt): resolve empty route types in shared context (#36576)
• 4cc6917 fix(nitro): preserve server tsconfig with relocated build dir (#36494)
• 5112695 fix(nuxt): fix scroll offset for IDs starting with numbers (#36524)
• 3d19616 fix(nuxt): detect vapor slots with rawVaporSlotKey from vue (#36614)
• 149696d fix(nuxt): keep middleware layout when restoring deferred prerendered route (...
• 16d3a2f fix(nuxt): re-export AnyFetchPath for emitted server route types (#36610)
• 15587ef fix(nuxt): resolve nuxt/app to the app's runtime (#36587)
• Additional commits viewable in compare view

Updates shiki from 4.4.2 to 4.5.0

Release notes

Sourced from shiki's releases.

v4.5.0

   🚀 Features

• Emit an explicit color level from codeToANSI  -  by @​EvanProgramming in shikijs/shiki#1320 (b968e)
• transformers:
  • Add classActiveCode option to transformerNotationWordHighlight  -  by @​curiouscoder-cmd in shikijs/shiki#1201 (1e968)
  • Add transformerRenderLineNumber  -  by @​Divyapahuja31 and DIVYA PAHUJA in shikijs/shiki#1238 (02f05)

   🐞 Bug Fixes

• cli:
  • Fall back to 'text' when file/URL has no extension and no -…  -  by @​VeerShah41 in shikijs/shiki#1248 (c00e5)
  • Fall back to plaintext for unknown languages  -  by @​Jinjiang and @​antfubot in shikijs/shiki#1319 (4eb7c)
• primitive:
  • Dispose wasm memory for lazily embedded langs  -  by @​rgodha24 in shikijs/shiki#1322 (b5423)
  • Dedupe grammar injections on repeated language loads  -  by @​antlio and @​antfubot in shikijs/shiki#1318 (33678)
• stream:
  • Compile Solid renderer with babel-preset-solid  -  by @​BetterAndBetterII and @​antfu in shikijs/shiki#1309 (8724e)
• transformers:
  • Keep notations on content comment lines  -  by @​tianrking in shikijs/shiki#1308 (d25ab)
  • Handle split # and -- comments in rose-pine theme  -  by @​anandghegde in shikijs/shiki#1317 (63e6d)
• twoslash:
  • Avoid crash when @​errors nodes land past EOF  -  by @​Yahiro025, @​cursoragent and @​antfubot in shikijs/shiki#1316 (5c919)

   🏎 Performance

• engine-js: Reuse each regex's last search while tokenizing a line  -  by @​issacgerges and @​antfu in shikijs/shiki#1314 (2ef5e)
• stream: Group tokens by line in the React renderer  -  by @​CNSeniorious000 in shikijs/shiki#1311 (81200)
• vitepress-twoslash: Replace lz-string with lz-string-es  -  by @​antfubot in shikijs/shiki#1324 (2e170)

    View changes on GitHub

v4.4.3

   🚀 Features

• Update deps and grammar  -  by @​antfu (72f26)

   🐞 Bug Fixes

• vitepress-twoslash: Delay twoslash tooltip show by 200ms  -  by @​antfubot in shikijs/shiki#1306 (9f2aa)

    View changes on GitHub

Commits

• f7d0167 chore: release v4.5.0
• 48cd2cc chore: release v4.4.3
• See full diff in compare view

Updates vue from 3.5.41 to 3.5.44

Release notes

Sourced from vue's releases.

v3.5.44

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.43

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.42

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.44 (2026-10-13)

Bug Fixes

• compat: expose _setupProxy for Vue 2.7 compiled script setup (fix #11164) (#15618) (f08059d)
• compiler-core: parenthesise v-for key in v-memo cache guard (#15724) (d084b90), closes #15723
• compiler-dom: correctly stringify 0 and false in v-html (#15571) (9f3b437)
• compiler-dom: inject transition persisted for v-show in production (#15783) (89cb272)
• compiler-sfc: error when defineModel prop options reference a destructured prop (#15604) (38012a5), closes #15602
• custom-element: skip mounting an async custom element removed while its component loads (#15777) (0f8e7b4), closes #15775
• hydration: observe children of a display: contents root in hydrateOnVisible (#15773) (7f688e8)
• KeepAlive: unmount pruned current component when its vnode was cloned on mount (#15711) (92798ac), closes #15710
• reactivity: avoid mutating native array iterators (#15703) (7f9d45d), closes #15643
• reactivity: do not track deps in watcher callbacks run inside another effect (#15782) (db00fe9), closes #5009
• reactivity: once watcher should stop when its callback throws (#15755) (ae4bd94)
• reactivity: preserve shallow collection semantics (#15793) (b600466), closes #15792
• runtime-core: detect new prop keys when comparing full props (#15634) (702fa61), closes #15632
• runtime-core: keep async placeholder for block patching and pending component updates (#15554) (05ec25f), closes #15551
• runtime-core: only flush jobs queued by the root render itself (#15757) (0bea14b), closes #6728
• runtime-core: render nothing for an invalid v-for range in production (#15742) (ad19e7d)
• runtime-dom: preserve v-show display for unchanged style strings (#15794) (c0a6d3f)
• runtime-dom: treat playsinline as a boolean attribute (#15627) (a084e44)
• server-renderer: propagate async setup errors (#15857) (6930374), closes #15716
• ssr: honor falsy vnode content overrides (#15769) (c11c5c8)
• suspense: mount resolved async component with its own namespace (#15640) (2a086a2), closes #15639
• suspense: skip rendering async components unmounted while pending (4ab865a)
• teleport: move targetStart and keep children before targetAnchor (#15818) (d3c6e02), closes #15817
• transition-group: measure nested groups against their moving outer item (#15848) (1936c87), closes #5385 #1531
• transition: handle comment-wrapped component roots (#15853) (ff35014), closes #6080 #5500

3.5.43 (2026-09-17)

Bug Fixes

• compiler-sfc: ignore comment delimiters inside strings and url() when parsing css vars (#15548) (2fde323)
• compiler-sfc: prepend semicolon for await in switch case (#15498) (9a1df69), closes #15495
• compiler-sfc: restore await scope when leaving nested blocks (5409708), closes #15465
• compiler-sfc: reuse parsed parent configs across tsconfig walks (fix #15478) (#15480) (d6febaa)
• hydration: run leave hooks for hydration placeholders (#15431) (5dda192)
• reactivity: preserve readonly wrappers in array copy methods (#15469) (599f35b)
• runtime-core: unmount v-once children after parent rerenders (#15435) (d720338)
• shared: handle circular references in looseEqual (#15499) (718f782), closes #15496
• shared: preserve comment-like text in style values (#15471) (b9456cb)
• suspense: don't drop nested suspense patches during hydration (#15429) (76d42dc)
• suspense: keep the boundary pending while its branch is patched (#15411) (bfcfe9e), closes #7506
• suspense: patch a hydrating boundary's pending branch in place (#15432) (2cde6f7)
• suspense: unmount the DOM an interrupted async component claimed (#15430) (fb9b45c)
• types: keep optional props when a runtime prop uses a generic PropType (#15523) (243aabc), closes #9546

3.5.42 (2026-08-27)

... (truncated)

Commits

• bf5f0dd release: v3.5.44
• 6930374 fix(server-renderer): propagate async setup errors (#15857)
• 8e8c547 chore(deps): update all non-major dependencies (#15585)
• 4cb0ca8 chore(deps): update playground (#15685)
• e38478f chore(deps): update dawidd6/action-download-artifact action to v27 (#15768)
• 1caed5a chore(deps): update compiler (#15586)
• a49f451 chore(deps): update lint (#15680)
• 219b858 chore(deps): update build (#15679)
• ff35014 fix(transition): handle comment-wrapped component roots (#15853)
• d084b90 fix(compiler-core): parenthesise v-for key in v-memo cache guard (#15724)
• Additional commits viewable in compare view

Updates vue-router from 5.2.0 to 5.4.0

Release notes

Sourced from vue-router's releases.

v5.4.0

   🚨 Breaking Changes

• experimental: Normalize query values to arrays  -  by @​posva in vuejs/router#2824 (f1fbc)

   🚀 Features

• Accept a prebuilt matcher in createRouter  -  by @​danielroe in vuejs/router#2804 (9de96)
• UseScrollRestoration and onRouteRendered  -  by @​posva in vuejs/router#2805 (e3dde)
• Diagnose experimental beforeEnter migration  -  by @​posva (b695c)
• experimental:
  • Warn about legacy optional param removal  -  by @​posva in vuejs/router#2818 (c2f92)
  • Extract hash params with definePage  -  by @​posva (dbf2d)
  • Configure required and default hash params  -  by @​posva (cef5c)
  • Never decode the hash, protect-only encoding  -  by @​posva in vuejs/router#2760 (aca2c)
  • Allow custom regexp for path params in definePage  -  by @​posva in vuejs/router#2822 (3a192)
• router:
  • Restore hashes and top by default  -  by @​posva (7c385)

   🐞 Bug Fixes

• Resolve experimental guard redirects against target on history navigation  -  by @​posva (2c5fb)
• experimental:
  • Keep declared case of static prefix in MatcherPatternPathStar.build()  -  by @​contactjawad in vuejs/router#2798 (4dc6b)
  • Make hash params optional and nullable  -  by @​posva (d9a4c)
  • Exclude defaults from required hash params  -  by @​posva (346e2)
  • Align hash parameter parsing with queries  -  by @​posva (cf251)
  • Keep last hash param instead of throwing  -  by @​posva (d1e8a)
  • Disallow required with a default for query params  -  by @​posva (f60e9)
  • Make query params with a default optional on push  -  by @​posva (fb604)
  • Do not inherit params, query, or hash on redirects  -  by @​posva (02a92)
• history:
  • Invalidate obsolete scroll positions  -  by @​posva and @​liuly0322 in vuejs/router#2814 (071f1)
• unplugin:
  • Sanitize named view in definePage import  -  by @​giaBaoJS in vuejs/router#2809 (0711d)
  • Keep hex character codes in param segments regexp  -  by @​kwy404 in vuejs/router#2811 (07663)

   🏎 Performance

• unplugin: Cache merged route overrides  -  by @​posva in vuejs/router#2821 (732b7)

    View changes on GitHub

v5.3.1

   🐞 Bug Fixes

• experimental: Handle non-string params for isActive  -  by @​posva (92cfd)

    View changes on GitHub

... (truncated)

Commits

• 596d481 release: vue-router@5.4.0
• 2970e8e chore: fix back extends
• 16a62f8 chore(deps): upgrade dependencies (#2828)
• b810a7e chore: remove unused types
• a0efbde docs: adapt
• 2c5fbd6 fix: resolve experimental guard redirects against target on history navigation
• 6ef3163 refactor: allow undefined on optional param
• 8e89a60 chore: comment
• 72ceb99 refactor: absolute position
• 57dd1d6 refactor: allow guards to return relative location
• Additional commits viewable in compare view

Updates @nuxt/test-utils from 4.1.0 to 4.3.4

Release notes

Sourced from @​nuxt/test-utils's releases.

v4.3.4

v4.3.4 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes

• runtime: test failure when module cached (#1856)
• runtime-utils: support registerEndpoint with FormData in jsdom (#1846)
• e2e: restore test context before running setup hooks (#1855)
• e2e: apply nuxtConfig overrides to dev server (#1851)
• config: prefer h3 version from nitro path (#1844)
• module: apply vitest setup only when loaded from vitest config (#1834)
• config: respect default resolve conditions in vitest browser mode (#1843)
• module: pass required token to open vitest ui in devtools (#1841)

💅 Refactors

• module: use package-manager-detector workspace + deno handling (1d59009c7)

🏡 Chore

• cleanup example deps, unify vitest, and update knip config (#1840)

❤️ Contributors

• Yoshihiro Yamaguchi (@​yamachi4416)
• Daniel Roe (@​danielroe)

v4.3.3

v4.3.3 is the next patch release.

👉 Changelog

compare changes

🔥 Performance

• use h3's toWebHandler instead of node-mock-http (abe8ad944)
• resolve h3 from the project (b5d802f03)
• replace estree-walker with oxc-walker (8e8ca5e8b)
• replace local-pkg with exsolve (38938a879)
• replace c12 with native dotenv parsing (26c72afa0)
• inline destr and scule usage (e4bfd2ebe)
• drop node-fetch-native polyfill (6b654de5c)
• replace nypm with package-manager-detector (#1828)

🩹 Fixes

... (truncated)

Commits

• a2a0174 v4.3.4 (#1838)
• 8a372c7 fix(runtime): test failure when module cached (#1856)
• eaf8b40 fix(runtime-utils): support registerEndpoint with FormData in jsdom (#1846)
• 28f2639 chore(deps): update nuxt framework to v5.0.0-2610141459-ba5fba8 (#1858)
• 33c8cac chore(deps): update nuxt framework to v5.0.0-2610132251-aadc393 (#1857)
• e345739 fix(e2e): restore test context before running setup hooks (#1855)
• cc855b4 chore(deps): update nuxt framework to v5.0.0-2610121449-e69fd4e (#1854)
• c5294da chore(deps): update nuxt framework to v5.0.0-2610121141-fa50237 (#1853)
• 9410fe8 fix(e2e): apply nuxtConfig overrides to dev server (#1851)
• 6f68679 chore(deps): update nuxt framework to v5.0.0-2610111052-7bcb758 (#1852)
• Additional commits viewable in compare view

Updates @vitejs/plugin-vue from 6.0.8 to 6.0.10

Release notes

Sourced from @​vitejs/plugin-vue's releases.

plugin-vue@6.0.10

Please refer to CHANGELOG.md for details.

plugin-vue@6.0.9

Please refer to CHANGELOG.md for details.

Changelog

Sourced from @​vitejs/plugin-vue's changelog.

6.0.10 (2026-10-10)

Bug Fixes

• plugin-vue: compile transformed normal scripts outside vapor mode (#857) (7b63e3c)
• plugin-vue: correct AST reuse checks and allow Vue 3.6 RC (ccc06dd)

Documentation

• plugin-vue: clarify compiler initialization hooks (55d0cab)

6.0.9 (2026-09-14)

Bug Fixes

• deps: update all non-major dependencies (#812) (b2b559d)
• plugin-vue: initialize compiler correctly (#475) (127b03f)
• plugin-vue: transpile TS in templates with empty script block (#838) (189148e)

Miscellaneous Chores

• deps: update dependency obug to v3 (#846) (3180192)

Commits

• a03675e release: plugin-vue@6.0.10
• 7b63e3c fix(plugin-vue): compile transformed normal scripts outside vapor mode (#857)
• ccc06dd fix(plugin-vue): correct AST reuse checks and allow Vue 3.6 RC
• 55d0cab docs(plugin-vue): clarify compiler initialization hooks
• 822c69d release: plugin-vue@6.0.9
• 127b03f fix(plugin-vue): initialize compiler correctly (#475)
• 3180192 chore(deps): update dependency obug to v3 (#846)
• 189148e fix(plugin-vue): transpile TS in templates with empty script block (#838)
• b2b559d fix(deps): update all non-major dependencies (#812)
• See full diff in compare view

Updates @vue/test-utils from 2.4.11 to 2.5.1

Release notes

Sourced from @​vue/test-utils's releases.

v2.5.1

What's Changed

• fix: generic SFC findComponent types by @​simonyang08 in vuejs/test-utils#2934
• fix: share config across builds by @​cexbrayat in