[dependabot]

Bumps @nuxt/vite-builder to 4.6.4 and updates ancestor dependency nuxt. These dependencies need to be updated together.

Updates @nuxt/vite-builder from 4.5.2 to 4.6.4

Release notes

Sourced from @​nuxt/vite-builder's releases.

v4.6.4

4.6.4 is a security release. It fixes eight advisories in Nuxt and pulls in nitropack 2.13.6, which fixes three more in Nitro. We recommend upgrading as soon as you can.

⚠️ Behaviour changes

These probably won't affect most apps, but it's worth flagging anyway:

1. Error details in production. When a page fails to render on the server, the error page and the payload now only carry message and data of errors you create with createError. Everything else is stripped.
2. Dev server Host checks. Webpack and rspack dev servers now reject requests with an unexpected Host header, as Vite already does. If you use a custom hostname or tunnel, you'll need to add it to the new devServer.allowedHosts option.
3. workspaceDir detection. When workspaceDir isn't set, Nuxt now only widens it past rootDir to an explicit workspace root or the closest git repository.
4. Nitropack cached routes. cache, swr and isr route rules now only cache GET and HEAD requests, and no longer store responses that set a cookie or send Cache-Control: private or no-store. Wildcard proxy and redirect rules also reject requests whose resolved target would leave the rule's scope.
5. Route rules and encoded slashes. Route rules now match paths that contain encoded slashes, so /api%2Fadmin is covered by a /api/** rule.

👉 Changelog

compare changes

🩹 Fixes

• nitro,nuxt: require unrouting 0.3.2 (768d21368)
• nitro: preserve wildcard tails in case-insensitive route rules (bf31e4cd8)
• nitro: require nitropack 2.13.6 (1b13c6981)
• nitro: keep leading double slash in renderer request path (75c12c6fb)
• nuxt: use unambiguous encoding for island hash (6f1b93c64)
• vite-server: resolve wildcard redirect tails from the matched segments (1e7dfa6a7)
• nuxt: do not expose details of untrusted thrown errors (8c56b71e4)
• nuxt: strip trailing slashes in linear time (97424dd21)
• nitro,webpack: include hosts the CLI allows after loading the config (8c11d965d)
• webpack: skip hot middleware for forbidden dev requests (3c9645326)
• rspack,webpack: reject unexpected Host headers in dev middleware (f8d64c9aa)
• schema,nitro,vite: add devServer.allowedHosts (3e1c7964e)
• nitro,nuxt: match route rules for paths with encoded slashes (084396b10)
• schema: only widen workspace dir to a declared workspace root (89d3306d1)
• nitro: only trust x-forwarded-proto in when opted-in (#36818)
• nitro: stream the body read through a nuxt/server handler (#36817)
• kit: suggest the specific fix when loading falls back to jiti (24d75659d)
• vite: use a single type checker (#36774)
• nitro,vite: remove windows + virtual dev ssr css links after hydration (#36765)
• nitro,vite: dedupe dev css by module node (#36420)
• nuxt: avoid hoisting setup-only values from definePageMeta (#36751)
• nuxt: only match hydration modifiers after lazy prefix (#36750)
• kit,nitro,nuxt: make emitted tsconfig/types stable across reruns (#36747)
• nuxt: render inlined component styles after stylesheet links (#36714)
• webpack: use valid devtool for hidden client sourcemaps in dev (#36555)

📖 Documentation

• clarify template dependency regeneration (#36766)
• revise README structure and headings (#36772)
• link the Nuxt DevTools docs on nuxt.com (#36769)

... (truncated)

Commits

• b9a6b68 v4.6.4 (#36823)
• 3e1c796 fix(schema,nitro,vite): add devServer.allowedHosts
• 89d3306 fix(schema): only widen workspace dir to a declared workspace root
• 99b85f4 chore(deps): update all non-major dependencies (4.x) (#36820)
• 731e459 fix(vite): use a single type checker (#36774)
• 2908015 fix(nitro,vite): remove windows + virtual dev ssr css links after hydration (...
• d3ee34d fix(nitro,vite): dedupe dev css by module node (#36420)
• 1b09d0c v4.6.3 (#36651)
• aec8129 fix(vite): do not read files named in client error reports
• 12b58f9 fix(vite): deny dev server access to nitro dev output
• Additional commits viewable in compare view

Updates nuxt from 4.5.2 to 4.6.4

Release notes

Sourced from nuxt's releases.

v4.6.4

4.6.4 is a security release. It fixes eight advisories in Nuxt and pulls in nitropack 2.13.6, which fixes three more in Nitro. We recommend upgrading as soon as you can.

⚠️ Behaviour changes

These probably won't affect most apps, but it's worth flagging anyway:

1. Error details in production. When a page fails to render on the server, the error page and the payload now only carry message and data of errors you create with createError. Everything else is stripped.
2. Dev server Host checks. Webpack and rspack dev servers now reject requests with an unexpected Host header, as Vite already does. If you use a custom hostname or tunnel, you'll need to add it to the new devServer.allowedHosts option.
3. workspaceDir detection. When workspaceDir isn't set, Nuxt now only widens it past rootDir to an explicit workspace root or the closest git repository.
4. Nitropack cached routes. cache, swr and isr route rules now only cache GET and HEAD requests, and no longer store responses that set a cookie or send Cache-Control: private or no-store. Wildcard proxy and redirect rules also reject requests whose resolved target would leave the rule's scope.
5. Route rules and encoded slashes. Route rules now match paths that contain encoded slashes, so /api%2Fadmin is covered by a /api/** rule.

👉 Changelog

compare changes

🩹 Fixes

• nitro,nuxt: require unrouting 0.3.2 (768d21368)
• nitro: preserve wildcard tails in case-insensitive route rules (bf31e4cd8)
• nitro: require nitropack 2.13.6 (1b13c6981)
• nitro: keep leading double slash in renderer request path (75c12c6fb)
• nuxt: use unambiguous encoding for island hash (6f1b93c64)
• vite-server: resolve wildcard redirect tails from the matched segments (1e7dfa6a7)
• nuxt: do not expose details of untrusted thrown errors (8c56b71e4)
• nuxt: strip trailing slashes in linear time (97424dd21)
• nitro,webpack: include hosts the CLI allows after loading the config (8c11d965d)
• webpack: skip hot middleware for forbidden dev requests (3c9645326)
• rspack,webpack: reject unexpected Host headers in dev middleware (f8d64c9aa)
• schema,nitro,vite: add devServer.allowedHosts (3e1c7964e)
• nitro,nuxt: match route rules for paths with encoded slashes (084396b10)
• schema: only widen workspace dir to a declared workspace root (89d3306d1)
• nitro: only trust x-forwarded-proto in when opted-in (#36818)
• nitro: stream the body read through a nuxt/server handler (#36817)
• kit: suggest the specific fix when loading falls back to jiti (24d75659d)
• vite: use a single type checker (#36774)
• nitro,vite: remove windows + virtual dev ssr css links after hydration (#36765)
• nitro,vite: dedupe dev css by module node (#36420)
• nuxt: avoid hoisting setup-only values from definePageMeta (#36751)
• nuxt: only match hydration modifiers after lazy prefix (#36750)
• kit,nitro,nuxt: make emitted tsconfig/types stable across reruns (#36747)
• nuxt: render inlined component styles after stylesheet links (#36714)
• webpack: use valid devtool for hidden client sourcemaps in dev (#36555)

📖 Documentation

• clarify template dependency regeneration (#36766)
• revise README structure and headings (#36772)
• link the Nuxt DevTools docs on nuxt.com (#36769)

... (truncated)

Commits

• b9a6b68 v4.6.4 (#36823)
• 6f1b93c fix(nuxt): use unambiguous encoding for island hash
• 8c56b71 fix(nuxt): do not expose details of untrusted thrown errors
• 97424dd fix(nuxt): strip trailing slashes in linear time
• 084396b fix(nitro,nuxt): match route rules for paths with encoded slashes
• 99b85f4 chore(deps): update all non-major dependencies (4.x) (#36820)
• 545b593 test: list new main-only diagnostic codes
• 861e153 test: normalise rolldown comment
• c75ca36 fix(nuxt): avoid hoisting setup-only values from definePageMeta (#36751)
• 34c56e5 fix(nuxt): only match hydration modifiers after lazy prefix (#36750)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.