chore(deps): update nuxt framework to ^4.6.4 by renovate[bot] · Pull Request #1643 · nuxt/cli

renovate · 2026-10-28T04:09:10Z

This PR contains the following updates:

Package	Change	Age	Confidence
@nuxt/kit (source)	`^4.6.2` → `^4.6.4`
@nuxt/schema (source)	`^4.6.2` → `^4.6.4`
@nuxt/schema@^4 (source)	`4.6.2` → `4.6.4`
nuxt (source)	`^4.6.2` → `^4.6.4`
nuxt (source)	`4.6.2` → `4.6.4`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

nuxt/nuxt (@nuxt/kit)

`v4.6.4`

Compare Source

4.6.4 is a security release. It fixes eight advisories in Nuxt and pulls in nitropack 2.13.6, which fixes three more in Nitro. We recommend upgrading as soon as you can.

⚠️ Behaviour changes

These probably won't affect most apps, but it's worth flagging anyway:

Error details in production. When a page fails to render on the server, the error page and the payload now only carry message and data of errors you create with createError. Everything else is stripped.
Dev server Host checks. Webpack and rspack dev servers now reject requests with an unexpected Host header, as Vite already does. If you use a custom hostname or tunnel, you'll need to add it to the new devServer.allowedHosts option.
workspaceDir detection. When workspaceDir isn't set, Nuxt now only widens it past rootDir to an explicit workspace root or the closest git repository.
Nitropack cached routes. cache, swr and isr route rules now only cache GET and HEAD requests, and no longer store responses that set a cookie or send Cache-Control: private or no-store. Wildcard proxy and redirect rules also reject requests whose resolved target would leave the rule's scope.
Route rules and encoded slashes. Route rules now match paths that contain encoded slashes, so /api%2Fadmin is covered by a /api/** rule.

👉 Changelog

compare changes

🩹 Fixes

nitro,nuxt: require unrouting 0.3.2 (768d21368)
nitro: preserve wildcard tails in case-insensitive route rules (bf31e4cd8)
nitro: require nitropack 2.13.6 (1b13c6981)
nitro: keep leading double slash in renderer request path (75c12c6fb)
nuxt: use unambiguous encoding for island hash (6f1b93c64)
vite-server: resolve wildcard redirect tails from the matched segments (1e7dfa6a7)
nuxt: do not expose details of untrusted thrown errors (8c56b71e4)
nuxt: strip trailing slashes in linear time (97424dd21)
nitro,webpack: include hosts the CLI allows after loading the config (8c11d965d)
webpack: skip hot middleware for forbidden dev requests (3c9645326)
rspack,webpack: reject unexpected Host headers in dev middleware (f8d64c9aa)
schema,nitro,vite: add devServer.allowedHosts (3e1c7964e)
nitro,nuxt: match route rules for paths with encoded slashes (084396b10)
schema: only widen workspace dir to a declared workspace root (89d3306d1)
nitro: only trust x-forwarded-proto in when opted-in (#36818)
nitro: stream the body read through a nuxt/server handler (#36817)
kit: suggest the specific fix when loading falls back to jiti (24d75659d)
vite: use a single type checker (#36774)
nitro,vite: remove windows + virtual dev ssr css links after hydration (#36765)
nitro,vite: dedupe dev css by module node (#36420)
nuxt: avoid hoisting setup-only values from definePageMeta (#36751)
nuxt: only match hydration modifiers after lazy prefix (#36750)
kit,nitro,nuxt: make emitted tsconfig/types stable across reruns (#36747)
nuxt: render inlined component styles after stylesheet links (#36714)
webpack: use valid devtool for hidden client sourcemaps in dev (#36555)

📖 Documentation

clarify template dependency regeneration (#36766)
revise README structure and headings (#36772)
link the Nuxt DevTools docs on nuxt.com (#36769)
warn against spreading untrusted objects onto server components (1225ca7ff)
update anchors for flat heading ids (#36664)

🏡 Chore

add 1000-row listing routes to the benchmark (c852d871f)
add client page weight and browser timing suites (#36788)

✅ Tests

update bundle size snapshot (7528c3ce6)
list new main-only diagnostic codes (545b5934c)
tolerate node 26 proxy inspect output (40f72b40b)
normalise rolldown comment (861e153dd)
improve benchmark tests (#36745)

🤖 CI

check unversioned docs links against branch docs version (d093c88b1)
skip unneeded checks for release prs (4b90681bd)
skip benchmarks in merge groups (6428070e0)
re-enable codspeed ⚡ (bc17c03d1)

❤️ Contributors

Daniel Roe (@danielroe)
Max (@onmax)
Sébastien Chopin (@atinux)
saini-25 (@saini-25)
Baptiste Leproux (@larbish)

Configuration

📅 Schedule: (UTC)

Branch creation
- Every minute (* * * * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-10-28T04:09:13Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: capture/fixture/package-lock.json

npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code EALLOWREMOTE
npm error Fetching packages of type "remote" have been disabled
npm error Refusing to fetch "https://registry.npmjs.org/@parcel/watcher-wasm/-/watcher-wasm-2.6.0.tgz"
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-11-03T22_57_24_951Z-debug-0.log

socket-security · 2026-10-28T04:09:49Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@nuxt/schema@4.6.4
nuxt@4.6.4
@nuxt/nitro-server@4.6.3 ⏵ 4.6.4	⁺¹	⁺¹	⁺¹
@nuxt/kit@4.6.3 ⏵ 4.6.4	⁺¹	⁺¹	⁺²

View full report

pkg-pr-new · 2026-10-28T04:10:48Z

nuxt-cli-playground

npm i https://pkg.pr.new/create-nuxt@1643

npm i https://pkg.pr.new/nuxi@1643

npm i https://pkg.pr.new/@nuxt/cli@1643

commit: 1045695

github-actions · 2026-10-28T04:13:55Z

CLI benchmark

@nuxt/cli v4.0.3 (baseline) vs v4.0.3 (this PR)

Metric	baseline v4.0.3	head v4.0.3	Delta
`nuxt --version` wall time (median)	50 ms	48 ms	-3.9%
`nuxt --help` wall time (median)	96 ms	98 ms	+1.1%
`nuxt dev --help` wall time (median)	77 ms	77 ms	+0.6%
`nuxt --version` modules loaded	35	35	0.0%
`nuxt --version` built-ins loaded	29	29	0.0%
`nuxt --help` modules loaded	136	136	0.0%
`nuxt --help` built-ins loaded	93	93	0.0%
`nuxt dev --help` modules loaded	64	64	0.0%
`nuxt dev --help` built-ins loaded	90	90	0.0%
Installed `node_modules`	2.48 MB	2.48 MB	-0.0%
Published tarball (packed)	245.5 kB	245.5 kB	-0.0%

Full report

`@nuxt/cli` v4.0.3 (baseline) vs v4.0.3 (head)

Setting	Value
Baseline	`ref:7d4dec65b188e549faad7c219d3766c988e5cdcb` (v4.0.3)
Head	local `packages/nuxt-cli` at `a986798` (v4.0.3)
Node	v24.22.2
OS	Linux 7.0.0 (kernel 7.0.0-1017-azure)
CPU	AMD EPYC 9V45 96-Core Processor x 4
Memory	15.6 GB
Load average at start	1.02, 0.25, 0.08
Run started	2026-11-03T23:00:15.189Z

Cold CLI startup

Median of 15 interleaved runs per command, one warmup discarded.

Command	baseline v4.0.3 median	head v4.0.3 median	Delta	baseline v4.0.3 min / p95	head v4.0.3 min / p95
`nuxt --version`	50 ms	48 ms	-3.9%	45 ms / 81 ms	46 ms / 53 ms
`nuxt --version` (first output byte)	45 ms	43 ms	-4.5%	41 ms / 76 ms	42 ms / 48 ms
`nuxt --help`	96 ms	98 ms	+1.1%	93 ms / 101 ms	89 ms / 101 ms
`nuxt --help` (first output byte)	91 ms	92 ms	+1.0%	87 ms / 95 ms	84 ms / 94 ms
`nuxt dev --help`	77 ms	77 ms	+0.6%	72 ms / 83 ms	72 ms / 89 ms
`nuxt dev --help` (first output byte)	71 ms	72 ms	+0.9%	67 ms / 78 ms	67 ms / 82 ms
`nuxt <unknown-command>` (no-op)	102 ms	102 ms	+0.4%	99 ms / 106 ms	97 ms / 109 ms
`nuxt <unknown-command>` (no-op) (first output byte)	96 ms	96 ms	+0.5%	93 ms / 99 ms	91 ms / 102 ms

Module load cost

Counted with a module.registerHooks load hook, compile cache disabled. Counts every JS module actually evaluated on that code path (native addons excluded). Built-ins loaded after bootstrap are counted separately, including the internal modules they load.

Command	baseline v4.0.3 modules	head v4.0.3 modules	Delta	baseline v4.0.3 source bytes	head v4.0.3 source bytes	Delta	baseline v4.0.3 built-ins	head v4.0.3 built-ins	Delta
`nuxt --version`	35	35	0.0%	300.4 kB	300.4 kB	0.0%	29	29	0.0%
`nuxt --help`	136	136	0.0%	861.0 kB	861.0 kB	0.0%	93	93	0.0%
`nuxt dev --help`	64	64	0.0%	460.2 kB	460.2 kB	0.0%	90	90	0.0%

Install footprint and published tarball

Each version installed on its own into an empty project with nothing but @nuxt/cli as a dependency, so the tree is exactly the CLI and its transitive dependencies. npm cache is warm and the registry is only consulted for metadata, so install wall time is indicative, not a network benchmark.

Metric	baseline v4.0.3	head v4.0.3	Delta
Direct dependencies of `@nuxt/cli`	23	23	0.0%
Packages in the installed tree (unique name@version)	39	39	0.0%
Unique package names	39	39	0.0%
Package directories on disk (cross-check)	32	32	0.0%
Installed `node_modules` on disk	2.48 MB	2.48 MB	-0.0%
Installed files	439	439	0.0%
Install wall time (warm npm cache, median of 3)	942 ms	929 ms	-1.4%
Published tarball (packed)	245.5 kB	245.5 kB	-0.0%
Published tarball (unpacked)	794.9 kB	794.9 kB	0.0%
Files in tarball	104	104	0.0%

Interleaved runs on a shared runner: trust the deltas, not the absolute timings. The dev, restart and build suites run locally via pnpm bench:cli.

codspeed · 2026-10-29T21:37:51Z

Merging this PR will not alter performance

1 warning

⚠️ 2 benchmarks are dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

✅ 2 untouched benchmarks

_{Comparing renovate/nuxt (1045695) with main (7d4dec6)}

renovate Bot requested a review from danielroe as a code owner October 28, 2026 04:09

renovate Bot force-pushed the renovate/nuxt branch from 22ef2eb to cbc1c59 Compare October 29, 2026 21:35

renovate Bot force-pushed the renovate/nuxt branch from cbc1c59 to a06a44e Compare November 2, 2026 13:50

danielroe force-pushed the main branch from d65a045 to 9b441f7 Compare November 2, 2026 23:17

renovate Bot force-pushed the renovate/nuxt branch from a06a44e to 3aacfd0 Compare November 2, 2026 23:20

chore(deps): update nuxt framework to ^4.6.4

1045695

renovate Bot force-pushed the renovate/nuxt branch from 3aacfd0 to 1045695 Compare November 3, 2026 22:57

renovate Bot changed the title ~~chore(deps): update nuxt framework to ^4.6.3~~ chore(deps): update nuxt framework to ^4.6.4 Nov 3, 2026

Navigation Menu

Repository navigation

chore(deps): update nuxt framework to ^4.6.4 - #1643

chore(deps): update nuxt framework to ^4.6.4#1643
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/nuxt

renovate Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 28, 2026 •

edited

Loading

`@nuxt/cli` v4.0.3 (baseline) vs v4.0.3 (head)

Cold CLI startup

Module load cost

Install footprint and published tarball

Uh oh!

codspeed Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v4.6.4

⚠️ Behaviour changes

👉 Changelog

🩹 Fixes

📖 Documentation

🏡 Chore

✅ Tests

🤖 CI

❤️ Contributors

Configuration

Uh oh!

renovate Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: capture/fixture/package-lock.json

Uh oh!

socket-security Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CLI benchmark

@nuxt/cli v4.0.3 (baseline) vs v4.0.3 (head)

Cold CLI startup

Module load cost

Install footprint and published tarball

Uh oh!

codspeed Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Oct 28, 2026 •

edited

Loading

`v4.6.4`

renovate Bot commented Oct 28, 2026 •

edited

Loading

socket-security Bot commented Oct 28, 2026 •

edited

Loading

pkg-pr-new Bot commented Oct 28, 2026 •

edited

Loading

github-actions Bot commented Oct 28, 2026 •

edited

Loading

`@nuxt/cli` v4.0.3 (baseline) vs v4.0.3 (head)

codspeed Bot commented Oct 29, 2026 •

edited

Loading