[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
nuxt (source)	^4.6.2 → ^4.6.3

---

Release Notes

nuxt/nuxt (nuxt)

v4.6.3

Compare Source

v4.6.3 is the next patch release.

👉 Changelog

compare changes

🚨 Security fixes

• vite: do not read files named in client error reports (63299e13c) - GHSA-x287-wcfc-q46c
• vite: deny dev server access to nitro dev output (c7e204ec6) - GHSA-648h-gw55-m2g7
• vite: deny serving generated app secret in dev (16dfdc2a9) - GHSA-3xf4-9g3c-4h4w
• nitro,nuxt: handle dot segments in request paths (440250d97) - GHSA-9v7c-q64q-vv33
• nuxt: apply redirect route rules to page islands (b20372dbe) - GHSA-2fxj-c3j7-rr69

🔥 Performance

• vite: skip compiling plain style blocks in the server build (#​36711)
• nitro,nuxt,rspack,webpack: bundle esm vue + reuse caches (#​36710)
• vite: avoid quadratic nested dir check for fs.allow (#​36702)
• nuxt: server render internal custom links without RouterLink (#​36707)
• nuxt: skip unneeded typed routes generation (#​36645)

🩹 Fixes

• nitro: don't share prerender hints with self-fetched requests (#​36705)
• nuxt: defer app scope cleanup on external navigation (#​36713)
• nuxt: prevent useCookie CookieStore sync from rewriting with refresh (#​36673)
• nuxt: only return redirects from navigateTo while middleware runs (#​36650)
• nuxt: remove purged entries from _asyncData (#​36709)
• vite: skip quoted import.meta keys + limit replace to client dev (#​36703)
• nuxt: hide RouteLocationRaw from navigateTo's public return type (#​36691)
• nuxt: tree-shake auto-imported #app composables (#​36696)
• nuxt: don't treat constrained route rules as covering dynamic pages (#​36701)
• nuxt: include shared/ in build cache hash (#​36704)
• nuxt: hash keyed function ids + page import names relative to rootDir (#​36697)
• nuxt: encode page paths before matching route rule keys (#​36683)
• nuxt: handle rejected updateCallbackDone of aborted view transition (#​36639)
• ui-templates: keep loading shader proportions on narrow screens (#​36654)
• nuxt: reject case-dependent route rule constraints w/ sensitive: false (#​36708)
• nuxt: don't case-fold regex constraints in route rule keys (#​36694)
• nuxt: normalise page prefix when finding route rule exceptions (#​36685)
• vite: mirror ssr invalidations for created and deleted files (634cba64c)
• nitro: keep noScripts wildcard patterns single-segment (fa323db7d)
• deps: update unrouting to v0.3.1 (#​36663)
• nuxt: avoid self-referencing nuxt/schema augmentation (#​36633)
• nuxt: let nightly runtime resolve its own nuxt/* imports (#​36632)
• nuxt: don't warn for vite+ vite.config files (#​36628)
• kit: keep generated declaration first in tsconfig include (#​36627)
• nuxt: clamp numeric v-for sources in island renders at render time (#​36623)
• rspack,webpack: register vue-loader plugin only once per config (#​36622)
• nitro: abort the portable request when the client disconnects (#​36652)
• deps: update nitropack to 2.13.5 + drop obsolete workarounds (#​36649)

📖 Documentation

• note provide/inject limit in server components (#​35837)
• use American spelling in a few guides (#​36706)
• document controlling prefetch hints via build:manifest hook (#​36695)
• update StackBlitz link to point to version 4 (#​36674)
• link to the 2.x docs (#​36640)
• clarify that island props must be validated before iteration (4b12d15c9)

✅ Tests

• list NUXT_B4023 as main-only (4fd54ff9a)
• wait for leave transition before each scroll behaviour test (453406999)
• vite: assert spa server bundle does not ship the app (#​36699)
• nuxt: cover route rule coverage under a base url (#​36682)
• list NUXT_B9006 as main-only (e107e0f40)

🤖 CI

• only run full checks for the last merge queue entry (132698a46)
• run a reduced matrix in the merge queue (7d228ba4b)
• compare merge queue changes against the base branch (bad8c3637)
• notify resolved issues after publishing a release (9d47884f3)
• remove broken ai-moderator and ecosystem-ci trigger workflows (1d89ad434)

🎉 New Contributors

• rynx.z (@​rynx-cc)
• Felix Fang (@​FelixFangX)
• Volkan Akyel (@​volkanakyel)
• Gareth (@​0xgdr)

❤️ Contributors

• Daniel Roe (@​danielroe)
• rynx.z (@​rynx-cc)
• Felix Fang (@​FelixFangX)
• Max (@​onmax)
• Volkan Akyel (@​volkanakyel)
• Bochkarev Ivan (@​Ibochkarev)
• Gareth (@​0xgdr)
• Hugo (@​HugoRCD)
• Sébastien Chopin (@​atinux)
• Eduardo San Martin Morote (@​posva)
• Baptiste Leproux (@​larbish)
• Benjamin Canac (@​benjamincanac)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Every minute (* * * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
dashboard-template	Ready	Preview	Oct 28, 2026 6:14am UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: d0fd1565-2acb-4031-9699-a384e4bf4825

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}