v4.4.7
📦 nuxtView on GitHub →
✨ 3 features🐛 30 fixes🔧 25 symbols
Summary
This is a security hotfix release (4.4.7) addressing several vulnerabilities and improving stability across Nitro, Vite, and Nuxt core components. Numerous bug fixes related to security, payload extraction, and build processes were implemented.
✨ New Features
- Added documentation for vite client and server options.
- Added dedicated module dependencies documentation page.
- Added documentation for nodeTsConfig and sharedTsConfig options.
🐛 Bug Fixes
- Nitro: Assigned `noSSR` before deciding payload extraction.
- Vite: Avoided filtering out directories with shared prefix from `allowDirs`.
- Nuxt: Used resolve from `pathe` for buildCache path boundary check.
- Nuxt: Prevented sibling-directory traversal in test component wrapper.
- Nitro: Passed event data to `isValid` in dev clipboard-copy listener.
- Nuxt: Validated protocols in `reloadNuxtApp` path before reload.
- Vite: Prefixed public asset virtuals with null byte.
- Nuxt: Re-ran `getCachedData` after initial fetch.
- Nuxt: Propagated `useFetch`/`useAsyncData` factory types.
- Vite: Closed vite dev server on nuxt close.
- Kit/Nuxt: Handled cancelling prompts to install packages.
- Kit: Avoided excluding node-context files in legacy tsconfig.
- Nuxt: Handled missing payload in chunkError listener.
- Nuxt: Awaited in-light template generation when closing nuxt.
- Nuxt: Clarified page and layout usage warnings.
- Webpack: Surfaced compilation errors when stats.toString is empty.
- Nuxt: Rejected prototype-chain keys in the island registry.
- Nuxt: Applied `isScriptProtocol` guard to `navigateTo` open option.
- Nuxt: Prevented server-only page island from recursing via `<NuxtPage>`.
- Rspack/Webpack: Required loopback host when missing same-origin signals.
- Nitro: Gated chrome devtools workspace endpoint to local requests.
- Nuxt: Escaped props in `<NuxtClientFallback>` ssr output.
- Kit: Improved TS extension stripping/substitutions.
- Nuxt: Preserved `.d.mts`/`.d.cts` in `resolveTypePaths`.
- Nuxt: Escaped `<NoScript>` slot content.
- Nuxt: Matched route rules case-insensitively to mirror `vue-router`.
- Nuxt: Rejected script-capable protocols in `<NuxtLink>` href.
- Nuxt: Blocked path-normalization open redirect in `navigateTo`.
- Nuxt: Rejected cross-origin paths in `reloadNuxtApp`.
- Vite: Bound vite-node IPC to a permissioned filesystem socket.