fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@aws-sdk/client-ecr (source)	3.1092.0 → 3.1103.0
@aws-sdk/client-sts (source)	3.1092.0 → 3.1103.0
@nuxtjs/sitemap	8.3.0 → 8.3.3
axios (source)	1.18.1 → 1.19.0
eslint (source)	10.7.0 → 10.8.0
eslint-plugin-perfectionist (source)	5.10.0 → 5.10.1
nuxt (source)	4.5.0 → 4.5.1
vue-tsc (source)	3.3.7 → 3.3.9

---

Release Notes

aws/aws-sdk-js-v3 (@​aws-sdk/client-ecr)

v3.1103.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ecr

v3.1102.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ecr

v3.1101.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ecr

v3.1100.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ecr

v3.1099.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ecr

v3.1098.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ecr

v3.1097.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ecr

v3.1096.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ecr

v3.1095.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ecr

v3.1094.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ecr

v3.1093.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-ecr

aws/aws-sdk-js-v3 (@​aws-sdk/client-sts)

v3.1103.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-sts

v3.1102.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-sts

v3.1101.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-sts

v3.1100.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-sts

v3.1099.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-sts

v3.1098.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-sts

v3.1097.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-sts

v3.1096.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-sts

v3.1095.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-sts

v3.1094.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-sts

v3.1093.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-sts

nuxt-modules/sitemap (@​nuxtjs/sitemap)

v8.3.3

Compare Source

   🚀 Features

• ci: Add package size reporting  -  by @​harlan-zw in #​652 (38c07)

   🐞 Bug Fixes

• Support Nuxt 5 and Nitro 3 runtimes  -  by @​harlan-zw in #​651 (54a74)
• Use shared Nitro fetch alias  -  by @​harlan-zw in #​653 (af1b8)

   🏎 Performance

• Parse records in linear time instead of quadratic  -  by @​harlan-zw in #​649 (42fa8)
• sitemapd: Speed up large sitemap parsing  -  by @​harlan-zw in #​650 (20d11)

    View changes on GitHub

v8.3.2

Compare Source

   🐞 Bug Fixes

• utils: Restore legacy sitemap parser exports  -  by @​harlan-zw in #​648 (bbae3)

    View changes on GitHub

v8.3.1

Compare Source

   🐞 Bug Fixes

• Harden lastmod validation and support gzipped XML sources  -  by @​harlan-zw in #​637 (dcaee)
• Decompress gzipped sitemaps in the production debug endpoint  -  by @​harlan-zw in #​638 (601b6)
• Expose configured sources during prerender  -  by @​harlan-zw in #​647 (ca9ec)
• types: Register augments for Nitro projects  -  by @​harlan-zw in #​641 (0fb38)

    View changes on GitHub

axios/axios (axios)

v1.19.0

Compare Source

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

eslint/eslint (eslint)

v10.8.0

Compare Source

Features

• 2fee9bb feat: export ConfigObject from eslint/config (#​21082) (sethamus)

Bug Fixes

• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#​21129) (Francesco Trotta)
• 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#​21116) (Pixel)
• e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#​21081) (synthex-byte)
• 20b5ad0 fix: quadratic-time regex in prefer-template (#​21096) (Milos Djermanovic)
• 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#​21094) (Pixel)
• b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#​21083) (Francesco Trotta)

Documentation

• 6ddf858 docs: fix broken Specify Parser Options anchor link (#​21106) (Minsu)
• 784dfbe docs: Clarify no-eq-null description (#​21120) (Park Harin)
• 7ec733a docs: Fix typos and grammar in glossary (#​21095) (Marry (Subin Yang))
• 92bb13f docs: replace quake link (#​21108) (Jung Hyeon Jun)
• 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#​21103) (Minsu)
• d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#​21099) (Jung Hyeon Jun)
• eccc68d docs: correct --suppressions-location option description (#​21093) (Ga eun Lee)
• c5963f7 docs: Update README (GitHub Actions Bot)

Chores

• 4fbf46d test: pin webpack version to 5.108.4 (#​21137) (Francesco Trotta)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#​21101) (Bo Hyun Kim)
• eccbe7b test: add error locations to no-class-assign (#​21123) (devoil)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#​21118) (dependabot[bot])
• e9d66d0 ci: bump actions/setup-node from 6 to 7 (#​21119) (dependabot[bot])
• ee225b6 test: Add error location details to no-eq-null rule (#​21117) (Park Harin)
• 044a627 chore: update minimatch to ^10.2.5 (#​21107) (김채영)
• fb09aa8 chore: update ecosystem plugins (#​21115) (ESLint Bot)
• 5abd878 test: add error locations to no-proto (#​21114) (Gihyeon Jeong / 정기현)
• 9715887 test: Add error location details to no-div-regex (#​21110) (Park Harin)
• a746ec6 test: add error locations to no-new-wrappers (#​21109) (Gihyeon Jeong / 정기현)
• 8dde645 test: add error locations to no-ex-assign (#​21102) (devoil)
• 13ab0ec test: add error locations to no-label-var (#​21098) (Gihyeon Jeong / 정기현)
• a99906f test: Add error location details to no-delete-var rule (#​21105) (Park Harin)
• c47e8dc chore: add missing backticks to languages/js/index.js (#​21104) (beeen)
• 0174428 chore: add missing backticks to translate-cli-options.js (#​21097) (dongkyu lee)
• 3d36589 chore: add missing backticks to serialization.js (#​21091) (이규환)
• dcc9312 test: add error locations to eqeqeq (#​21090) (Ga eun Lee)
• 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#​21089) (Marry (Subin Yang))
• 5d2f866 chore: update dependency prettier to v3.9.5 (#​21086) (renovate[bot])
• d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#​21084) (Francesco Trotta)
• bf3eda0 chore: update ecosystem plugins (#​21079) (ESLint Bot)

azat-io/eslint-plugin-perfectionist (eslint-plugin-perfectionist)

v5.10.1

Compare Source

compare changes

🐞 Bug Fixes

• Fix crash in typescript 7
  (fbbc372)
• Fix complex comments cases not being auto-fixed correctly
  (7a35d8b)
• Respect ignored callback dependencies in nested calls
  (c9a119e)
• Take into account extended tsconfigs
  (93a267e)

❤️ Contributors

• Hugo (@​hugop95)

nuxt/nuxt (nuxt)

v4.5.1

Compare Source

⚠️ This is a security release. We recommend upgrading as soon as possible with npx nuxt upgrade --dedupe.

It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, cross-user payload disclosure on cached pages, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.

If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.

If you use the cache, swr or isr route rules, purge any CDN or edge cache after upgrading; a leaked _payload.json may already be cached upstream.

Full details: Nuxt Security Patch Releases and GitHub Security Advisories.

👉 Changelog

compare changes

🔥 Performance

• nitro: Replace island teleports in a single html pass (#​35515)
• nuxt: Add vue.optionsApi and disable it for v5+ (#​35791)
• nuxt: Without pages, skip client plugins that require routing (#​35794)
• nuxt: Skip payload revival plugin when ssr: false (#​35782)

🩹 Fixes

• nitro: Read rspack dev output fs lazily for server entry (#​35740)
• rspack,webpack: Resolve loaders and runtime deps from nuxt dirs (#​35568)
• nuxt: Return global route for useRoute in detached effect scope (#​35659)
• nuxt: Ignore custom name or path when reusing an existing page in pages:extend (#​35661)
• nuxt: Render client components in nested server components (#​35669)
• nuxt: Preserve explicit useFetch method inference (#​35671)
• nuxt: Revalidate cached route payloads instead of using force-cache (#​35672)
• nuxt: Correct default export detection in plugin metadata (#​35676)
• nuxt: Clear hide/reset timeouts in set() (#​35534)
• kit,nuxt,rspack,schema,webpack: Add .mts file extension in resolver (#​33845)
• nuxt: Preserve trailing slash in NuxtLink href when unset (#​35501)
• nuxt: Don't cross-pollute useAsyncData cache on reactive key change (#​35656)
• nuxt: Filter plugin dependencies by build target (#​35682)
• nuxt: Reload real page module on HMR of JSX render-function pages (#​35678)
• nuxt: Resolve @unhead/vue/* from nuxt's dependency tree (#​35690)
• kit: Surface module load errors instead of masking as missing (#​35497)
• nuxt: Type auto-imported $fetch with nitro's $Fetch (#​35704)
• nuxt: Don't reference app config sources in shared and node tsconfigs (#​35673)
• vite: Resolve SSR inlined CSS module class name mismatch (#​35610)
• nuxt: Generate layout types even when pages module is disabled (#​35717)
• nitro: Skip resource hints for stylesheets already rendered as blocking links (#​35691)
• kit: Dedupe layers that are both auto-scanned and explicitly extended (#​35712)
• nuxt: Don't apply scroll behaviour after a subsequent nav (#​35719)
• vite: Ensure server sourcemap-preserver plugin actually runs (#​35680)
• vite: Preserve css suffix when extracting ssr inline styles (#​35714)
• nuxt: Watch external component directories in development (#​35652)
• nuxt: Don't exclude client entry module from style extraction (#​35720)
• nuxt: Amend cleanup command in NUXT_B7014 error message (#​35735)
• nuxt: Only pull in vue-router when there are island pages (#​35739)
• vite: Suppress external warnings for internal vite-node paths (#​35744)
• nuxt: Use scope-aware oxc parser for auto-imports (#​35743)
• nuxt: Sync layout meta during middleware on SSR (#​35633)
• nitro: Add alias for h3 that pins it to the version nuxt depends on (#​35774)
• nuxt: Preserve query params in cached payload extraction (#​35696)
• nuxt: Mirror runtime route tree in generated typed-router types (#​35788)
• nuxt: Warn when an imports preset from cannot be resolved (#​35799)
• kit: Avoid mutating layer configs when resolving options (#​35729)
• nuxt: Convert inline route rules exactly or drop with a warning (#​35455)
• nitro,nuxt,vite: Dedupe and normalise global css links in dev (#​35834)
• vite: Register template HMR plugin on dev servers (929c6c138)
• nuxt: Remove dev error overlay when error is cleared (#​35821)
• rspack,webpack: Resolve bundled postcss defaults from builder (#​35823)
• schema: Normalise slashes in app.buildAssetsDir (#​35833)
• nitro: Bound island props and v-for to prevent unauthenticated DoS (4e35ae9ba)
• nitro: Confine runtime payload cache to prerendering (ac9b41a36)
• nuxt: Case-fold route rule keys to match folded lookups (ad624a75a)
• nitro: Require loopback peer for chrome devtools workspace endpoint (0769c4f9b)
• nuxt: Reject reserved template island prop under runtime compiler (ee6c84633)
• nuxt: Reject top-level as prop for islands (581651ff3)

💅 Refactors

• nuxt: Use tick based debounce for asyncData executes (#​34151)
• kit,nuxt: Replace semver with verkit (#​35713)
• rspack,webpack: Use DI model to split builders (#​35751)

📖 Documentation

• Add dev container setup guide (#​35665)
• Fix dev container setup guide (#​35666)
• Add explanation of 200.html and 404.html SPA fallbacks (#​34483)
• Expand payload extraction documentation (#​35648)
• Clarify NuxtLink componentName is the internal (devtools) name (#​35658)
• Add example for components dir pattern option (#​35663)
• Require a single root element (#​35677)
• Add reason for why you should never import Vue app code in nitro code (#​34481)
• Document disabling code-splitting with codeSplitting: false (#​35683)
• Document nuxt-client caveat for non-SFC components (#​35654)
• Clarify favicon does not use cdnURL by default (#​35681)
• Standardize section order and headings across docs (#​35685)
• Clarify onPrehydrate example comment (#​35684)
• Add useId as a known limitation of nuxt island (#​35693)
• Recommend status over pending in data fetching (#​35694)
• Fill gaps in API minimalVersion badges after #​34485 (#​35708, #​34485)
• Explain dynamic asset paths (#​35695)
• Document runtimeConfig env var casting edge cases (#​35709)
• Clarify module dependency resolution (#​35718)
• Add more writing guidelines (#​35662)
• Add note with alternatives to using remote layers (#​35721)
• Use nuxt rather than nuxi (8891e179c)
• Document relative baseURL workarounds (#​34004)
• Warn about runtimeCompiler security best practices (449b63ab1)
• Warn about validating server component props (2c981cb07)

📦 Build

• nitro: Re-export type from augments to preserve module (dac937675)
• nuxt: Remove .ts file extension from runtime/ imports (#​35689)
• ui-templates: Commit generated ui template files (#​35770)

🏡 Chore

• Add extension 🤦 (d595fb3d4)
• Move to pnpm catalogs (#​35748)
• Update knip config, resolve issues, and run in ci (#​35742)
• Ignore @nuxt/telemetry in knip (9824d4f10)
• ui-templates: Pass config file path to unocss (34e7a810d)
• Allow regenerating lockfile in release script (c31389df3)
• nuxt: Bump @nuxt/devtools to v3.3.1 (#​35815)
• Ensure types are setup before unit tests (784d8f700)
• Simplify knip configuration (#​35827)

✅ Tests

• Reproduce duplicate CSS in shared chunks (#​35649)
• Prepare fixtures automatically before fixture and e2e runs (e8b3e6411)
• Improve and refactor basic fixture (#​35687)
• Slim down client-only, chunk-error and axis-independent suites (#​35706)
• Do not run type checking when benchmarking nuxt build (6355f3bc9)
• kit: Scope loadNuxt temp dir so it doesn't delete sibling fixtures (37301dd51)
• Guard against transient undefined _route in gotoPath (ca92d082b)
• Retry fixture prepare on transient ENOTEMPTY (3a6b59f96)
• Raise route-HMR polling timeout to reduce e2e flakiness (01dc27b7e)
• Update bundle size snapshot (30d24817c)

🤖 CI

• Rebalance shards and drop non-vite windows fixtures (#​35700)
• Warm windows dependency cache on main (#​35730)
• Run knip in default and production modes (#​35745)
• Run knip on pull requests (d620aa972)
• Prepare tests (c7bf7f738)
• Also prepare tests in knip job (58f68bd64)
• Check internal docs links on pull requests and all links weekly (#​35767)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Lars Kappert (@​webpro)
• Matej Černý (@​cernymatej)
• Anthony Fu (@​antfu)
• Harlan Wilton (@​harlan-zw)
• Florian Heuberger (@​Flo0806)
• Anoesj Sadraee (@​Anoesj)
• Ryota Watanabe (@​wattanx)
• Alexander Lichter (@​TheAlexLichter)
• Nestor Vera (@​hacknug)
• Mateleo (@​Mateleo)
• Kevin Deng (@​sxzz)
• Robin (@​OrbisK)
• Bochkarev Ivan (@​Ibochkarev)
• Quentin Macq (@​quentinmcq)
• Julien Huang (@​huang-julien)
• Max (@​onmax)
• Luke Nelson (@​luc122c)
• Darlan José Batista do Prado (@​DarlanPrado)
• kealan (@​KealanAU)
• Sushant (@​sushantguri)
• raminjafary (@​raminjafary)
• Aubakirov Asker (@​Askerka00)
• lutejka (@​lutejka)
• Amulet Iris (@​KazariAI)
• bdbch (@​bdbch)
• Elecmonkey (@​elecmonkey)

vuejs/language-tools (vue-tsc)

v3.3.9

Compare Source

component-meta

• feat: expose runtime values of enum members in schema (#​6131) - Thanks to @​valentinpalkovic!
• fix: keep getProgramAndFile free of side effects (#​6136) - Thanks to @​seanogdev!

language-core

• feat: check unused generic type parameters (#​6137) - Thanks to @​KazariEX!

language-service

• fix: preserve trailing modifiers when completing in the middle of a directive (#​6133) - Thanks to @​lazerg!
• fix: only replace current directive modifier on completion - Thanks to @​KazariEX!
• fix: preserve current modifier when filtering completion duplicates - Thanks to @​KazariEX!

workspace

• feat: migrate build and tests to typescript-native-bridge (#​6129)

v3.3.8

Compare Source

language-core

• feat: support vapor directives (#​6126) - Thanks to @​liangmiQwQ!

workspace

• chore: upgrade to TypeScript 7 and support @typescript/typescript6 (#​6123) - Thanks to @​WaldemarEnns!

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 6am and before 10am on saturday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.