chore(deps): bump nuxt from 4.2.0 to 4.4.6

[dependabot]

Bumps nuxt from 4.2.0 to 4.4.6.

Release notes

Sourced from nuxt's releases.

v4.4.6

4.4.6 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes

• vite: Use spa entry for vite-node fallback (#35037)
• vite: Invalidate SSR module cache when modules are invalidated via plugin hooks (a86657a0e)
• nuxt: Match deduplicated resolveComponent calls in jsx blocks (#35028)
• nuxt: Prefer our own builder/server deps (#35029)
• nuxt: Update useFetch key even with watch: false (#35002)
• nitro: Mark @babel/plugin-syntax-typescript as optional peer dep (#35041)
• nitro: Add json extension to payload cache items (#35043)
• nuxt: Handle errors fetching app manifest (#35050)
• nuxt: Encode html-significant characters in external redirect body (#35052)
• nuxt: Preserve setPageLayout props on same-path navigation (#35055)
• vite: Don't strip buildAssetsDir from vite-node SSR ids (#35040)
• nuxt: Mark useLoadingIndicator properties as readonly (#35062)
• vite: Strip queries in css inline styles map (#35067)
• nitro: Validate island request hash matches props (#35077)
• nitro: Use regexp to strip query (163e18d4b)
• nitro: Use statusCode for nitro v2 compatibility (952f6841e)
• nitro-server: Re-export h3 named symbols statically (cd99001c8)
• nuxt: Render component-less parent routes during client-side nav (#35036)
• kit: Respect tsConfig.exclude in legacy tsconfig.json (#35079)
• nuxt: Run middleware for page islands (#35092)

💅 Refactors

• rspack,webpack: Extract same-origin check for dev middleware (#35051)

📖 Documentation

• Remove CSB, set node 22 and use steps for clarity (#35066)

🏡 Chore

• One more type, one more (50dcf15bb)
• Remove unneeded (?) overrides (6997093af)
• Use explicit versions for fixture dependencies (294a734d4)
• Ignore link-like syntax in code (2584a549c)
• Narrow engines.node in test (5bb17fb47)
• Remove unused import (a52d78626)

✅ Tests

• Relax relative time assertion (c3dcd16f9)
• Add type (732d844ad)
• Drop h3 v2 types (8286e5fcd)

🤖 CI

• Clean up agent-scan workflow (ab8317547)
• Continue autofix workflow when test:engines fails (3025e561e)
• Improve workflows (#35088)

❤️ Contributors

• Daniel Roe (@​danielroe)

... (truncated)

Commits

• 30a45f7 v4.4.6
• e881fe8 fix(nuxt): run middleware for page islands (#35092)
• 3310097 fix(nuxt): render component-less parent routes during client-side nav (#35036)
• b29f805 chore(deps): update all non-major dependencies (4.x) (#35075)
• e9cddf4 fix(nitro): validate island request hash matches props (#35077)
• 7499721 fix(nuxt): mark useLoadingIndicator properties as readonly (#35062)
• 38507a8 chore(deps): update dependency cssnano to v8 (4.x) (#35038)
• 5abe6d3 chore(deps): update all non-major dependencies (4.x) (#35046)
• 4bdd9dd fix(nuxt): preserve setPageLayout props on same-path navigation (#35055)
• 1ca9c44 fix(nuxt): encode html-significant characters in external redirect body (#35052)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	nuxt@​4.4.6

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: npm @nuxt/vite-builder under CC-BY-4.0 License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/dist/THIRD-PARTY-LICENSES.md) From: pnpm-lock.yaml → npm/nuxt@4.4.6 → npm/@nuxt/vite-builder@4.4.6 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@nuxt/vite-builder@4.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm caniuse-lite under CC-BY-4.0 License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (npm metadata) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/package.json) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/LICENSE) From: pnpm-lock.yaml → npm/nuxt@4.4.6 → npm/caniuse-lite@1.0.30001793 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/caniuse-lite@1.0.30001793. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm glob under BlueOak-1.0.0 License: BlueOak-1.0.0 - The applicable license policy does not permit this license (5) (npm metadata) License: BlueOak-1.0.0 - The applicable license policy does not permit this license (5) (package/LICENSE.md) License: BlueOak-1.0.0 - The applicable license policy does not permit this license (5) (package/package.json) From: pnpm-lock.yaml → npm/nuxt@4.4.6 → npm/glob@13.0.6 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/glob@13.0.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm ioredis is 96.0% likely obfuscated Confidence: 0.96 Location: Package overview From: pnpm-lock.yaml → npm/nuxt@4.4.6 → npm/ioredis@5.10.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ioredis@5.10.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm isexe under BlueOak-1.0.0 License: BlueOak-1.0.0 - The applicable license policy does not permit this license (5) (npm metadata) License: BlueOak-1.0.0 - The applicable license policy does not permit this license (5) (package/package.json) License: BlueOak-1.0.0 - The applicable license policy does not permit this license (5) (package/LICENSE.md) From: pnpm-lock.yaml → npm/isexe@4.0.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/isexe@4.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm lru-cache under BlueOak-1.0.0 License: BlueOak-1.0.0 - The applicable license policy does not permit this license (5) (npm metadata) License: BlueOak-1.0.0 - The applicable license policy does not permit this license (5) (package/package.json) License: BlueOak-1.0.0 - The applicable license policy does not permit this license (5) (package/LICENSE.md) From: pnpm-lock.yaml → npm/nuxt@4.4.6 → npm/lru-cache@11.4.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lru-cache@11.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm minimatch under BlueOak-1.0.0 License: BlueOak-1.0.0 - The applicable license policy does not permit this license (5) (npm metadata) License: BlueOak-1.0.0 - The applicable license policy does not permit this license (5) (package/package.json) License: BlueOak-1.0.0 - The applicable license policy does not permit this license (5) (package/LICENSE.md) From: pnpm-lock.yaml → npm/nuxt@4.4.6 → npm/minimatch@10.2.5 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/minimatch@10.2.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm minipass under BlueOak-1.0.0 License: BlueOak-1.0.0 - The applicable license policy does not permit this license (5) (npm metadata) License: BlueOak-1.0.0 - The applicable license policy does not permit this license (5) (package/package.json) License: BlueOak-1.0.0 - The applicable license policy does not permit this license (5) (package/LICENSE.md) From: pnpm-lock.yaml → npm/nuxt@4.4.6 → npm/minipass@7.1.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/minipass@7.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm path-scurry under BlueOak-1.0.0 License: BlueOak-1.0.0 - The applicable license policy does not permit this license (5) (npm metadata) License: BlueOak-1.0.0 - The applicable license policy does not permit this license (5) (package/package.json) License: BlueOak-1.0.0 - The applicable license policy does not permit this license (5) (package/LICENSE.md) From: pnpm-lock.yaml → npm/nuxt@4.4.6 → npm/path-scurry@2.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/path-scurry@2.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report