[dependabot]

Bumps @nuxt/nitro-server to 4.6.3 and updates ancestor dependency nuxt. These dependencies need to be updated together.

Updates @nuxt/nitro-server from 4.5.2 to 4.6.3

Release notes

Sourced from @​nuxt/nitro-server's releases.

v4.6.3

v4.6.3 is the next patch release.

👉 Changelog

compare changes

🚨 Security fixes

• vite: do not read files named in client error reports (63299e13c) - GHSA-x287-wcfc-q46c
• vite: deny dev server access to nitro dev output (c7e204ec6) - GHSA-648h-gw55-m2g7
• vite: deny serving generated app secret in dev (16dfdc2a9) - GHSA-3xf4-9g3c-4h4w
• nitro,nuxt: handle dot segments in request paths (440250d97) - GHSA-9v7c-q64q-vv33
• nuxt: apply redirect route rules to page islands (b20372dbe) - GHSA-2fxj-c3j7-rr69

🔥 Performance

• vite: skip compiling plain style blocks in the server build (#36711)
• nitro,nuxt,rspack,webpack: bundle esm vue + reuse caches (#36710)
• vite: avoid quadratic nested dir check for fs.allow (#36702)
• nuxt: server render internal custom links without RouterLink (#36707)
• nuxt: skip unneeded typed routes generation (#36645)

🩹 Fixes

• nitro: don't share prerender hints with self-fetched requests (#36705)
• nuxt: defer app scope cleanup on external navigation (#36713)
• nuxt: prevent useCookie CookieStore sync from rewriting with refresh (#36673)
• nuxt: only return redirects from navigateTo while middleware runs (#36650)
• nuxt: remove purged entries from _asyncData (#36709)
• vite: skip quoted import.meta keys + limit replace to client dev (#36703)
• nuxt: hide RouteLocationRaw from navigateTo's public return type (#36691)
• nuxt: tree-shake auto-imported #app composables (#36696)
• nuxt: don't treat constrained route rules as covering dynamic pages (#36701)
• nuxt: include shared/ in build cache hash (#36704)
• nuxt: hash keyed function ids + page import names relative to rootDir (#36697)
• nuxt: encode page paths before matching route rule keys (#36683)
• nuxt: handle rejected updateCallbackDone of aborted view transition (#36639)
• ui-templates: keep loading shader proportions on narrow screens (#36654)
• nuxt: reject case-dependent route rule constraints w/ sensitive: false (#36708)
• nuxt: don't case-fold regex constraints in route rule keys (#36694)
• nuxt: normalise page prefix when finding route rule exceptions (#36685)
• vite: mirror ssr invalidations for created and deleted files (634cba64c)
• nitro: keep noScripts wildcard patterns single-segment (fa323db7d)
• deps: update unrouting to v0.3.1 (#36663)
• nuxt: avoid self-referencing nuxt/schema augmentation (#36633)
• nuxt: let nightly runtime resolve its own nuxt/* imports (#36632)
• nuxt: don't warn for vite+ vite.config files (#36628)

... (truncated)

Commits

• 1b09d0c v4.6.3 (#36651)
• 45463f8 fix(nitro,nuxt): handle dot segments in request paths
• 94a9ecb fix(nitro): don't share prerender hints with self-fetched requests (#36705)
• f5ae355 perf(nitro,nuxt,rspack,webpack): bundle esm vue + reuse caches (#36710)
• 0ea6d38 fix(nuxt): reject case-dependent route rule constraints w/ sensitive: false...
• fa323db fix(nitro): keep noScripts wildcard patterns single-segment
• 98f324a fix(nitro): abort the portable request when the client disconnects (#36652)
• f28cf9b fix(deps): update nitropack to 2.13.5 + drop obsolete workarounds (#36649)
• 026e993 v4.6.2 (#36545)
• 493565e fix(nitro): apply useHeadSafe rules to server island head
• Additional commits viewable in compare view

Updates nuxt from 4.5.2 to 4.6.3

Release notes

Sourced from nuxt's releases.

v4.6.3

v4.6.3 is the next patch release.

👉 Changelog

compare changes

🚨 Security fixes

• vite: do not read files named in client error reports (63299e13c) - GHSA-x287-wcfc-q46c
• vite: deny dev server access to nitro dev output (c7e204ec6) - GHSA-648h-gw55-m2g7
• vite: deny serving generated app secret in dev (16dfdc2a9) - GHSA-3xf4-9g3c-4h4w
• nitro,nuxt: handle dot segments in request paths (440250d97) - GHSA-9v7c-q64q-vv33
• nuxt: apply redirect route rules to page islands (b20372dbe) - GHSA-2fxj-c3j7-rr69

🔥 Performance

• vite: skip compiling plain style blocks in the server build (#36711)
• nitro,nuxt,rspack,webpack: bundle esm vue + reuse caches (#36710)
• vite: avoid quadratic nested dir check for fs.allow (#36702)
• nuxt: server render internal custom links without RouterLink (#36707)
• nuxt: skip unneeded typed routes generation (#36645)

🩹 Fixes

• nitro: don't share prerender hints with self-fetched requests (#36705)
• nuxt: defer app scope cleanup on external navigation (#36713)
• nuxt: prevent useCookie CookieStore sync from rewriting with refresh (#36673)
• nuxt: only return redirects from navigateTo while middleware runs (#36650)
• nuxt: remove purged entries from _asyncData (#36709)
• vite: skip quoted import.meta keys + limit replace to client dev (#36703)
• nuxt: hide RouteLocationRaw from navigateTo's public return type (#36691)
• nuxt: tree-shake auto-imported #app composables (#36696)
• nuxt: don't treat constrained route rules as covering dynamic pages (#36701)
• nuxt: include shared/ in build cache hash (#36704)
• nuxt: hash keyed function ids + page import names relative to rootDir (#36697)
• nuxt: encode page paths before matching route rule keys (#36683)
• nuxt: handle rejected updateCallbackDone of aborted view transition (#36639)
• ui-templates: keep loading shader proportions on narrow screens (#36654)
• nuxt: reject case-dependent route rule constraints w/ sensitive: false (#36708)
• nuxt: don't case-fold regex constraints in route rule keys (#36694)
• nuxt: normalise page prefix when finding route rule exceptions (#36685)
• vite: mirror ssr invalidations for created and deleted files (634cba64c)
• nitro: keep noScripts wildcard patterns single-segment (fa323db7d)
• deps: update unrouting to v0.3.1 (#36663)
• nuxt: avoid self-referencing nuxt/schema augmentation (#36633)
• nuxt: let nightly runtime resolve its own nuxt/* imports (#36632)
• nuxt: don't warn for vite+ vite.config files (#36628)

... (truncated)

Commits

• 1b09d0c v4.6.3 (#36651)
• 4fd54ff test: list NUXT_B4023 as main-only
• 45463f8 fix(nitro,nuxt): handle dot segments in request paths
• 57da2ae fix(nuxt): apply redirect route rules to page islands
• c655a32 fix(nuxt): defer app scope cleanup on external navigation (#36713)
• e2179ce fix(nuxt): prevent useCookie CookieStore sync from rewriting with refresh (#3...
• f818b2e fix(nuxt): only return redirects from navigateTo while middleware runs (#36...
• f5ae355 perf(nitro,nuxt,rspack,webpack): bundle esm vue + reuse caches (#36710)
• 6761ca2 fix(nuxt): remove purged entries from _asyncData (#36709)
• 8ef5ede fix(nuxt): hide RouteLocationRaw from navigateTo's public return type (#36691)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.