build(deps): bump the npm_and_yarn group across 1 directory with 4 updates by dependabot[bot] · Pull Request #796 · zitadel/nextgen

dependabot · 2026-08-09T09:58:44Z

Bumps the npm_and_yarn group with 3 updates in the / directory: nuxt, dompurify and hono.

Updates nuxt from 4.4.8 to 4.5.1

Release notes

v4.5.1

⚠️ This is a security release. We recommend upgrading as soon as possible with npx nuxt upgrade --dedupe.

It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, cross-user payload disclosure on cached pages, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.

If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.

If you use the cache, swr or isr route rules, purge any CDN or edge cache after upgrading; a leaked _payload.json may already be cached upstream.

Full details: Nuxt Security Patch Releases and GitHub Security Advisories.

👉 Changelog

compare changes

🔥 Performance

nitro: Replace island teleports in a single html pass (#35515)

nuxt: Add vue.optionsApi and disable it for v5+ (#35791)

nuxt: Without pages, skip client plugins that require routing (#35794)

nuxt: Skip payload revival plugin when ssr: false (#35782)

🩹 Fixes

nitro: Read rspack dev output fs lazily for server entry (#35740)

rspack,webpack: Resolve loaders and runtime deps from nuxt dirs (#35568)

nuxt: Return global route for useRoute in detached effect scope (#35659)

nuxt: Ignore custom name or path when reusing an existing page in pages:extend (#35661)

nuxt: Render client components in nested server components (#35669)

nuxt: Preserve explicit useFetch method inference (#35671)

nuxt: Revalidate cached route payloads instead of using force-cache (#35672)

nuxt: Correct default export detection in plugin metadata (#35676)

nuxt: Clear hide/reset timeouts in set() (#35534)

kit,nuxt,rspack,schema,webpack: Add .mts file extension in resolver (#33845)

nuxt: Preserve trailing slash in NuxtLink href when unset (#35501)

nuxt: Don't cross-pollute useAsyncData cache on reactive key change (#35656)

nuxt: Filter plugin dependencies by build target (#35682)

nuxt: Reload real page module on HMR of JSX render-function pages (#35678)

nuxt: Resolve @unhead/vue/* from nuxt's dependency tree (#35690)

kit: Surface module load errors instead of masking as missing (#35497)

nuxt: Type auto-imported $fetch with nitro's $Fetch (#35704)

nuxt: Don't reference app config sources in shared and node tsconfigs (#35673)

vite: Resolve SSR inlined CSS module class name mismatch (#35610)

nuxt: Generate layout types even when pages module is disabled (#35717)

nitro: Skip resource hints for stylesheets already rendered as blocking links (#35691)

kit: Dedupe layers that are both auto-scanned and explicitly extended (#35712)

nuxt: Don't apply scroll behaviour after a subsequent nav (#35719)

vite: Ensure server sourcemap-preserver plugin actually runs (#35680)

vite: Preserve css suffix when extracting ssr inline styles (#35714)

nuxt: Watch external component directories in development (#35652)

nuxt: Don't exclude client entry module from style extraction (#35720)

nuxt: Amend cleanup command in NUXT_B7014 error message (#35735)

nuxt: Only pull in vue-router when there are island pages (#35739)

vite: Suppress external warnings for internal vite-node paths (#35744)

... (truncated)

Commits

452dd50 v4.5.1
581651f fix(nuxt): reject top-level as prop for islands
ee6c846 fix(nuxt): reject reserved template island prop under runtime compiler
ad624a7 fix(nuxt): case-fold route rule keys to match folded lookups
4e35ae9 fix(nitro): bound island props and v-for to prevent unauthenticated DoS
352135f fix(nuxt): remove dev error overlay when error is cleared (#35821)
b1a8e93 fix(nitro,nuxt,vite): dedupe and normalise global css links in dev (#35834)
df55902 fix(nuxt): convert inline route rules exactly or drop with a warning (#35455)
083b750 fix(nuxt): warn when an imports preset from cannot be resolved (#35799)
61eb637 perf(nuxt): skip payload revival plugin when ssr: false (#35782)
Additional commits viewable in compare view

Updates dompurify from 3.4.12 to 3.4.13

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.13

Fixed an issue with hook removal during IN_PLACE sanitization, thanks @koyokr

Fixed an issue with hooks potentially bypassing the clone guard, thanks @AkshayjainG

Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @AkshayjainG

Bumped several dependencies where possible

Commits

3067f77 release: 3.4.13 (#1562)
See full diff in compare view

Updates hono from 4.12.31 to 4.12.34

Release notes

Sourced from hono's releases.

v4.12.34

Security fixes

This release includes fixes for the following security issues:

memo() retains SSR output across requests, leading to cross-user data disclosure

Affects: hono/jsx (server-side rendering). Fixes memo() reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — useContext(), useRequestContext(), or getContext() — could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r

ReDoS in CORS middleware via Access-Control-Request-Headers

Affects: hono/cors. Fixes a whitespace-tolerant regular expression with quadratic backtracking used to parse the Access-Control-Request-Headers preflight header when allowHeaders is not configured (the default), where a single preflight request carrying a long whitespace run could consume seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239

Algorithmic complexity DoS in Language Middleware

Affects: hono/language. Fixes quadratic string processing in language-tag normalization, where a crafted language tag with a large number of hyphen-separated subtags — supplied via a query parameter, cookie, or Accept-Language header — could cause excessive CPU consumption and block the event loop. GHSA-54fx-42gc-7vw4

Proxy Helper does not remove response headers listed in the Connection header

Affects: hono/proxy. Fixes proxy() forwarding response headers that the origin's Connection header designates as connection-scoped, where headers intended only for the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to clients, disclosing connection-scoped or internal metadata. GHSA-79qm-7rj5-m7r9

Users who use hono/jsx for server-side rendering, hono/cors, hono/language, or hono/proxy are strongly encouraged to upgrade to this version.

v4.12.33

What's Changed

fix(cookie): relax name validation when parsing Cookie header in honojs/hono#5164

chore: bump @hono/node-server in honojs/hono#5167

fix(jsx): handle useSyncExternalStore subscription and snapshot changes in honojs/hono#5166

chore: remove undici in favor of global fetch in honojs/hono#5168

Full Changelog: honojs/hono@v4.12.32...v4.12.33

v4.12.32

What's Changed

ci: enable reports for type & bundle size check in honojs/hono#5148

fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in honojs/hono#5142

fix(sse): emit empty id field to reset Last-Event-ID in honojs/hono#5138

test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in honojs/hono#5145

fix: use Object.create(null) when parsing query, headers, and params in honojs/hono#5161

fix(secure-headers): keep CSP callbacks scoped to their header in honojs/hono#5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

Commits

734755a 4.12.34
9839ff3 chore: update bun.lock (#5182)
0c45036 Merge commit from fork
720b566 Merge commit from fork
f70e2c3 Merge commit from fork
93fc250 Merge commit from fork
51db313 4.12.33
aed1463 chore: remove undici in favor of global fetch (#5168)
224d2f5 fix(jsx): handle useSyncExternalStore subscription and snapshot changes (#5166)
df653ce chore: bump @hono/node-server (#5167)
Additional commits viewable in compare view

Updates @nuxt/devtools from 3.2.4 to 3.4.1

Release notes

Sourced from @nuxt/devtools's releases.

v3.4.1

   🐞 Bug Fixes

devtools: Prevent StateEditor from freezing the page on live state - by @antfubot in nuxt/devtools#1058 (06249)

    View changes on GitHub

v3.4.0

   🚀 Features

Upgrade @vitejs/devtools-kit to v0.4.10 - by @antfu (5cea1)

   🐞 Bug Fixes

devtools: Continue hardening the RPC surface - by @antfubot in nuxt/devtools#1049 (7f072)

    View changes on GitHub

v3.3.1

No significant changes

    View changes on GitHub

v3.3.0

   🐞 Bug Fixes

devtools: Require dev auth token for openInEditor and options RPC methods - by @antfubot in nuxt/devtools#1039 (a7b27)

    View changes on GitHub

v3.2.6

   🐞 Bug Fixes

Nuxt api url - by @antfu (1f0b2)

    View changes on GitHub

Changelog

Sourced from @nuxt/devtools's changelog.

3.4.1 (2026-08-04)

Bug Fixes

devtools: prevent StateEditor from freezing the page on live state (#1058) (0624919)

3.4.0 (2026-07-29)

Bug Fixes

devtools: continue hardening the RPC surface (#1049) (7f072dc)

Features

upgrade @vitejs/devtools-kit to v0.4.10 (5cea1a1)

3.3.1 (2026-07-24)

3.3.0 (2026-07-24)

Bug Fixes

devtools: require dev auth token for openInEditor and options RPC methods (#1039) (a7b2718)

3.2.6 (2026-07-17)

Bug Fixes

nuxt api url (1f0b20d)

3.2.5 (2026-04-30)

Bug Fixes

... (truncated)

Commits

39a6dbb chore: release v3.4.1
e2de554 chore: update deps
0624919 fix(devtools): prevent StateEditor from freezing the page on live state (#1058)
0ceaa45 chore: release v3.4.0
5cea1a1 feat: upgrade @vitejs/devtools-kit to v0.4.10
7f072dc fix(devtools): continue hardening the RPC surface (#1049)
9a2da33 chore: release v3.3.1
12eb2a3 chore: release v3.3.0
a7b2718 fix(devtools): require dev auth token for openInEditor and options RPC method...
e65c8a9 chore: release v3.2.6
Additional commits viewable in compare view

vercel · 2026-08-09T09:58:49Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nextgen	Ready	Preview	Aug 9, 2026 7:35pm
nextgen-docs	Ready	Preview	Aug 9, 2026 7:35pm
nextgen-mock-zitadel	Ready	Preview	Aug 9, 2026 7:35pm

Copilot

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates key frontend/security-related dependencies across the monorepo to newer patch/minor versions.

Changes:

Bump dompurify and hono versions in the pnpm workspace catalog.
Align Nuxt version bumps in both sdk-nuxt and the Nuxt demo app.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.

File	Description
pnpm-workspace.yaml	Updates shared catalog versions for `dompurify` and `hono`.
packages/sdk-nuxt/package.json	Bumps Nuxt dependency to `^4.5.1`.
apps/demo-nuxt/package.json	Bumps Nuxt dependency to `^4.5.1` to match the SDK package.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

  clsx: ^2.1.1
  cmdk: ^1.1.1
  cookie-parser: ^1.4.7
-  dompurify: ^3.4.12
+  dompurify: ^3.4.13
  eslint: ^9.0.0


    "eslint-plugin-perfectionist": "catalog:",
    "eslint-plugin-prettier": "catalog:",
    "h3": "^1.15.3",
-    "nuxt": "^4.4.8",
+    "nuxt": "^4.5.1",
    "prettier": "catalog:",
    "tsup": "catalog:",
    "typescript": "^5.7.3",


    "@zitadel/components": "workspace:*",
    "@zitadel/design-tokens": "workspace:*",
    "@zitadel/shared-component-styles": "workspace:*",
-    "nuxt": "^4.4.8"
+    "nuxt": "^4.5.1"
  },


github-actions · 2026-08-09T09:59:46Z

⚠️ No Changeset found

Latest commit: b5b79a8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

…dates Bumps the npm_and_yarn group with 3 updates in the / directory: [nuxt](https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt), [dompurify](https://github.com/cure53/DOMPurify) and [hono](https://github.com/honojs/hono). Updates `nuxt` from 4.4.8 to 4.5.1 - [Release notes](https://github.com/nuxt/nuxt/releases) - [Commits](https://github.com/nuxt/nuxt/commits/v4.5.1/packages/nuxt) Updates `dompurify` from 3.4.12 to 3.4.13 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.12...3.4.13) Updates `hono` from 4.12.31 to 4.12.34 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.31...v4.12.34) Updates `@nuxt/devtools` from 3.2.4 to 3.4.1 - [Release notes](https://github.com/nuxt/devtools/releases) - [Changelog](https://github.com/nuxt/devtools/blob/v3.4.1/CHANGELOG.md) - [Commits](https://github.com/nuxt/devtools/commits/v3.4.1/packages/devtools) --- updated-dependencies: - dependency-name: "@nuxt/devtools" dependency-version: 3.4.1 dependency-type: indirect - dependency-name: dompurify dependency-version: 3.4.13 dependency-type: direct:production - dependency-name: hono dependency-version: 4.12.34 dependency-type: direct:production - dependency-name: nuxt dependency-version: 4.5.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 9, 2026

Copilot AI lite review requested due to automatic review settings August 9, 2026 09:58

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 9, 2026

Copilot AI reviewed Aug 9, 2026

View reviewed changes

vercel Bot deployed to Preview – nextgen-mock-zitadel August 9, 2026 09:59 View deployment

vercel Bot deployed to Preview – nextgen August 9, 2026 09:59 View deployment

vercel Bot deployed to Preview – nextgen-docs August 9, 2026 09:59 View deployment

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-24710cfd69 branch from 98c82d4 to b5b79a8 Compare August 9, 2026 19:34

vercel Bot deployed to Preview – nextgen-mock-zitadel August 9, 2026 19:35 View deployment

vercel Bot deployed to Preview – nextgen August 9, 2026 19:35 View deployment

vercel Bot deployed to Preview – nextgen-docs August 9, 2026 19:35 View deployment

Navigation Menu

Uh oh!

build(deps): bump the npm_and_yarn group across 1 directory with 4 updates - #796

build(deps): bump the npm_and_yarn group across 1 directory with 4 updates#796
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-24710cfd69

dependabot Bot commented on behalf of github Aug 9, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Aug 9, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Aug 9, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v4.5.1

👉 Changelog

🔥 Performance

🩹 Fixes

DOMPurify 3.4.13

v4.12.34

Security fixes

memo() retains SSR output across requests, leading to cross-user data disclosure

ReDoS in CORS middleware via Access-Control-Request-Headers

Algorithmic complexity DoS in Language Middleware

Proxy Helper does not remove response headers listed in the Connection header

v4.12.33

What's Changed

v4.12.32

What's Changed

v3.4.1

🐞 Bug Fixes

View changes on GitHub

v3.4.0

🚀 Features

🐞 Bug Fixes

View changes on GitHub

v3.3.1

View changes on GitHub

v3.3.0

🐞 Bug Fixes

View changes on GitHub

v3.2.6

🐞 Bug Fixes

View changes on GitHub

3.4.1 (2026-08-04)

Bug Fixes

3.4.0 (2026-07-29)

Bug Fixes

Features

3.3.1 (2026-07-24)

3.3.0 (2026-07-24)

Bug Fixes

3.2.6 (2026-07-17)

Bug Fixes

3.2.5 (2026-04-30)

Bug Fixes

Uh oh!

vercel Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Aug 9, 2026 •

edited

Loading

`memo()` retains SSR output across requests, leading to cross-user data disclosure

ReDoS in CORS middleware via `Access-Control-Request-Headers`

Proxy Helper does not remove response headers listed in the `Connection` header

vercel Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading