Skip to content

[Snyk] Security upgrade nuxt from 3.13.2 to 3.15.3#136

Open
kevin-benton wants to merge 1 commit intomainfrom
snyk-fix-1acf6ba0be9cbdbbcc30c98c749f75d3
Open

[Snyk] Security upgrade nuxt from 3.13.2 to 3.15.3#136
kevin-benton wants to merge 1 commit intomainfrom
snyk-fix-1acf6ba0be9cbdbbcc30c98c749f75d3

Conversation

@kevin-benton
Copy link
Contributor

snyk-top-banner

Snyk has created this PR to fix 1 vulnerabilities in the pnpm dependencies of this project.

Snyk changed the following file(s):

  • package.json
⚠️ Warning
Failed to update the pnpm-lock.yaml, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

Issue Score
high severity Relative Path Traversal
SNYK-JS-NANOTAR-15272643
  170  

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Relative Path Traversal

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-NANOTAR-15272643
@kevin-benton
Copy link
Contributor Author

Merge Risk: Medium

This upgrade from Nuxt v3.13.2 to v3.15.3 is a minor update that introduces new features and performance improvements. However, it carries a medium risk due to the inclusion of a major new version of a core dependency.

Key Changes:

  • Vite 6 Integration: Nuxt v3.15.0 includes Vite 6. While the Nuxt team expects this to be non-breaking for most users, it is a significant underlying change. Projects with custom Vite configurations or dependencies that rely on a specific Vite version should be tested carefully.
  • New Features in v3.14: Introduces an experimental rspack builder, a shared/ folder for code shared between client/server, and new composables like useResponseHeader.
  • New Features in v3.15: Adds a 'navigation' mode for the callOnce composable and improves Hot Module Replacement (HMR) for templates and pages.

Recommendation:
Given the major version bump of Vite, it is recommended to thoroughly test the application after upgrading, paying close attention to the build process and any custom Vite plugins or configurations.

Source: Nuxt 3.14 Release Notes, Nuxt 3.15 Release Notes

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants