Bump nuxt and @nuxt/content

[dependabot]

Bumps nuxt and @nuxt/content. These dependencies needed to be updated together.
Updates nuxt from 3.21.6 to 4.5.1

Release notes

Sourced from nuxt's releases.

v4.5.1

⚠️ This is a security release. We recommend upgrading as soon as possible with npx nuxt upgrade --dedupe.

It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, cross-user payload disclosure on cached pages, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.

If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.

If you use the cache, swr or isr route rules, purge any CDN or edge cache after upgrading; a leaked _payload.json may already be cached upstream.

Full details: Nuxt Security Patch Releases and GitHub Security Advisories.

👉 Changelog

compare changes

🔥 Performance

• nitro: Replace island teleports in a single html pass (#35515)
• nuxt: Add vue.optionsApi and disable it for v5+ (#35791)
• nuxt: Without pages, skip client plugins that require routing (#35794)
• nuxt: Skip payload revival plugin when ssr: false (#35782)

🩹 Fixes

• nitro: Read rspack dev output fs lazily for server entry (#35740)
• rspack,webpack: Resolve loaders and runtime deps from nuxt dirs (#35568)
• nuxt: Return global route for useRoute in detached effect scope (#35659)
• nuxt: Ignore custom name or path when reusing an existing page in pages:extend (#35661)
• nuxt: Render client components in nested server components (#35669)
• nuxt: Preserve explicit useFetch method inference (#35671)
• nuxt: Revalidate cached route payloads instead of using force-cache (#35672)
• nuxt: Correct default export detection in plugin metadata (#35676)
• nuxt: Clear hide/reset timeouts in set() (#35534)
• kit,nuxt,rspack,schema,webpack: Add .mts file extension in resolver (#33845)
• nuxt: Preserve trailing slash in NuxtLink href when unset (#35501)
• nuxt: Don't cross-pollute useAsyncData cache on reactive key change (#35656)
• nuxt: Filter plugin dependencies by build target (#35682)
• nuxt: Reload real page module on HMR of JSX render-function pages (#35678)
• nuxt: Resolve @unhead/vue/* from nuxt's dependency tree (#35690)
• kit: Surface module load errors instead of masking as missing (#35497)
• nuxt: Type auto-imported $fetch with nitro's $Fetch (#35704)
• nuxt: Don't reference app config sources in shared and node tsconfigs (#35673)
• vite: Resolve SSR inlined CSS module class name mismatch (#35610)
• nuxt: Generate layout types even when pages module is disabled (#35717)
• nitro: Skip resource hints for stylesheets already rendered as blocking links (#35691)
• kit: Dedupe layers that are both auto-scanned and explicitly extended (#35712)
• nuxt: Don't apply scroll behaviour after a subsequent nav (#35719)
• vite: Ensure server sourcemap-preserver plugin actually runs (#35680)
• vite: Preserve css suffix when extracting ssr inline styles (#35714)
• nuxt: Watch external component directories in development (#35652)
• nuxt: Don't exclude client entry module from style extraction (#35720)
• nuxt: Amend cleanup command in NUXT_B7014 error message (#35735)
• nuxt: Only pull in vue-router when there are island pages (#35739)
• vite: Suppress external warnings for internal vite-node paths (#35744)

... (truncated)

Commits

• 452dd50 v4.5.1
• 581651f fix(nuxt): reject top-level as prop for islands
• ee6c846 fix(nuxt): reject reserved template island prop under runtime compiler
• ad624a7 fix(nuxt): case-fold route rule keys to match folded lookups
• 4e35ae9 fix(nitro): bound island props and v-for to prevent unauthenticated DoS
• 352135f fix(nuxt): remove dev error overlay when error is cleared (#35821)
• b1a8e93 fix(nitro,nuxt,vite): dedupe and normalise global css links in dev (#35834)
• df55902 fix(nuxt): convert inline route rules exactly or drop with a warning (#35455)
• 083b750 fix(nuxt): warn when an imports preset from cannot be resolved (#35799)
• 61eb637 perf(nuxt): skip payload revival plugin when ssr: false (#35782)
• Additional commits viewable in compare view

Updates @nuxt/content from 2.13.4 to 3.15.2

Changelog

Sourced from @​nuxt/content's changelog.

3.15.2 (2026-07-23)

Bug Fixes

• dev: ignore temporary files in content source paths (#3784) (a019e70)
• security: reject SQL function calls in query WHERE clauses (#3819) (847d523)

3.15.1 (2026-07-21)

Bug Fixes

• dev: preserve SQL hashes in HMR dumps (#3816) (b6796e9)

3.15.0 (2026-07-02)

Features

• add explicit bun sqlite connector for Bun runtime deployments (#3741) (92ac2ab)
• search: add type inference for extraFields (#3714) (078491b)

Bug Fixes

• content: support validator detection with pnpm enableGlobalVirtualStore (#3791) (6b2720b)
• hmr: update all matching collections when a file changes (#3802) (06f8edb)
• search: softer heading-level boost curve and tuned defaults (#3801) (00d25a5)
• vercel: use tmp directory to clone contents (#3810) (793d59a)

3.14.0 (2026-05-18)

Features

• search: add useSearchCollection composable with FTS5 full-text search (#3787) (2a1a585)
• types: add custom properties on ContentConfig (#3761) (ea196c5)
• types: add NOT IN to SQLOperator type (#3785) (ab88eb3)

Bug Fixes

• docs: update Nuxt version from 3 to 4 in template features (#3780) (1f24029)
• path-meta: slugify function did not pass to transformer (#3794) (778d7db)
• preview: skip collections without source in preview template (#3771) (8aabefd)

3.13.0 (2026-04-13)

Bug Fixes

• get mdc configs by calling mdc:configSources hook (#3736) (57f5552)
• preview: move formatDate/formatDateTime into runtime subtree (#3749) (4a76b2a)

3.12.0 (2026-02-27)

... (truncated)

Commits

• fe0af35 chore(release): v3.15.2
• a019e70 fix(dev): ignore temporary files in content source paths (#3784)
• 847d523 fix(security): reject SQL function calls in query WHERE clauses (#3819)
• d8fed0c chore(release): v3.15.1
• d7dc629 chore: update git ignore
• 7d9bcd8 chore: upgrade deps & lockfile (#3808)
• b6796e9 fix(dev): preserve SQL hashes in HMR dumps (#3816)
• e7e1269 chore(release): v3.15.0
• dedecc4 chore: upgrade mdc module
• f4ded6d chore: upgrade deps (#3811)
• Additional commits viewable in compare view

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.