[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@nuxt/schema (source)	3.17.4 → 3.21.11
nuxt (source)	3.17.4 → 3.21.11

---

Release Notes

nuxt/nuxt (@​nuxt/schema)

v3.21.11

Compare Source

3.21.11 is a patch release.

[!IMPORTANT]
Nuxt v3 is now end-of-life. Please upgrade to Nuxt v4, or you may wish to check out our partner HeroDevs who provide never-ending support for end-of-life releases

👉 Changelog

compare changes

🩹 Fixes

• nuxt: Serialize island payloads for components with underscores in keys (#​35807)
• nitro: Dedupe island renders when prerendering (#​35835)
• nitro: Reject non-object island props (#​35867)
• nuxt: Re-check for preview mode after prerendered page hydration (#​35886)
• nuxt: Settle asyncData status when bailing (#​35908)
• kit: Clone resolved config with klona rather than klona/full (#​35914)
• nuxt: Use client-side navigation for links inside islands (#​35806)
• nuxt: Match route rules against decoded paths (81f86ac5e)

🏡 Chore

• Unpin oxc-walker (a6c9dc6d3)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Samuel Burkhard (@​samydoesit)
• Alexander Lichter (@​TheAlexLichter)

v3.21.10

Compare Source

⚠️ This is a security release. We recommend upgrading as soon as possible with npx nuxt upgrade --dedupe.

It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.

If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.

Full details: Nuxt Security Patch Releases and GitHub Security Advisories.

👉 Changelog

compare changes

🩹 Fixes

• nuxt: Clear hide/reset timeouts in set() (#​35534)
• nuxt: Preserve trailing slash in NuxtLink href when unset (#​35501)
• vite: Resolve SSR inlined CSS module class name mismatch (#​35610)
• nuxt: Sync layout meta during middleware on SSR (#​35633)
• nuxt: Update client URL to match SSR on fatal middleware error (#​35637)
• nuxt: Watch external component directories in development (#​35652)
• nuxt: Don't cross-pollute useAsyncData cache on reactive key change (#​35656)
• nuxt: Return global route for useRoute in detached effect scope (#​35659)
• nuxt: Ignore custom name or path when reusing an existing page in pages:extend (#​35661)
• nuxt: Preserve explicit useFetch method inference (#​35671)
• nuxt: Correct default export detection in plugin metadata (#​35676)
• nuxt: Reload real page module on HMR of JSX render-function pages (#​35678)
• vite: Ensure server sourcemap-preserver plugin actually runs (#​35680)
• nuxt: Resolve @unhead/vue/* from nuxt's dependency tree (#​35690)
• nuxt: Don't apply scroll behaviour after a subsequent nav (#​35719)
• vite: Preserve css suffix when extracting ssr inline styles (#​35714)
• nuxt: Don't exclude client entry module from style extraction (#​35720)
• kit: Avoid mutating layer configs when resolving options (#​35729)
• nuxt: Generate layout types even when pages module is disabled (#​35717)
• nitro: Skip resource hints for stylesheets already rendered as blocking links (#​35691)
• nuxt: Revalidate cached route payloads instead of using force-cache (#​35672)
• nuxt: Preserve query params in cached payload extraction (#​35696)
• rspack,webpack: Resolve loaders and runtime deps from nuxt dirs (#​35568)
• nuxt: Render client components in nested server components (#​35669)
• nuxt: Remove dev error overlay when error is cleared (#​35821)
• rspack,webpack: Resolve bundled postcss defaults from builder (#​35823)
• schema: Normalise slashes in app.buildAssetsDir (#​35833)
• nuxt: Case-fold route rule keys to match folded lookups (619963309)
• nitro: Require loopback peer for chrome devtools workspace endpoint (00f71bb65)
• nitro: Bound island props and v-for to prevent unauthenticated DoS (668cdfdfd)
• nuxt: Reject reserved template island prop under runtime compiler (5b60017f7)
• nuxt: Reject top-level as prop for islands (00a2b0494)

📖 Documentation

• Document relative baseURL workarounds (#​34004)
• Warn about runtimeCompiler security best practices (b76c1a8bd)
• Warn about validating server component props (f6d72628d)

✅ Tests

• Guard against transient undefined _route in gotoPath (5391e7e6a)
• Raise route-HMR polling timeout to reduce e2e flakiness (cbc757c63)
• kit: Scope loadNuxt temp dir so it doesn't delete sibling fixtures (72e4b5578)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Florian Heuberger (@​Flo0806)
• Matej Černý (@​cernymatej)
• bdbch (@​bdbch)
• Elecmonkey (@​elecmonkey)
• Ryota Watanabe (@​wattanx)
• kealan (@​KealanAU)
• Julien Huang (@​huang-julien)
• Luke Nelson (@​luc122c)
• Harlan Wilton (@​harlan-zw)
• Mateleo (@​Mateleo)
• lutejka (@​lutejka)
• Darlan José Batista do Prado (@​DarlanPrado)
• Max (@​onmax)
• Sushant (@​sushantguri)
• raminjafary (@​raminjafary)

v3.21.9

Compare Source

3.21.9 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes

• vite: Use spa entry for vite-node fallback (3.x) (c8410a16a)
• kit,nuxt: Pass error as cause when we re-throw (#​35387)
• vite: Inline CSS for lazy components imported from #components (#​35215)
• nuxt: Validate <ClientOnly> fallback tag name (#​35325)
• vite: Extract server page CSS when inlineStyles is disabled (#​35209)
• nitro: Include nested layers in nitro transforms (#​35327)
• nitro: Export empty styles object with ssr: false (#​35330)
• nuxt: Emit auto-import paths as files, not directories (#​35333)
• nuxt: Suppress spurious slot warning in NuxtPage during nav (#​35335)
• vite: Preserve backslash separators in windows named pipe path (#​35336)
• nuxt: Detach in-flight promise on useAsyncData teardown (#​35328)
• nuxt: Respect per-page keepalive set via definePageMeta (#​34526)
• nuxt: Align useFetch error type with runtime (#​35346)
• nuxt: Unwrap getter body in useFetch (#​35343)
• rspack,webpack: Strip invalid webpack PURE annotations (#​35386)
• nuxt: Guard against -1 when unregistering a router hook (#​35391)
• nuxt: Clean up load/error listeners in preloadPayload (#​35392)
• nuxt: Avoid idle wait when refreshing data after hydration (#​35358)
• nuxt: Ensure page:start finishes before page:finish starts (#​35408)
• nuxt: Preserve plugin navigation during app boot (#​35344)
• vite: Add extension to vite-node-runner virtual import (e81a0c484)
• nuxt: Make virtual module IDs stable across hosts (#​35317)
• nuxt: Hash serialized island props (#​35356)
• vite: Avoid emitted ssr styles file name collisions (#​35432)
• nuxt: Avoid syncing route too early when reused page remounts (#​35440)
• nuxt: Keep nested layout on deferred route during suspended layout switch (#​35443)
• vite: Set define for NODE_ENV and __VUE_PROD_DEVTOOLS__ (#​35444)
• nuxt: Restore deferred query route before page is mounted (#​35442)
• nuxt: Make islands hash backwards-compatible (#​35452)
• nuxt: Pass nuxt rootDir to typed-router context (#​35565)
• nitro: Only reload nitro after initial nitro build (6ba8e26a5)
• schema: Enable HMR for defineNuxtComponent in JSX (#​35620)
• schema: Resolve Vite cache directory from workspace (#​35626)
• nitro: Write prerender cache files atomically (#​35619)
• nuxt: Apply latest navigation on concurrent navigateTo in built-in router (#​35631)

📖 Documentation

• Improving testing documentation for better understanding (#​35526)
• Add tip about prerendering registration for pages (#​35635)
• Clarify useFetch custom data error (#​35647)
• Drop reference to non-existent section (bd1943d04)
• Update link to /3.x slug (71bdb972d)

🏡 Chore

• Allow node version updates (#​35297)

✅ Tests

• Assert dev css delivery transport for server pages (9851e993b)
• Count only render-blocking stylesheet links for page styles (b0e895a7f)
• Await expectNoClientErrors (afffe7f09)

🤖 CI

• Handle missing base branch (for stacked prs) (13a933f8a)
• Unlink issues from autoclosed PRs (#​35615)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Florian Heuberger (@​Flo0806)
• Mateleo (@​Mateleo)
• Luke Nelson (@​luc122c)
• Darlan José Batista do Prado (@​DarlanPrado)
• Julien Huang (@​huang-julien)
• skoenfaelt (@​skoenfaelt)
• Anoesj Sadraee (@​Anoesj)
• raminjafary (@​raminjafary)
• Kurt Medley (@​HeavyMedl)
• isksss (@​isksss)
• Alexander Lichter (@​TheAlexLichter)
• Damian Głowala (@​DamianGlowala)
• Sami El Achi (@​samiashi)

v3.21.8

Compare Source

3.21.8 is a hotfix release to address an issue running the dev server on MacOS.

👉 Changelog

compare changes

🩹 Fixes

• vite: Shorter socket name for macOs with tmp fallback (#​35265)
• kit: Respect type option in findPath (#​35272)
• deps: Update nuxt/scripts presets (ff6b060dd)

📖 Documentation

• Change null to undefined in data-fetching docs to match actual types (#​35301)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Ali Mahmmoud (@​AliMahmoudDev)
• Quentin Macq (@​quentinmcq)
• Eduardo San Martin Morote (@​posva)

v3.21.7

Compare Source

3.21.7 is the a security hotfix release.

👉 make sure to check https://github.com/nuxt/nuxt/security/advisories to view open advisories resolved by this release.

👉 Changelog

compare changes

🩹 Fixes

• nitro: Assign noSSR before deciding payload extraction (#​35108)
• vite: Avoid filtering out dirs with shared prefix from allowDirs (#​35112)
• nuxt: Use resolve from pathe for buildCache path boundary check (#​35111)
• nuxt: Prevent sibling-directory traversal in test component wrapper (#​35110)
• nitro: Pass event data to isValid in dev clipboard-copy listener (#​35109)
• nuxt: Validate protocols in reloadNuxtApp path before reload (#​35115)
• vite: Resolve vite clientServer with ssr: false (#​34959)
• vite: Prefix public asset virtuals with null byte (38d330179)
• nuxt: Handle missing payload in chunkError listener (#​35155)
• vite: Close vite dev server on nuxt close (d007d7060)
• kit,nuxt: Handle cancelling prompts to install packages (59821a5ca)
• nuxt: Await in-lifght template generation when closing nuxt (#​35181)
• webpack: Surface compilation errors when stats.toString is empty (71dccff2b)
• kit: Improve TS extension stripping/substitutions (#​35233)
• nuxt: Preserve .d.mts/.d.cts in resolveTypePaths (#​35235)
• nuxt: Reject prototype-chain keys in the island registry (#​35205)
• nitro: Gate chrome devtools workspace endpoint to local requests (#​35201)
• nuxt: Escape props in <NuxtClientFallback> ssr output (#​35199)
• nuxt: Apply isScriptProtocol guard to navigateTo open option (#​35206)
• rspack,webpack: Require loopback host when missing same-origin signals (#​35200)
• nuxt: Absolutely resolve defu in app config template (40bedf0db)
• nuxt: Match route rules case-insensitively to mirror vue-router (3f3e3fa7b)
• nuxt: Escape <NoScript> slot content (7fea9fd68)
• nuxt: Block path-normalization open redirect in navigateTo (1f2dd5e78)
• nuxt: Reject cross-origin paths in reloadNuxtApp (6497d99dd)
• vite: Bind vite-node IPC to a permissioned filesystem socket (c293bf950)
• nuxt: Reject script-capable protocols in <NuxtLink> href (53284043d)
• nuxt: Clarify page and layout usage warnings (#​35184)
• nuxt: Do not absolutely resolve defu (d11d7b1b5)

📖 Documentation

• Edit for clarity and grammar (#​35214)
• Add dedicated module dependencies page (#​35171)

🏡 Chore

• Use execFileSync for safety in release scripts (9a455a658)
• Assert there is always a tag (8da21fba8)
• Fix type in test (bc2837125)
• Fix lychee dynamic composable exclude (#​35119)
• Add autofix action tag in comment (70eba297f)
• Update renovate minimum release age (27a6821a1)

✅ Tests

• Update test for js payload rendering (b51a80840)
• Improve reliability of hmr test (0078499f0)

🤖 CI

• Always run all tests for 4.x/3.x (0519c0ade)
• Update to agentscan v1.8.0 (#​35120)
• Automatically close PRs from automated accounts (#​35161)
• Migrate from tibdex (6277aedcb)
• Disable provenance-change enforcement in dependency-review (1d4910eed)
• Add zizmor github actions check (#​35089)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Matej Černý (@​cernymatej)
• anton-gor-dev (@​anton-gor-dev)
• Julien Huang (@​huang-julien)
• David Stack (@​davidstackio)
• Noah3521 (@​Noah3521)
• Matteo Gabriele (@​MatteoGabriele)
• Mohit Kumar (@​mohitkum4r)
• Florian Heuberger (@​Flo0806)

v3.21.6

Compare Source

3.21.6 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes

• nuxt: Prefer our own builder/server deps (#​35029)
• nitro: Add json extension to payload cache items (#​35043)
• nuxt: Handle errors fetching app manifest (#​35050)
• nuxt: Preserve setPageLayout props on same-path navigation (#​35055)
• vite: Don't strip buildAssetsDir from vite-node SSR ids (#​35040)
• nuxt: Mark useLoadingIndicator properties as readonly (#​35062)
• vite: Strip queries in css inline styles map (#​35067)
• nuxt: Encode html-significant characters in external redirect body (#​35052)
• nitro: Validate island request hash matches props (#​35077)
• nitro: Use regexp to strip query (042b615e6)
• nitro: Use statusCode for nitro v2 compatibility (82dcd6a31)
• nuxt: Render component-less parent routes during client-side nav (#​35036)
• nuxt: Run middleware for page islands (#​35092)

💅 Refactors

• rspack,webpack: Extract same-origin check for dev middleware (#​35051)

📖 Documentation

• Remove CSB, set node 22 and use steps for clarity (#​35066)

🏡 Chore

• Ignore link-like syntax in code (f9bf11b11)
• Narrow engines.node in test (5ed9a2691)
• Remove unused import (3a8bb0030)

✅ Tests

• Relax relative time assertion (256513eb0)
• Move build assets dir fixture out of app/ (6d2ac69ff)

🤖 CI

• Clean up agent-scan workflow (31590cf07)
• Continue autofix workflow when test:engines fails (958abb882)
• Improve workflows (#​35088)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Julien Huang (@​huang-julien)
• Damian Głowala (@​DamianGlowala)
• Sébastien Chopin (@​atinux)
• Adrien Foulon (@​Tofandel)

v3.21.5

Compare Source

3.21.5 is the next patch release.

👉 Changelog

compare changes

🔥 Performance

• kit: Cache layer roots and short-circuit isIgnored relative (#​35015)

🩹 Fixes

• nitro: Correct payload route rule for / + override ssr: true (#​34990)
• nitro: Break recursive rendering deadlocks during prerender (#​34939)
• vite: Drop redundant css link when entry styles are inlined (#​34950)
• nuxt: Only force suspense remount after first resolve (#​34949)
• kit: Read .env before resolving nuxt schema (#​34958)
• nitro: Preserve serverHandlers array after nitro:config (#​34985)
• vite: Only consider CSS inlined when styles are actually emitted (#​35006)
• nuxt: Handle string presets in auto-imports (#​35013)
• nuxt: Correct island transform for server pages and 'deep' mode (#​35005)
• vite: Inline css for non-island children of server components (#​35001)
• nuxt: Defer head DOM updates until page transition finishes (#​35016)
• nuxt: Explicitly freeze head during island plugin phase (#​35010)
• vite: Inline css imported from non-vue js modules (#​35020)
• nitro: Remove unused middleware (fe857d36b)

📖 Documentation

• Add warning about routing in server components (#​34994)

🏡 Chore

• Ignore pnpm cyclic workspace deps warn (#​34998)
• Remove jiti from build steps (#​35004)
• Fix lockfile (48e56a509)
• nuxt: Cast to nitro event handler type (5b358ca19)

✅ Tests

• Extract server components fixture + add some failing tests (#​34995)
• Isolate buildDir per matrix project for shared fixtures (#​35007)
• Split env testing into separate file (fd4019cf8)
• Use 3.x style tsconfig (86625efad)
• Use more 3.x style tsconfigs (4a9bde3f3)
• Correct import path (133d5f6d7)
• Update snapshots (9fc42f788)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Harlan Wilton (@​harlan-zw)
• Jonazzzz (@​Bombastickj)
• Damian Głowala (@​DamianGlowala)
• Florian Heuberger (@​Flo0806)

v3.21.4

Compare Source

v3.21.2

Compare Source

v3.21.1

Compare Source

3.21.1 is a regularly schedule patch release.

👉 Changelog

compare changes

🩹 Fixes

• nuxt: Correct reference format of server builder (#​34177)
• nuxt: Add status/statusText getters to NuxtError (#​34188)
• schema: Add direnv and vendor to default ignore (#​34190)
• nuxt: Focus hash links after navigation (#​34193)
• nuxt: Exclude head runtime from unhead imports transform (#​34195)
• kit: Include prereleases in semver satisfy check (#​34210)
• nuxt: Watch server/ for builder:watch hook (#​34208)
• nitro: Encode unicode paths in x-nitro-prerender header (#​34202)
• nitro: Preserve error.message for fatal errors (#​34226)
• Only enable dynamic imports when ts plugin (#​34205)
• webpack: Use H3Error for 403 in dev server (#​34233)
• nuxt: Ensure NuxtError extends Error type (#​34242)
• vite: Use H3Error for 404 in dev server (#​34225)
• nuxt: Add backwards compat for #app barrel export in keyed functions (#​34199)
• nuxt: Track + re-add custom routes on hmr (#​32044)
• nuxt: Keep vnode when leaving deeper nested route (#​33778)
• vite: Prevent CSS flickering in dev mode after config changes (#​33856)
• nuxt: Do not start view transition if there is no route (#​33723)
• nuxt: Call deferHydration done on NuxtPage unmount (#​34152)
• nuxt: Handle invalid datetime in ` (#​33992)
• nuxt: Preserve middleware error status in 404 fallback (#​34148)
• nitro: Do not augment nuxt/schema (#​34255)
• nuxt: Cache manifest files to preserve buildId (#​34002)
• nuxt: Don't decode query string in SSR context URL (#​34252)
• nuxt: Allow specifying moduleDependencies by meta.name (#​34263)
• nuxt: Resolve #components import mapping conflict for packages outside rootDir (#​34139)
• vite,webpack: Use node.res to send 403/404 (#​34266)
• nitro,nuxt: Align path encoding with vue-router (#​34265)
• nitro: Augment nuxt/schema once more (9f5bb611d)

💅 Refactors

• nuxt: Prefer genObjectKey to omit unnecessary quotes (#​34245)
• nuxt: Use ComponentProps helper to extract layout props (#​34248)

📖 Documentation

• Remove link to ai guide entirely (084b5d7f2)
• Update roadmap dates (#​34166)
• Clarify shared type context limitations for custom imports (#​34194)
• Fix broken links (#​34223)
• Document payload extraction for ISR/SWR routes (#​34222)
• Update example of email validation (#​34247)
• Add documentation for keyedComposables (#​34201)

🏡 Chore

• Remove px from width attribute (e80147f7d)
• Add ai config in gitignore (#​34220)

✅ Tests

• Vitest v4 compatibility (70e147b71)
• Add runtime tests for deeply nested <NuxtPage> navigation (707a9dc44)
• Resolve merge issues in tests (85abddc54)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Matej Černý (@​cernymatej)
• Octavio Araiza (@​8ctavio)
• Muhammad Yasir Ghaffar (@​M-YasirGhaffar)
• Max (@​onmax)
• Bobbie Goede (@​BobbieGoede)
• 纸鹿/Zhilu (@​L33Z22L11)
• Florian Heuberger (@​Flo0806)
• 山吹色御守 (@​KazariEX)
• ExXTreMe315 (@​ExXTreMe315)
• Eugene (@​FlexIDK)
• abeer0 (@​iiio2)
• Jonas Thelemann (@​dargmuesli)
• Erwan Jugand (@​erwanjugand)

v3.21.0

Compare Source

3.21.0 is the next minor release.

Nuxt 4.3 and 3.21 bring powerful new features for layouts, caching, and developer experience – plus significant performance improvements under the hood.

📣 Some News

Extended v3 Support

Early this month, I opened a discussion to find out how the upgrade had gone from v3 to v4. I was really pleased to hear how well it had gone for most people.

Having said that, we're committed to making sure no one gets left behind. And so we will continue to provide security updates and critical bug fix releases beyond the previously announced end-of-life date of January 31, 2026, meaning Nuxt v3 will meet its end-of-life on July 31, 2026.

[!TIP]
As usual, today also brings a minor release for v3, with many of the same improvements backported from v4.3.

Preparing for Nuxt 5

We're closer than ever to the releases of Nuxt v5 and Nitro v3. In the coming weeks, the main branch of the Nuxt repository will begin receiving initial commits for Nuxt 5. However, it's still business as usual.

• Continue making pull requests to the main branch
• We'll backport changes to the 4.x and 3.x branches

Keep an eye out on the Upgrade Guide – we'll be adding details about how you can already start migrating your projects to prepare for Nuxt v4 with future.compatibilityVersion: 5.

🗂️ Route Rule Layouts

But that's enough about the future. We have a lot of good things for you today!

First, you can now set layouts directly in route rules using the new appLayout property (#​31092). This provides a centralized, declarative way to manage layouts across your application without scattering definePageMeta calls throughout your pages.

export default defineNuxtConfig({
  routeRules: {
    '/admin/**': { appLayout: 'admin' },
    '/dashboard/**': { appLayout: 'dashboard' },
    '/auth/**': { appLayout: 'minimal' }
  }
})

This might be useful for:

• Admin panels with a shared layout across many routes
• Marketing pages that need a different layout from the app

[!TIP]
Plus, you can pass props to layouts now! See the setPageLayout improvements below.

📦 ISR/SWR Payload Extraction

Payload extraction now works with ISR (incremental static regeneration), SWR (stale-while-revalidate) and cache routeRules (#​33467). Previously, only pre-rendered pages could generate _payload.json files.

This means:

• Client-side navigation to ISR/SWR pages can use cached payloads
• CDNs (Vercel, Netlify, Cloudflare) can cache payload files alongside HTML
• Fewer API calls during navigation – data can be prefetched and served from the cached payload

export default defineNuxtConfig({
  routeRules: {
    '/products/**': { 
      isr: 3600, // Revalidate every hour
    }
  }
})

🧹 Dev Mode Payload Extraction

Related to the above, payload extraction now also works in development mode (#​30784). This makes it easier to test and debug payload behavior without needing to run a production build.

[!IMPORTANT]
Payload extraction works in dev mode with nitro.static set to true, or for individual pages which have isr, swr, prerender or cache route rules.

🚫 Disable Modules from Layers

When extending Nuxt layers, you can now disable specific modules that you don't need (#​33883). Just pass false to the module's options:

export default defineNuxtConfig({
  extends: ['../shared-layer'],
  // disable @nuxt/image from layer
  image: false,
})

🏷️ Route Groups in Page Meta

Route groups (folders wrapped in parentheses like (protected)/) are now exposed in page meta (#​33460). This makes it easy to check which groups a route belongs to in middleware or anywhere you have access to the route.

<script setup lang="ts">
// This page's meta will include: { groups: ['protected'] }
useRoute().meta.groups
</script>

export default defineNuxtRouteMiddleware((to) => {
  if (to.meta.groups?.includes('protected') && !isAuthenticated()) {
    return navigateTo('/login')
  }
})

This provides a clean, convention-based approach to route-level authorization without needing to add definePageMeta to every protected page.

🎨 Layout Props with setPageLayout

The setPageLayout composable now accepts a second parameter to pass props to your layout (#​33805):

export default defineNuxtRouteMiddleware((to) => {
  setPageLayout('admin', {
    sidebar: true,
    theme: 'dark'
  })
})

<script setup lang="ts">
defineProps<{
  sidebar?: boolean
  theme?: 'light' | 'dark'
}>()
</script>

🔧 #server Alias

A new #server alias provides clean imports within your server directory (#​33870), similar to how #shared works:

// Before: relative path hell
import { helper } from '../../../../utils/helper'

// After: clean and predictable
import { helper } from '#server/utils/helper'

The alias includes import protection – you can't accidentally import #server code from client or shared contexts.

🪟 Draggable Error Overlay

The development error overlay introduced in Nuxt 4.2 is now draggable and can be minimized (#​33695). You can:

• Drag it to any corner of the screen (it snaps to edges)
• Minimize it to a small pill button when you want to keep working
• Your position and minimized state persist across page reloads

This is a quality-of-life improvement when you're iterating on fixes and don't want the overlay blocking your view.

https://github.com/user-attachments/assets/nuxt_4-3_error_demo.mp4

⚙️ Async Plugin Constructors

Module authors can now use async functions when adding build plugins (#​33619):

export default defineNuxtModule({
  async setup() {
    // Lazy load only when actually needed
    addVitePlugin(() => import('my-cool-plugin').then(r => r.default()))
    
    // No need to load webpack plugin if using Vite
    addWebpackPlugin(() => import('my-cool-plugin/webpack').then(r => r.default()))
  }
})

This enables true lazy loading of build plugins, avoiding unnecessary code loading when plugins aren't needed.

🚀 Performance Improvements

This release includes several performance optimizations for faster builds:

• Hook filters - Internal plugins now use filters to avoid running hooks unnecessarily (#​33898)
• SSR styles optimization - The nuxt:ssr-styles plugin is now significantly faster (#​33862, #​33865)
• Layer alias transform - Skipped when using Vite (it handles this natively) (#​33864)
• Route rules compilation - Route rules are now compiled into a client chunk using rou3, removing the need for radix3 in the client bundle and eliminating app manifest fetches (#​33920)

🎨 Inline Styles for Webpack/Rspack

The inlineStyles feature now works with webpack and rspack builders (#​33966), not just Vite. This enables critical CSS inlining for better Core Web Vitals regardless of your bundler choice.

⚠️ Deprecations

statusCode → status, statusMessage → statusText

In preparation for Nitro v3 and H3 v2, we're moving to use Web API naming conventions (#​33912). The old properties still work but are deprecated in advance of v5:

- throw createError({ statusCode: 404, statusMessage: 'Not Found' })
+ thr

> [!IMPORTANT]
> ✂ PR body was truncated to here.


</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/privy-open-source/nhp).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC4zMy42IiwidXBkYXRlZEluVmVyIjoiNDQuMjIwLjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->