Skip to content

Update dependency nuxt to v4.6.3 - #260

Open
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/nuxtjs-monorepo
Open

Update dependency nuxt to v4.6.3#260
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/nuxtjs-monorepo

Conversation

@renovate

@renovate renovate Bot commented Oct 30, 2026 •
edited by chrissearle
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
nuxt (source) 4.6.2 → 4.6.3 age confidence

Release Notes

nuxt/nuxt (nuxt)

v4.6.3

Compare Source

v4.6.3 is the next patch release.

👉 Changelog

compare changes

🚨 Security fixes
🔥 Performance
  • vite: skip compiling plain style blocks in the server build (#​36711)
  • nitro,nuxt,rspack,webpack: bundle esm vue + reuse caches (#​36710)
  • vite: avoid quadratic nested dir check for fs.allow (#​36702)
  • nuxt: server render internal custom links without RouterLink (#​36707)
  • nuxt: skip unneeded typed routes generation (#​36645)
🩹 Fixes
  • nitro: don't share prerender hints with self-fetched requests (#​36705)
  • nuxt: defer app scope cleanup on external navigation (#​36713)
  • nuxt: prevent useCookie CookieStore sync from rewriting with refresh (#​36673)
  • nuxt: only return redirects from navigateTo while middleware runs (#​36650)
  • nuxt: remove purged entries from _asyncData (#​36709)
  • vite: skip quoted import.meta keys + limit replace to client dev (#​36703)
  • nuxt: hide RouteLocationRaw from navigateTo's public return type (#​36691)
  • nuxt: tree-shake auto-imported #app composables (#​36696)
  • nuxt: don't treat constrained route rules as covering dynamic pages (#​36701)
  • nuxt: include shared/ in build cache hash (#​36704)
  • nuxt: hash keyed function ids + page import names relative to rootDir (#​36697)
  • nuxt: encode page paths before matching route rule keys (#​36683)
  • nuxt: handle rejected updateCallbackDone of aborted view transition (#​36639)
  • ui-templates: keep loading shader proportions on narrow screens (#​36654)
  • nuxt: reject case-dependent route rule constraints w/ sensitive: false (#​36708)
  • nuxt: don't case-fold regex constraints in route rule keys (#​36694)
  • nuxt: normalise page prefix when finding route rule exceptions (#​36685)
  • vite: mirror ssr invalidations for created and deleted files (634cba64c)
  • nitro: keep noScripts wildcard patterns single-segment (fa323db7d)
  • deps: update unrouting to v0.3.1 (#​36663)
  • nuxt: avoid self-referencing nuxt/schema augmentation (#​36633)
  • nuxt: let nightly runtime resolve its own nuxt/* imports (#​36632)
  • nuxt: don't warn for vite+ vite.config files (#​36628)
  • kit: keep generated declaration first in tsconfig include (#​36627)
  • nuxt: clamp numeric v-for sources in island renders at render time (#​36623)
  • rspack,webpack: register vue-loader plugin only once per config (#​36622)
  • nitro: abort the portable request when the client disconnects (#​36652)
  • deps: update nitropack to 2.13.5 + drop obsolete workarounds (#​36649)
📖 Documentation
  • note provide/inject limit in server components (#​35837)
  • use American spelling in a few guides (#​36706)
  • document controlling prefetch hints via build:manifest hook (#​36695)
  • update StackBlitz link to point to version 4 (#​36674)
  • link to the 2.x docs (#​36640)
  • clarify that island props must be validated before iteration (4b12d15c9)
✅ Tests
  • list NUXT_B4023 as main-only (4fd54ff9a)
  • wait for leave transition before each scroll behaviour test (453406999)
  • vite: assert spa server bundle does not ship the app (#​36699)
  • nuxt: cover route rule coverage under a base url (#​36682)
  • list NUXT_B9006 as main-only (e107e0f40)
🤖 CI
  • only run full checks for the last merge queue entry (132698a46)
  • run a reduced matrix in the merge queue (7d228ba4b)
  • compare merge queue changes against the base branch (bad8c3637)
  • notify resolved issues after publishing a release (9d47884f3)
  • remove broken ai-moderator and ecosystem-ci trigger workflows (1d89ad434)
🎉 New Contributors
❤️ Contributors

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Oct 30, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@github-actions

github-actions Bot commented Oct 30, 2026

Copy link
Copy Markdown

Terraform Plan

🚧 Changes detected — Plan: 6 to add, 1 to change, 1 to destroy.

Plan output 
Acquiring state lock. This may take a few moments...

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.network.aws_security_group.tasks will be created
  + resource "aws_security_group" "tasks" {
      + arn                    = (known after apply)
      + description            = "ECS tasks of cupcake-cupcake; peer rules are managed by javabin-app-peers-sync"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = "cupcake-cupcake-tasks"
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = true
      + tags                   = {
          + "Name"            = "cupcake-cupcake-tasks"
          + "javabin-network" = "app"
        }
      + tags_all               = {
          + "Name"            = "cupcake-cupcake-tasks"
          + "environment"     = "production"
          + "javabin-network" = "app"
          + "managed-by"      = "terraform"
          + "repo"            = "javaBin/frosting"
          + "service"         = "cupcake"
          + "team"            = "cupcake"
        }
      + vpc_id                 = "vpc-0cd3502de2527a310"
    }

  # module.network.aws_service_discovery_service.this will be created
  + resource "aws_service_discovery_service" "this" {
      + arn           = (known after apply)
      + force_destroy = true
      + id            = (known after apply)
      + name          = "cupcake-cupcake"
      + namespace_id  = (known after apply)
      + tags_all      = {
          + "environment" = "production"
          + "managed-by"  = "terraform"
          + "repo"        = "javaBin/frosting"
          + "service"     = "cupcake"
          + "team"        = "cupcake"
        }
      + type          = (known after apply)

      + dns_config {
          + namespace_id   = "ns-4qfb7mei2fit4q4b"
          + routing_policy = "MULTIVALUE"

          + dns_records {
              + ttl  = 10
              + type = "A"
            }
        }

      + health_check_custom_config {
          + failure_threshold = 1
        }
    }

  # module.network.aws_ssm_parameter.network will be created
  + resource "aws_ssm_parameter" "network" {
      + arn            = (known after apply)
      + data_type      = (known after apply)
      + description    = "App-to-app request for cupcake-cupcake — read by the platform app-peers-sync Lambda"
      + has_value_wo   = (known after apply)
      + id             = (known after apply)
      + insecure_value = (known after apply)
      + key_id         = (known after apply)
      + name           = "/javabin/apps/cupcake/cupcake/network"
      + tags_all       = {
          + "environment" = "production"
          + "managed-by"  = "terraform"
          + "repo"        = "javaBin/frosting"
          + "service"     = "cupcake"
          + "team"        = "cupcake"
        }
      + tier           = (known after apply)
      + type           = "String"
      + value          = (sensitive value)
      + version        = (known after apply)
    }

  # module.network.aws_vpc_security_group_egress_rule.all will be created
  + resource "aws_vpc_security_group_egress_rule" "all" {
      + arn                    = (known after apply)
      + cidr_ipv4              = "0.0.0.0/0"
      + description            = "All outbound"
      + id                     = (known after apply)
      + ip_protocol            = "-1"
      + security_group_id      = (known after apply)
      + security_group_rule_id = (known after apply)
      + tags_all               = {
          + "environment" = "production"
          + "managed-by"  = "terraform"
          + "repo"        = "javaBin/frosting"
          + "service"     = "cupcake"
          + "team"        = "cupcake"
        }
    }

  # module.network.aws_vpc_security_group_ingress_rule.alb[0] will be created
  + resource "aws_vpc_security_group_ingress_rule" "alb" {
      + arn                          = (known after apply)
      + description                  = "ALB to the app port"
      + from_port                    = 3000
      + id                           = (known after apply)
      + ip_protocol                  = "tcp"
      + referenced_security_group_id = "sg-061000c0fa68a41b7"
      + security_group_id            = (known after apply)
      + security_group_rule_id       = (known after apply)
      + tags_all                     = {
          + "environment" = "production"
          + "managed-by"  = "terraform"
          + "repo"        = "javaBin/frosting"
          + "service"     = "cupcake"
          + "team"        = "cupcake"
        }
      + to_port                      = 3000
    }

  # module.service.aws_ecs_service.this will be updated in-place
  ~ resource "aws_ecs_service" "this" {
        id                                 = "arn:aws:ecs:eu-central-1:553637109631:service/javabin-platform/cupcake-cupcake"
        name                               = "cupcake-cupcake"
        tags                               = {}
      ~ task_definition                    = "arn:aws:ecs:eu-central-1:553637109631:task-definition/cupcake-cupcake:3" -> (known after apply)
        # (16 unchanged attributes hidden)

      ~ network_configuration {
          ~ security_groups  = [
              - "sg-0df9a0a3a22548c62",
            ] -> (known after apply)
            # (2 unchanged attributes hidden)
        }

      + service_registries {
          + registry_arn = (known after apply)
        }

        # (3 unchanged blocks hidden)
    }

  # module.service.aws_ecs_task_definition.this must be replaced
-/+ resource "aws_ecs_task_definition" "this" {
      ~ arn                      = "arn:aws:ecs:eu-central-1:553637109631:task-definition/cupcake-cupcake:3" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:eu-central-1:553637109631:task-definition/cupcake-cupcake" -> (known after apply)
      ~ container_definitions    = jsonencode(
          ~ [
              ~ {
                  ~ environment            = [
                        {
                            name  = "COGNITO_DOMAIN"
                            value = "javabin-internal.auth.eu-central-1.amazoncognito.com"
                        },
                      + {
                          + name  = "COGNITO_EXTRA_AUTH_PARAMS"
                          + value = "prompt=select_account"
                        },
                        {
                            name  = "COGNITO_GROUPS"
                            value = "helter"
                        },
                        # (6 unchanged elements hidden)
                    ]
                    name                   = "cupcake"
                  ~ portMappings           = [
                      ~ {
                          - hostPort      = 3000
                            # (2 unchanged attributes hidden)
                        },
                    ]
                  - systemControls         = []
                  - volumesFrom            = []
                    # (7 unchanged attributes hidden)
                },
            ] # forces replacement
        )
      ~ enable_fault_injection   = false -> (known after apply)
      ~ id                       = "cupcake-cupcake" -> (known after apply)
      ~ revision                 = 3 -> (known after apply)
      - tags                     = {} -> null
        # (10 unchanged attributes hidden)

      - volume {
          - configure_at_launch = false -> null
          - name                = "tmp" -> null
        }
      + volume {
          + configure_at_launch = (known after apply)
          + name                = "tmp"
        }
    }

Plan: 6 to add, 1 to change, 1 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

LLM Review

Risk: 🟡 MEDIUM

Creates networking/service-discovery resources for cupcake-cupcake and replaces its ECS task definition (6 to add, 1 to change, 1 to destroy), with no database or internet-facing security group opening.

  • 💥 [destruction] The aws_ecs_task_definition.this resource is destroy-and-replace (forces replacement, driven by container_definitions changes). Task definition revisions are immutable, so this creates a new revision; the ECS service is updated in-place to point at it. Confirm the ECS service rollout succeeds and that the old revision is not referenced elsewhere. Also note the container port mapping change: hostPort 3000 is removed from portMappings, which is usually harmless on awsvpc networking but should be verified.
  • 🔒 [security] The ECS service drops the existing security group sg-0df9a0a3a22548c62 from network_configuration and the plan shows the new tasks SG (aws_security_group.tasks) will be used via the service update. Verify the new SG is attached and the old SG removal does not unintentionally expose or cut traffic. The new ingress rule only allows TCP 3000 from the ALB SG sg-061000c0fa68a41b7, and egress is all-outbound to 0.0.0.0/0, which is standard for app tasks.
  • 🔒 [security] A new SSM parameter /javabin/apps/cupcake/cupcake/network is created with a sensitive value and read by a platform Lambda (app-peers-sync) that also manages peer rules on the tasks security group. Confirm the Lambda's IAM scope is limited to this parameter path and to the intended SG.
  • 🔒 [security] The task definition gains a COGNITO_EXTRA_AUTH_PARAMS env var (prompt=select_account). This is a benign auth-flow tweak, not a permission change, but it changes login behaviour for the app.
  • 💰 [cost] New resources are low-cost: a security group, SG rules, a Cloud Map service, and an SSM standard parameter. No NAT gateway, RDS, or load balancer is created. Routine ECS task replacement has no meaningful cost impact.

@renovate

renovate Bot commented Nov 3, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ Rebase not applied

This branch has not been rebased, as its update has not yet met the internal checks configured for it, such as minimumReleaseAge. Rebasing it now would add a dependency version which is still within its configured observation period.

Renovate will rebase this branch once its update has met those checks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants