chore(deps): bump nuxt from 4.5.0 to 4.5.1

[dependabot]

Bumps nuxt from 4.5.0 to 4.5.1.

Release notes

Sourced from nuxt's releases.

v4.5.1

⚠️ This is a security release. We recommend upgrading as soon as possible with npx nuxt upgrade --dedupe.

It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, cross-user payload disclosure on cached pages, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.

If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.

If you use the cache, swr or isr route rules, purge any CDN or edge cache after upgrading; a leaked _payload.json may already be cached upstream.

Full details: Nuxt Security Patch Releases and GitHub Security Advisories.

👉 Changelog

compare changes

🔥 Performance

• nitro: Replace island teleports in a single html pass (#35515)
• nuxt: Add vue.optionsApi and disable it for v5+ (#35791)
• nuxt: Without pages, skip client plugins that require routing (#35794)
• nuxt: Skip payload revival plugin when ssr: false (#35782)

🩹 Fixes

• nitro: Read rspack dev output fs lazily for server entry (#35740)
• rspack,webpack: Resolve loaders and runtime deps from nuxt dirs (#35568)
• nuxt: Return global route for useRoute in detached effect scope (#35659)
• nuxt: Ignore custom name or path when reusing an existing page in pages:extend (#35661)
• nuxt: Render client components in nested server components (#35669)
• nuxt: Preserve explicit useFetch method inference (#35671)
• nuxt: Revalidate cached route payloads instead of using force-cache (#35672)
• nuxt: Correct default export detection in plugin metadata (#35676)
• nuxt: Clear hide/reset timeouts in set() (#35534)
• kit,nuxt,rspack,schema,webpack: Add .mts file extension in resolver (#33845)
• nuxt: Preserve trailing slash in NuxtLink href when unset (#35501)
• nuxt: Don't cross-pollute useAsyncData cache on reactive key change (#35656)
• nuxt: Filter plugin dependencies by build target (#35682)
• nuxt: Reload real page module on HMR of JSX render-function pages (#35678)
• nuxt: Resolve @unhead/vue/* from nuxt's dependency tree (#35690)
• kit: Surface module load errors instead of masking as missing (#35497)
• nuxt: Type auto-imported $fetch with nitro's $Fetch (#35704)
• nuxt: Don't reference app config sources in shared and node tsconfigs (#35673)
• vite: Resolve SSR inlined CSS module class name mismatch (#35610)
• nuxt: Generate layout types even when pages module is disabled (#35717)
• nitro: Skip resource hints for stylesheets already rendered as blocking links (#35691)
• kit: Dedupe layers that are both auto-scanned and explicitly extended (#35712)
• nuxt: Don't apply scroll behaviour after a subsequent nav (#35719)
• vite: Ensure server sourcemap-preserver plugin actually runs (#35680)
• vite: Preserve css suffix when extracting ssr inline styles (#35714)
• nuxt: Watch external component directories in development (#35652)
• nuxt: Don't exclude client entry module from style extraction (#35720)
• nuxt: Amend cleanup command in NUXT_B7014 error message (#35735)
• nuxt: Only pull in vue-router when there are island pages (#35739)
• vite: Suppress external warnings for internal vite-node paths (#35744)

... (truncated)

Commits

• 452dd50 v4.5.1
• 581651f fix(nuxt): reject top-level as prop for islands
• ee6c846 fix(nuxt): reject reserved template island prop under runtime compiler
• ad624a7 fix(nuxt): case-fold route rule keys to match folded lookups
• 4e35ae9 fix(nitro): bound island props and v-for to prevent unauthenticated DoS
• 352135f fix(nuxt): remove dev error overlay when error is cleared (#35821)
• b1a8e93 fix(nitro,nuxt,vite): dedupe and normalise global css links in dev (#35834)
• df55902 fix(nuxt): convert inline route rules exactly or drop with a warning (#35455)
• 083b750 fix(nuxt): warn when an imports preset from cannot be resolved (#35799)
• 61eb637 perf(nuxt): skip payload revival plugin when ssr: false (#35782)
• Additional commits viewable in compare view

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.