v3.15.2

Compare Source

Bug Fixes

• dev: ignore temporary files in content source paths (#​3784) (a019e70)
• security: reject SQL function calls in query WHERE clauses (#​3819) (847d523)

v3.15.1

Compare Source

Bug Fixes

• dev: preserve SQL hashes in HMR dumps (#​3816) (b6796e9)

v1.0.3

Compare Source

v1.0.3 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes

• update command defaults and descriptions (#​677)

📦 Build

• migrate to tsdown (#​765)

🏡 Chore

• migrate to pnpm v11 (#​738)
• remove shamefully-hoist (#​580)
• migrate resolutions/pnpm.overrides to pnpm-workspace.yaml (cfb45fb)
• migrate npm badges and links to npmx.dev (afcf2fa)
• revert pnpm trust policy and restore provenance action (aeb1d38)
• update pnpm to 10.21 and enable trust policy (92eb2af)

✅ Tests

• accept nuxt/app specifier for NuxtError in snapshot (809c89f)
• update v4.5 error type as well (9412c91)
• accept either #app or nuxt/app in generated declarations (#​727)

🤖 CI

• use uppt release workflow (604d5b3)
• add agent-scan workflow to flag bot-authored PRs (4442a14)
• rename workflow (f7be1a6)
• avoid checkout in reproduction (57e7ce9)
• pin github actions to full-length commit shas (c3c8e72)
• add provenance action to check for downgrades in provenance (d87d217)
• run tests on node 20 (54c5f13)

🎉 New Contributors

• Damian Głowala (@​DamianGlowala)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Damian Głowala (@​DamianGlowala)
• Bobbie Goede (@​BobbieGoede)

v4.1.0

Compare Source

4.1.0 is the next minor release.

👉 Changelog

compare changes

🚀 Enhancements

• e2e: Silence server logs and allow customising log level (#​1735)
• runtime: Improve app.root and app.teleports html tag setup (#​1726)

🩹 Fixes

• e2e: Add warning message for e2e in nuxt vitest setup (#​1691)
• runtime-utils: Ensure RouterLink stub works with pages: false (#​1687)
• config: Patch ssr.resolve.conditions to remove import (#​1732)
• config: Browser setup in defineVitestProject (#​1724)
• config: Inline config for useRuntimeConfig() composable (#​1737)
• config: Nested browser-mode Nuxt Vitest projects with viteEnvironmentApi (#​1708)

📦 Build

• Migrate to tsdown (#​1720)

🏡 Chore

• Drop pkg.pr.new nitro resolution (#​1681)
• Migrate to pnpm v11 (#​1701)
• Move h3-next to optional dependencies (#​1733)

✅ Tests

• Add test for autoImport: false (#​1688)

🤖 CI

• Add agent-scan workflow to flag bot-authored PRs (13dd49cde)
• Migrate agentscan-action to v2 (08f8ee220)

❤️ Contributors

• Yoshihiro Yamaguchi (@​yamachi4416)
• Peter Budai (@​peterbud)
• Daniel Roe (@​danielroe)

v4.10.0

Compare Source

Features

• ChatPrompt: add body slot and focus highlight (#​6709) (123184b)
• ChatTool: add actions prop for tool approval (#​6694) (1a3a9dc)
• ContentSearch/DashboardSearch: support unmountOnHide prop (#​6523) (f03f98b)
• ContentToc: scroll list independently and center active link (#​6697) (64b9f7d)
• Drawer: add close and closeIcon props (#​6669) (53e88a4)
• Editor: allow disabling starter kit for plain text (#​6713) (76d613c)
• Empty: add loading and loadingIcon props (#​6707) (86cd25c)
• InputRating: new component (#​5757) (cba2c2c)
• Modal/Slideover: support unmountOnHide prop (#​6626) (4deb61b), closes #​5839 #​3605
• module: pre-bundle used icons into @nuxt/icon client bundle (#​6633) (8d46034)
• Popover: support enableTouch prop (#​6626) (54125f3), closes #​2346
• Prompt: add claude action (#​6693) (7bdcb13)
• prose: configurable heading anchors and copy button (#​6735) (f419731)
• ScrollArea: add getScrollElement virtualize option (#​6650) (a84de85)
• Table: add getScrollElement virtualize option (#​6657) (7e6d0f7)
• unplugin: pre-bundle used icons into the Vue/Vite build (#​6635) (dcf7cbc)

Bug Fixes

• AuthForm: track password visibility per field (#​6638) (0faeb92)
• BlogPost/ChangelogVersion: format date in UTC to prevent hydration mismatch (#​6722) (fe5bb23)
• Button: allow inline event handlers with non-void return types (#​6668) (269080a)
• Carousel: prevent reset when plugin props use inline objects (f41d11e), closes #​6221
• ChatMessages: re-evaluate streaming indicator on each render (#​6673) (5c986dd)
• components: forward $attrs to root element when to prop is absent (#​6628) (d3b5f1d)
• components: forward data-slot to component root (#​6643) (c9c5232)
• components: respect prefers-reduced-motion in animations (#​6723) (f951529)
• ContentNavigation: key items by identity to prevent leading icon flash (#​6640) (09fb52b)
• defineShortcuts: add missing arrowdown to shiftable keys (#​6702) (2128414)
• defineShortcuts: defer standalone shortcuts that prefix a chain (#​6703) (76ee176)
• Editor: prevent suggestion menu blinking on keystroke (#​6712) (7e6d8b0)
• FileUpload: add aria-disabled attribute when disabled (#​6653) (c3b2996)
• inertia: make useRoute().fullPath reactive across navigations (#​6696) (c256997)
• Link: apply rel prop to internal links (#​6677) (276302e)
• Link: fall back to original path when localePath fails (#​6637) (906e8fd)
• LocaleSelect: add missing keys in emoji mapping (#​6629) (fab73ab)
• module: avoid unhead v2-only hookOnce in colors plugin (#​6658) (e4ca579)
• SelectMenu/InputMenu: only re-highlight first item with create-item (#​6689) (a71dece)
• Separator: forward fall-through attributes to root (#​6641) (88baabc)
• theme: use logical properties for RTL (#​6724) (3179012)
• types: type prose components in app config (#​6711) (d56e39a)
• useComponentProps: let app config defaultVariants override withDefaults (#​6686) (f5e58fb)
• useFileUpload: keep dropzone type filter reactive to accept (#​6699) (000aba4)
• useResizable: recover from corrupted persisted storage (#​6704) (4c60745)
• useResizable: share resize logic between mouse and touch (#​6705) (730a54c)
• useScrollspy: unobserve previous headings on update (#​6700) (5944067)
• useToast: dedupe duplicate ids and handle max of 0 (#​6698) (71c623b)

Performance Improvements

• components: drop the redundant inner in component extend (#​6647) (3bf1a92)
• module: declare sideEffects for barrel tree-shaking (#​6729) (2cc2849)
• types: decouple useComponentProps from the component-types barrel (#​6648) (6576fb8)
• types: import cross-component types from source, not the barrel (#​6646) (7eab4bc)
• vue: skip rewriting unchanged templates (#​6730) (14b6001)

v10.8.0

Compare Source

Features

• 2fee9bb feat: export ConfigObject from eslint/config (#​21082) (sethamus)

Bug Fixes

• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#​21129) (Francesco Trotta)
• 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#​21116) (Pixel)
• e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#​21081) (synthex-byte)
• 20b5ad0 fix: quadratic-time regex in prefer-template (#​21096) (Milos Djermanovic)
• 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#​21094) (Pixel)
• b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#​21083) (Francesco Trotta)

Documentation

• 6ddf858 docs: fix broken Specify Parser Options anchor link (#​21106) (Minsu)
• 784dfbe docs: Clarify no-eq-null description (#​21120) (Park Harin)
• 7ec733a docs: Fix typos and grammar in glossary (#​21095) (Marry (Subin Yang))
• 92bb13f docs: replace quake link (#​21108) (Jung Hyeon Jun)
• 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#​21103) (Minsu)
• d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#​21099) (Jung Hyeon Jun)
• eccc68d docs: correct --suppressions-location option description (#​21093) (Ga eun Lee)
• c5963f7 docs: Update README (GitHub Actions Bot)

Chores

• 4fbf46d test: pin webpack version to 5.108.4 (#​21137) (Francesco Trotta)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#​21101) (Bo Hyun Kim)
• eccbe7b test: add error locations to no-class-assign (#​21123) (devoil)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#​21118) (dependabot[bot])
• e9d66d0 ci: bump actions/setup-node from 6 to 7 (#​21119) (dependabot[bot])
• ee225b6 test: Add error location details to no-eq-null rule (#​21117) (Park Harin)
• 044a627 chore: update minimatch to ^10.2.5 (#​21107) (김채영)
• fb09aa8 chore: update ecosystem plugins (#​21115) (ESLint Bot)
• 5abd878 test: add error locations to no-proto (#​21114) (Gihyeon Jeong / 정기현)
• 9715887 test: Add error location details to no-div-regex (#​21110) (Park Harin)
• a746ec6 test: add error locations to no-new-wrappers (#​21109) (Gihyeon Jeong / 정기현)
• 8dde645 test: add error locations to no-ex-assign (#​21102) (devoil)
• 13ab0ec test: add error locations to no-label-var (#​21098) (Gihyeon Jeong / 정기현)
• a99906f test: Add error location details to no-delete-var rule (#​21105) (Park Harin)
• c47e8dc chore: add missing backticks to languages/js/index.js (#​21104) (beeen)
• 0174428 chore: add missing backticks to translate-cli-options.js (#​21097) (dongkyu lee)
• 3d36589 chore: add missing backticks to serialization.js (#​21091) (이규환)
• dcc9312 test: add error locations to eqeqeq (#​21090) (Ga eun Lee)
• 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#​21089) (Marry (Subin Yang))
• 5d2f866 chore: update dependency prettier to v3.9.5 (#​21086) (renovate[bot])
• d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#​21084) (Francesco Trotta)
• bf3eda0 chore: update ecosystem plugins (#​21079) (ESLint Bot)

v0.56.0

Compare Source

Breaking Changes

• Reorganizes the exported ESM modules to provide supported, tree-shakeable entry points (#​5155). The monaco-editor entry point continues to load all features and languages. Custom bundles can now import monaco-editor/editor and opt into:
  • all editor features with monaco-editor/features/register.all, or individual features with monaco-editor/features/<feature>/register;
  • all language definitions with monaco-editor/languages/definitions/register.all, or individual definitions with monaco-editor/languages/definitions/<language>/register;
  • the CSS, HTML, JSON, and TypeScript language features with monaco-editor/languages/features/register.all, or their individual register entry points.
• Renames the misspelled IOverlayWidgetPosition.stackOridinal property to stackOrdinal.
• Removes the deprecated IMirrorModel and IWorkerContext worker API types.

New Features and APIs

• Adds editor.doubleClickSelectsBlock.
• Adds editor.find.closeOnResult and editor.inlayHints.showLongLineWarning.
• Adds offWhenInlineCompletions to QuickSuggestionsValue.
• Adds model and provider option support to inline completion providers.
• Adds ICodeEditor.revealAllCursors, ICodeEditor.getWidthOfLine, and ICodeEditor.renderAsync.
• Adds advanced-external and advanced-wasm diff algorithms.
• Exposes typed native LSP client and transport APIs.

Fixes

• Treats Markdown returned by language servers as untrusted (#​5280).
• Updates the editor core to the version used by 0.56.0-dev-20260625.

v22.23.2: 22.23.2

Compare Source

Node.js 22.23.2

v22.23.1: 22.23.1

Compare Source

Node.js 22.23.1

v22.23.0: 22.23.0

Compare Source

Node.js 22.23.0

v22.22.3: 22.22.3

Compare Source

Node.js 22.22.3

v22.22.2: 22.22.2

Compare Source

Node.js 22.22.2

v22.22.1: 22.22.1

Compare Source

Node.js 22.22.1

v22.22.0: 22.22.0

Compare Source

Node.js 22.22.0

v22.21.1: 22.21.1

Compare Source

Node.js 22.21.1

v22.21.0: 22.21.0

Compare Source

Node.js 22.21.0

v22.20.0: 22.20.0

Compare Source

Node.js 22.20.0

v22.19.0: 22.19.0

Compare Source

Node.js 22.19.0

v22.18.0: 22.18.0

Compare Source

Node.js 22.18.0

v22.17.1: 22.17.1

Compare Source

Node.js 22.17.1

v22.17.0: 22.17.0

Compare Source

Node.js 22.17.0

v22.16.0: 22.16.0

Compare Source

Node.js 22.16.0

v22.15.1: 22.15.1

Compare Source

Node.js 22.15.1

v22.15.0: 22.15.0

Compare Source

Node.js 22.15.0

v22.14.0: 22.14.0

Compare Source

Node.js 22.14.0

v22.13.1: 22.13.1

Compare Source

Node.js 22.13.1

v22.13.0: 22.13.0

Compare Source

Node.js 22.13.0

v22.12.0: 22.12.0

Compare Source

Node.js 22.12.0

v22.11.0: 22.11.0

Compare Source

Node.js 22.11.0

v22.10.0: 22.10.0

Compare Source

Node.js 22.10.0

v22.9.0: 22.9.0

Compare Source

Node.js 22.9.0

v22.8.0: 22.8.0

Compare Source

Node.js 22.8.0

v22.7.0: 22.7.0

Compare Source

Node.js 22.7.0

v22.6.0: 22.6.0

Compare Source

Node.js 22.6.0

v22.5.1: 22.5.1

Compare Source

Node.js 22.5.1

v22.5.0: 22.5.0

Compare Source

Node.js 22.5.0

v22.4.1: 22.4.1

Compare Source

Node.js 22.4.1

v22.4.0: 22.4.0

Compare Source

Node.js 22.4.0

v22.3.0: 22.3.0

Compare Source

Node.js 22.3.0

v22.2.0: 22.2.0

Compare Source

Node.js 22.2.0

v22.1.0: 22.1.0

Compare Source

Node.js 22.1.0

v0.142.0

🚀 Features

• 11f5d1f ast_visit: Add Utf8ToUtf16::convert_program_and_comments (#​24859) (overlookmotel)

🐛 Bug Fixes

• e80574f estree: Handle empty spans serializing ImportMeta and NewTarget (#​24775) (overlookmotel)

v0.141.0

💥 BREAKING CHANGES

• 54cc121 ast: [BREAKING] Split MetaProperty into ImportMeta and NewTarget (#​24557) (camc314)

🚀 Features

• 7b045cd minfier: Drop last break from last switch case (#​24673) (Armano)
• 3d22307 parser: Add ParseOptions::enable_ident_hashes (#​24491) (Boshen)

v1.1.1

Compare Source

Bug Fixes

• fix build script (#​350) (2438ec5)

v11.19.0: pnpm 11.19

Compare Source

Minor Changes

• pnpm login no longer requires an interactive terminal when the registry supports web-based login: without a TTY it prints the authentication URL (skipping the QR code and the "Press ENTER to open the URL in your browser" prompt) and polls the registry until the browser approval completes. Only the classic username/password login still fails with ERR_PNPM_LOGIN_NON_INTERACTIVE in a non-interactive terminal.

• The save-prefix setting now accepts =: newly added dependencies are saved with an explicit = operator (=1.2.3) instead of the setting being silently treated as the default ^.

Patch Changes

• allowBuilds entries can now approve git-hosted packages that pnpm downloads as a tarball, such as github: dependencies (which are fetched from codeload.github.com rather than cloned), by their repository URL without the resolved commit hash. This matches the hashless git+ matching already supported for cloned git dependencies. For example:

  allowBuilds:
    "foo@git+https://github.com/org/foo.git": true

  This approves the package whether pnpm clones it or downloads a tarball, so the entry no longer has to be updated every time the pinned commit changes. GitLab and Bitbucket tarball downloads are matched the same way. Approving or denying a specific resolved commit by its full tarball dep path continues to work.

• pnpm outdated --include-github-actions no longer blocks on an interactive git credential prompt when a workflow uses a private action repo.

• Prevented minimumReleaseAge from replacing latest with a SemVer-greater version than the registry tag target #​13034.

• Fixed empty bundledDependencies and bundleDependencies arrays causing nondeterministic lockfile changes. See #​13123.

• The install summary no longer prints (X is available) when the registry's dist-tags.latest is still held back by the active minimumReleaseAge policy. The hint only ever names the actual latest tag, so an immature latest suppresses the hint instead of advertising the version pnpm just refused to install #​11698.

• pnpm update keeps the explicit = operator of an exact version pin: a dependency saved as =3.5.1 now updates to =3.5.2 instead of the bare 3.5.2. See #​13168.

• Preserve a workspace dependency's link: entry when a run does not target it — e.g. pnpm update <other-pkg> (with or without --recursive), or a plain install after a root/catalog dependency change — with injectWorkspacePackages, instead of spuriously rewriting it to a peer-suffixed file: protocol. See #​10433.

• Workspace dependencies declared with a relative path (e.g. "foo": "workspace:../foo") are no longer silently dropped from the workspace projects graph, so --filter selection and the topological order of recursive commands take them into account.

Platinum Sponsors

Gold Sponsors

v11.18.0: pnpm 11.18

Compare Source

Minor Changes

• Fixed an installed optional dependency being left without one of its own required dependencies. When a package reached through optionalDependencies is installable on the current system but one of its regular dependencies is not, a lockfile-based install skipped that dependency and installed the parent anyway, so importing the parent failed with MODULE_NOT_FOUND. The dependency is now installed, and an install-check warning reports the incompatibility. A dependency is still only skipped when every path to it is optional, or when the package that pulls it in was itself skipped #​13286.

• pnpm setup now appends PNPM_HOME and the global bin directory to the GitHub Actions environment files (GITHUB_ENV and GITHUB_PATH), so later steps in the same job can run pnpm add --global and other global commands #​9191.

• Added support for publishConfig.name, which publishes a package under a different name than the one its manifest carries in the workspace. It is for a project whose published name is already taken by a sibling project, which otherwise has to be renamed by a build step just before publishing. Only the published artifact is renamed — dependents, pnpm-lock.yaml, and release tooling keep addressing the project by its manifest name — and the new name reaches the packed manifest, the tarball filename, and everything that addresses the package at the registry: the already-published check of pnpm publish -r, its registry selection, and the release-planning probes of pnpm change status and pnpm version -r #​13345.

• pnpm self-update no longer takes any instruction from the project it is run in:

  • pnpm is fetched through the same trusted registry and auth configuration used when switching pnpm versions, so a project .npmrc or pnpm-workspace.yaml can no longer redirect the download or attach credentials to it, and the project's default .pnpmfile.(c|m)js is no longer loaded. Pnpmfiles from trusted sources (the pnpmfile setting, the global pnpmfile, config dependencies) still apply.
  • The minimumReleaseAge settings in pnpm-workspace.yaml no longer affect self-update. They still govern the project's own dependencies; for self-update the cooldown now comes from the built-in default, your global config, a PNPM_CONFIG_* environment variable, or a command-line flag. This fixes self-update failing inside a workspace that raises the cutoff while succeeding everywhere else, and stops a repository from either waiving the cooldown or keeping you on an outdated pnpm by raising it.
  • The same applies to the trustPolicy settings and to ci: a project can no longer weaken the trust check that guards the pnpm download, nor re-enable the confirmation prompt that a CI run suppresses.

  When self-update refuses a version that is younger t

✂ Note

PR body was truncated to here.