@nuxt/nitro-server 3.21.1 → 3.21.2

package/dist/index.mjs

@@ -19,16 +19,23 @@ import { isWindows } from "std-env";
 import { ImpoundPlugin } from "impound";
 import { resolveModulePath } from "exsolve";
 import { runtimeDependencies } from "nitropack/runtime/meta";
-var version = "3.21.1";
+//#region package.json
+var version = "3.21.2";
+//#endregion
+//#region src/utils.ts
 function toArray(value) {
 	return Array.isArray(value) ? value : [value];
 }
 let _distDir = dirname(fileURLToPath(import.meta.url));
 if (/(?:chunks|shared)$/.test(_distDir)) _distDir = dirname(_distDir);
 const distDir = _distDir;
+//#endregion
+//#region ../ui-templates/dist/templates/spa-loading-icon.ts
 const template = () => {
 	return "<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"80\" fill=\"none\" class=\"nuxt-spa-loading\" viewBox=\"0 0 37 25\"><path d=\"M24.236 22.006h10.742L25.563 5.822l-8.979 14.31a4 4 0 0 1-3.388 1.874H2.978l11.631-20 5.897 10.567\"/></svg><style>.nuxt-spa-loading{left:50%;position:fixed;top:50%;transform:translate(-50%,-50%)}.nuxt-spa-loading>path{animation:nuxt-spa-loading-move 3s linear infinite;fill:none;stroke:#00dc82;stroke-dasharray:128;stroke-dashoffset:128;stroke-linecap:round;stroke-linejoin:round;stroke-width:4px}@keyframes nuxt-spa-loading-move{to{stroke-dashoffset:-128}}</style>";
 };
+//#endregion
+//#region ../nuxt/src/core/plugins/import-protection.ts
 function createImportProtectionPatterns(nuxt, options) {
 	const patterns = [];
 	const context = contextFlags[options.context];
@@ -54,6 +61,8 @@ const contextFlags = {
 	"nuxt-app": "the Vue part of your app",
 	"shared": "the #shared directory"
 };
+//#endregion
+//#region src/templates.ts
 const nitroSchemaTemplate = {
 	filename: "types/nitro-nuxt.d.ts",
 	async getContents({ nuxt }) {
@@ -105,6 +114,8 @@ declare module 'nitropack' {
 function renderReference(ref, baseDir) {
 	return `/// <reference ${"path" in ref ? `path="${isAbsolute(ref.path) ? relative(baseDir, ref.path) : ref.path}"` : `types="${ref.types}"`} />`;
 }
+//#endregion
+//#region src/index.ts
 const logLevelMapReverse = {
 	silent: 0,
 	info: 3,
@@ -351,7 +362,8 @@ async function bundle(nuxt) {
 		"appLayout",
 		"cache",
 		"isr",
-		"swr"
+		"swr",
+		"ssr"
 	];
 	function getRouteRulesRouter() {
 		const routeRulesRouter = createRouter();
@@ -412,6 +424,7 @@ async function bundle(nuxt) {
 		nuxt.hook("nitro:init", (nitro) => {
 			nitro.hooks.hook("build:before", (nitro) => {
 				for (const [route, value] of Object.entries(nitro.options.routeRules)) if (!route.endsWith("*") && !route.endsWith("/_payload.json")) {
+					if (value.ssr === false) continue;
 					if (value.isr || value.cache || value.prerender && nuxt.options.dev) {
 						const payloadKey = route + "/_payload.json";
 						const defaults = {};
@@ -598,6 +611,22 @@ async function bundle(nuxt) {
 	await nuxt.callHook("nitro:init", nitro);
 	nuxt["~runtimeDependencies"] ||= [];
 	nuxt["~runtimeDependencies"].push(...runtimeDependencies, "unhead", "@unhead/vue", "@nuxt/devalue", "unstorage", ...nitro.options.inlineDynamicImports ? ["vue", "@vue/server-renderer"] : []);
+	addVitePlugin({
+		name: "nuxt:nitro:ssr-conditions",
+		configEnvironment(name, config) {
+			if (name === "ssr") {
+				config.resolve ||= {};
+				config.resolve.conditions = [...nitro.options.exportConditions || [], "import"];
+			}
+		}
+	});
+	addVitePlugin({
+		name: "nuxt:nitro:vue-feature-flags",
+		applyToEnvironment: (environment) => environment.name === "ssr" && environment.config.isProduction,
+		configResolved(config) {
+			for (const key in config.define) if (key.startsWith("__VUE")) nitro.options.replace[key] = config.define[key];
+		}
+	});
 	nitro.vfs = nuxt.vfs = nitro.vfs || nuxt.vfs || {};
 	nuxt.hook("close", () => nitro.hooks.callHook("close"));
 	nitro.hooks.hook("prerender:routes", (routes) => {
@@ -733,4 +762,5 @@ async function spaLoadingTemplate(nuxt) {
 	if (nuxt.options.spaLoadingTemplate) logger.warn(`Could not load custom \`spaLoadingTemplate\` path as it does not exist: \`${nuxt.options.spaLoadingTemplate}\`.`);
 	return "";
 }
+//#endregion
 export { bundle };

package/dist/runtime/handlers/island.d.mts

@@ -1,2 +1,3 @@
-declare const _default;
-export default _default;
+import type { EventHandler } from "h3";
+declare const handler: EventHandler;
+export default handler;

package/dist/runtime/handlers/island.mjs

@@ -1,5 +1,5 @@
 import { destr } from "destr";
-import { defineEventHandler, getQuery, readBody, setResponseHeaders } from "h3";
+import { createError, defineEventHandler, getQuery, readBody, setResponseHeaders } from "h3";
 import { resolveUnrefHeadInput } from "@unhead/vue";
 import { getRequestDependencies } from "vue-bundle-renderer/runtime";
 import { getQuery as getURLQuery } from "ufo";
@@ -10,7 +10,7 @@ import { getSSRRenderer } from "../utils/renderer/build-files.mjs";
 import { renderInlineStyles } from "../utils/renderer/inline-styles.mjs";
 import { getClientIslandResponse, getServerComponentHTML, getSlotIslandResponse } from "../utils/renderer/islands.mjs";
 const ISLAND_SUFFIX_RE = /\.json(?:\?.*)?$/;
-export default defineEventHandler(async (event) => {
+const handler = defineEventHandler(async (event) => {
 	const nitroApp = useNitroApp();
 	setResponseHeaders(event, {
 		"content-type": "application/json;charset=utf-8",
@@ -98,26 +98,38 @@ export default defineEventHandler(async (event) => {
 	}
 	return islandResponse;
 });
+export default handler;
+const ISLAND_PATH_PREFIX = "/__nuxt_island/";
+const VALID_COMPONENT_NAME_RE = /^[a-z][\w.-]*$/i;
 async function getIslandContext(event) {
-	// TODO: Strict validation for url
 	let url = event.path || "";
 	if (import.meta.prerender && event.path && await islandPropCache.hasItem(event.path)) {
 		// rehydrate props from cache so we can rerender island if cache does not have it any more
 		url = await islandPropCache.getItem(event.path);
 	}
-	const componentParts = url.substring("/__nuxt_island".length + 1).replace(ISLAND_SUFFIX_RE, "").split("_");
+	if (!url.startsWith(ISLAND_PATH_PREFIX)) {
+		throw createError({
+			statusCode: 400,
+			statusMessage: "Invalid island request path"
+		});
+	}
+	const componentParts = url.substring(ISLAND_PATH_PREFIX.length).replace(ISLAND_SUFFIX_RE, "").split("_");
 	const hashId = componentParts.length > 1 ? componentParts.pop() : undefined;
 	const componentName = componentParts.join("_");
-	// TODO: Validate context
+	if (!componentName || !VALID_COMPONENT_NAME_RE.test(componentName)) {
+		throw createError({
+			statusCode: 400,
+			statusMessage: "Invalid island component name"
+		});
+	}
 	const context = event.method === "GET" ? getQuery(event) : await readBody(event);
-	const ctx = {
-		url: "/",
-		...context,
+	// Only extract known context fields to prevent arbitrary data injection
+	return {
+		url: typeof context?.url === "string" ? context.url : "/",
 		id: hashId,
 		name: componentName,
 		props: destr(context.props) || {},
 		slots: {},
 		components: {}
 	};
-	return ctx;
 }

package/dist/runtime/handlers/renderer.d.mts

@@ -1,2 +1,3 @@
-declare const _default;
-export default _default;
+import type { EventHandler } from "h3";
+declare const handler: EventHandler;
+export default handler;

package/dist/runtime/handlers/renderer.mjs

@@ -38,7 +38,7 @@ const APP_TELEPORT_CLOSE_TAG = HAS_APP_TELEPORTS ? `</${appTeleportTag}>` : "";
 const PAYLOAD_URL_RE = NUXT_JSON_PAYLOADS ? /^[^?]*\/_payload.json(?:\?.*)?$/ : /^[^?]*\/_payload.js(?:\?.*)?$/;
 const PAYLOAD_FILENAME = NUXT_JSON_PAYLOADS ? "_payload.json" : "_payload.js";
 let entryPath;
-export default defineRenderHandler(async (event) => {
+const handler = defineRenderHandler(async (event) => {
 	const nitroApp = useNitroApp();
 	// Whether we're rendering an error page
 	const ssrError = event.path.startsWith("/__nuxt_error") ? getQuery(event) : null;
@@ -282,6 +282,7 @@ export default defineRenderHandler(async (event) => {
 		}
 	};
 });
+export default handler;
 function normalizeChunks(chunks) {
 	const result = [];
 	for (const _chunk of chunks) {

package/dist/runtime/middleware/no-ssr.d.mts

@@ -1,2 +1,3 @@
-declare const _default;
-export default _default;
+import type { EventHandler } from "h3";
+declare const handler: EventHandler;
+export default handler;

package/dist/runtime/middleware/no-ssr.mjs

@@ -1,7 +1,8 @@
 import { defineEventHandler, getRequestHeader } from "h3";
-export default defineEventHandler((event) => {
+const handler = defineEventHandler((event) => {
 	if (getRequestHeader(event, "x-nuxt-no-ssr")) {
 		event.context.nuxt ||= {};
 		event.context.nuxt.noSSR = true;
 	}
 });
+export default handler;

package/dist/runtime/plugins/dev-server-logs.d.mts

@@ -1,2 +1,3 @@
-declare const _default;
+import type { NitroApp } from "nitropack/runtime/app";
+declare const _default: (nitroApp: NitroApp) => void;
 export default _default;

package/dist/runtime/utils/cache.d.mts

@@ -1,5 +1,11 @@
-export declare const payloadCache: unknown;
-export declare const islandCache: unknown;
-export declare const islandPropCache: unknown;
-export declare const sharedPrerenderPromises: unknown;
-export declare const sharedPrerenderCache: unknown;
+import type { Storage } from "unstorage";
+export declare const payloadCache: Storage | null;
+export declare const islandCache: Storage | null;
+export declare const islandPropCache: Storage | null;
+export declare const sharedPrerenderPromises: Map<string, Promise<any>> | null;
+interface SharedPrerenderCache {
+	get<T = unknown>(key: string): Promise<T> | undefined;
+	set<T>(key: string, value: Promise<T>): Promise<void>;
+}
+export declare const sharedPrerenderCache: SharedPrerenderCache | null;
+export {};

package/dist/runtime/utils/config.d.mts

@@ -1 +1 @@
-export declare const defineAppConfig: unknown;
+export declare const defineAppConfig: (config: any) => any;

package/dist/runtime/utils/dev.mjs

@@ -357,7 +357,7 @@ function webComponentScript(base64HTML, startMinimized) {
     iframe.id = 'frame';
     iframe.src = 'data:text/html;base64,${base64HTML}';
     iframe.title = 'Detailed error stack trace';
-    iframe.setAttribute('sandbox', 'allow-scripts allow-same-origin');
+    iframe.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-top-navigation-by-user-activation');
 
     const preview = el('div');
     preview.id = 'preview';

package/dist/runtime/utils/error.d.mts

@@ -3,4 +3,4 @@ import type { H3Event } from "h3";
 * Nitro internal functions extracted from https://github.com/nitrojs/nitro/blob/v2/src/runtime/internal/utils.ts
 */
 export declare function isJsonRequest(event: H3Event): boolean;
-export declare function hasReqHeader(event: H3Event, name: string, includes: string);
+export declare function hasReqHeader(event: H3Event, name: string, includes: string): boolean;

package/dist/runtime/utils/error.mjs

@@ -11,5 +11,5 @@ export function isJsonRequest(event) {
 }
 export function hasReqHeader(event, name, includes) {
 	const value = getRequestHeader(event, name);
-	return value && typeof value === "string" && value.toLowerCase().includes(includes);
+	return !!(value && typeof value === "string" && value.toLowerCase().includes(includes));
 }

package/dist/runtime/utils/renderer/build-files.d.mts

@@ -10,7 +10,7 @@ interface Renderer {
 		renderScripts: () => string;
 	}>;
 }
-export declare const getSSRRenderer: unknown;
+export declare const getSSRRenderer: () => Promise<Renderer>;
 export declare function getRenderer(ssrContext: NuxtSSRContext): Promise<Renderer>;
-export declare const getSSRStyles: unknown;
+export declare const getSSRStyles: () => Promise<Record<string, () => Promise<string[]>>>;
 export {};

package/dist/runtime/utils/renderer/payload.mjs

@@ -7,7 +7,7 @@ import { appId, multiApp } from "#internal/nuxt.config.mjs";
 import { NUXT_JSON_PAYLOADS, NUXT_NO_SSR, NUXT_PAYLOAD_EXTRACTION, NUXT_RUNTIME_PAYLOAD_EXTRACTION } from "#internal/nuxt/nitro-config.mjs";
 export function renderPayloadResponse(ssrContext) {
 	return {
-		body: NUXT_JSON_PAYLOADS ? stringify(splitPayload(ssrContext).payload, ssrContext["~payloadReducers"]) : `export default ${devalue(splitPayload(ssrContext).payload)}`,
+		body: NUXT_JSON_PAYLOADS ? encodeForwardSlashes(stringify(splitPayload(ssrContext).payload, ssrContext["~payloadReducers"])) : `export default ${devalue(splitPayload(ssrContext).payload)}`,
 		statusCode: getResponseStatus(ssrContext.event),
 		statusMessage: getResponseStatusText(ssrContext.event),
 		headers: {
@@ -17,7 +17,7 @@ export function renderPayloadResponse(ssrContext) {
 	};
 }
 export function renderPayloadJsonScript(opts) {
-	const contents = opts.data ? stringify(opts.data, opts.ssrContext["~payloadReducers"]) : "";
+	const contents = opts.data ? encodeForwardSlashes(stringify(opts.data, opts.ssrContext["~payloadReducers"])) : "";
 	const payload = {
 		"type": "application/json",
 		"innerHTML": contents,
@@ -33,13 +33,30 @@ export function renderPayloadJsonScript(opts) {
 	const config = uneval(opts.ssrContext.config);
 	return [payload, { innerHTML: multiApp ? `window.__NUXT__=window.__NUXT__||{};window.__NUXT__[${JSON.stringify(appId)}]={config:${config}}` : `window.__NUXT__={};window.__NUXT__.config=${config}` }];
 }
+/**
+* Encode forward slashes as unicode escape sequences to prevent
+* Google from treating them as internal links and trying to crawl them.
+* @see https://github.com/nuxt/nuxt/issues/24175
+*/
+function encodeForwardSlashes(str) {
+	return str.replaceAll("/", "\\u002F");
+}
+/**
+* Escape a string for safe interpolation inside a double-quoted JavaScript string literal.
+* Prevents XSS when user-controlled URLs are embedded in inline `<script>` tags.
+*/
+function escapeJsString(str) {
+	return str.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"").replaceAll("\n", "\\n").replaceAll("\r", "\\r").replaceAll("/", "\\u002F").replaceAll("<", "\\u003C");
+}
 export function renderPayloadScript(opts) {
 	opts.data.config = opts.ssrContext.config;
 	const _PAYLOAD_EXTRACTION = !opts.ssrContext.noSSR && (import.meta.prerender && NUXT_PAYLOAD_EXTRACTION || NUXT_RUNTIME_PAYLOAD_EXTRACTION && (opts.routeOptions.isr || opts.routeOptions.cache));
 	const nuxtData = devalue(opts.data);
 	if (_PAYLOAD_EXTRACTION) {
-		const singleAppPayload = `import p from "${opts.src}";window.__NUXT__={...p,...(${nuxtData})}`;
-		const multiAppPayload = `import p from "${opts.src}";window.__NUXT__=window.__NUXT__||{};window.__NUXT__[${JSON.stringify(appId)}]={...p,...(${nuxtData})}`;
+		// Escape the URL to prevent XSS when interpolated into a JS string literal
+		const escapedSrc = escapeJsString(opts.src);
+		const singleAppPayload = `import p from "${escapedSrc}";window.__NUXT__={...p,...(${nuxtData})}`;
+		const multiAppPayload = `import p from "${escapedSrc}";window.__NUXT__=window.__NUXT__||{};window.__NUXT__[${JSON.stringify(appId)}]={...p,...(${nuxtData})}`;
 		return [{
 			type: "module",
 			innerHTML: multiApp ? multiAppPayload : singleAppPayload

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nuxt/nitro-server",
-  "version": "3.21.1",
+  "version": "3.21.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/nuxt/nuxt.git",
@@ -19,41 +19,41 @@
   ],
   "dependencies": {
     "@nuxt/devalue": "^2.0.2",
-    "@unhead/vue": "^2.1.3",
-    "@vue/shared": "^3.5.27",
+    "@unhead/vue": "^2.1.12",
+    "@vue/shared": "^3.5.30",
     "consola": "^3.4.2",
     "defu": "^6.1.4",
     "destr": "^2.0.5",
-    "devalue": "^5.6.2",
+    "devalue": "^5.6.3",
     "errx": "^0.1.0",
     "escape-string-regexp": "^5.0.0",
     "exsolve": "^1.0.8",
-    "h3": "^1.15.5",
-    "impound": "^1.0.0",
+    "h3": "^1.15.6",
+    "impound": "^1.1.5",
     "klona": "^2.0.6",
     "mocked-exports": "^0.1.1",
     "nitropack": "^2.13.1",
     "ohash": "^2.0.11",
     "pathe": "^2.0.3",
     "pkg-types": "^2.3.0",
-    "rou3": "^0.7.12",
-    "std-env": "^3.10.0",
+    "rou3": "^0.8.1",
+    "std-env": "^4.0.0",
     "ufo": "^1.6.3",
     "unctx": "^2.5.0",
     "unstorage": "^1.17.4",
-    "vue": "^3.5.27",
+    "vue": "^3.5.30",
     "vue-bundle-renderer": "^2.2.0",
     "vue-devtools-stub": "^0.1.0",
-    "@nuxt/kit": "3.21.1"
+    "@nuxt/kit": "3.21.2"
   },
   "peerDependencies": {
-    "nuxt": "^3.21.1"
+    "nuxt": "^3.21.2"
   },
   "devDependencies": {
-    "obuild": "0.4.27",
+    "obuild": "0.4.32",
     "vitest": "4.0.18",
-    "nuxt": "3.21.1",
-    "@nuxt/schema": "3.21.1"
+    "@nuxt/schema": "3.21.2",
+    "nuxt": "3.21.2"
   },
   "engines": {
     "node": "^20.19.0 || >=22.12.0"