create-nuxt-base 2.4.0 → 2.5.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/CHANGELOG.md +14 -0
  2. package/nuxt-base-template/.claude/agent-memory/lt-dev-npm-package-maintainer/MEMORY.md +34 -20
  3. package/nuxt-base-template/README.md +11 -11
  4. package/nuxt-base-template/nuxt.config.ts +10 -8
  5. package/nuxt-base-template/openapi-ts.config.ts +2 -10
  6. package/nuxt-base-template/package.json +17 -16
  7. package/nuxt-base-template/pnpm-lock.yaml +1421 -1067
  8. package/package.json +1 -1
package/CHANGELOG.md CHANGED
@@ -2,6 +2,20 @@
2
2
 
3
3
  All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
4
4
 
5
+ ### [2.5.1](https://github.com/lenneTech/nuxt-base-starter/compare/v2.5.0...v2.5.1) (2026-03-16)
6
+
7
+
8
+ ### Bug Fixes
9
+
10
+ * prevent build-time baked API URLs by defaulting to empty strings resolved at runtimeOC ([e577648](https://github.com/lenneTech/nuxt-base-starter/commit/e577648a287e18a76c72564d68bacc277b04a500))
11
+
12
+ ## [2.5.0](https://github.com/lenneTech/nuxt-base-starter/compare/v2.3.1...v2.5.0) (2026-03-16)
13
+
14
+
15
+ ### Features
16
+
17
+ * add production default dockerfile ([e338c93](https://github.com/lenneTech/nuxt-base-starter/commit/e338c9363a348c1a63d40a71301240c8e8478835))
18
+
5
19
  ## [2.4.0](https://github.com/lenneTech/nuxt-base-starter/compare/v2.3.1...v2.4.0) (2026-03-16)
6
20
 
7
21
 
package/nuxt-base-template/.claude/agent-memory/lt-dev-npm-package-maintainer/MEMORY.md CHANGED
@@ -11,6 +11,7 @@
11
11
 
12
12
  - `better-auth`, `@better-auth/passkey`, `tus-js-client` are peer dependencies of `@lenne.tech/nuxt-extensions` - keep in `dependencies`
13
13
  - `@nuxt/ui` and `@vueuse/nuxt` belong in `dependencies` (used in app/ source files with type imports)
14
+ - `@hey-api/client-fetch`: deprecated, moved to devDependencies (only used in openapi-ts.config.ts codegen config)
14
15
  - pnpm sometimes auto-moves packages to devDependencies during `-D` updates - watch and fix
15
16
 
16
17
  ## Security Overrides
@@ -22,38 +23,51 @@
22
23
 
23
24
  ## Deprecated Package Notes
24
25
 
25
- - `@hey-api/client-fetch`: deprecated ("bundled in @hey-api/openapi-ts since v0.73.0") but still a valid runtime HTTP client for generated API SDKs - KEEP in dependencies
26
- - `openapi-ts.config.ts` uses deprecated `lint`/`format` options; use `postProcess: ['eslint', 'prettier']` instead
26
+ - `@hey-api/client-fetch`: deprecated ("bundled in @hey-api/openapi-ts since v0.73.0"), moved to devDependencies (codegen config only, no runtime use)
27
+ - `openapi-ts.config.ts`: migrated from deprecated `lint`/`format` options to `postProcess: ['oxlint', 'oxfmt']`
27
28
  - `@nuxtjs/color-mode`: do NOT add to devDeps - @nuxt/ui brings its own 3.x internally; 4.0.0 would conflict
28
29
 
29
- ## Override Cleanup Notes (2026-03-09)
30
+ ## Override Cleanup Notes (2026-03-16)
30
31
 
31
32
  Removed as no longer needed:
32
33
 
33
- - `devalue@<=5.6.2` - nuxt requires ^5.6.2, latest is 5.6.3 (always picked)
34
- - `fast-xml-parser@>=5.0.0 <5.3.8` - @nuxtjs/sitemap requires ^5.3.3, latest is 5.4.2 (always safe)
35
- - `markdown-it@>=13.0.0 <14.1.1` - prosemirror-markdown requires ^14.0.0, latest is 14.1.1 (always picked)
36
- - `minimatch@>=5.0.0 <5.1.8` - readdir-glob installs minimatch 5.1.9 which is already >=5.1.8 (safe)
34
+ - `svgo@=4.0.0` - postcss-svgo now requires ^4.0.1, so 4.0.0 is never picked
35
+ - `devalue@<=5.6.2` (old) - replaced with `devalue@<=5.6.3` to cover new vulnerability in 5.6.3
36
+
37
+ Updated overrides:
38
+
39
+ - `hono@<4.12.4` → `hono@<4.12.7` - new vulnerability discovered in <4.12.7
40
+ - `tar@<=7.5.9` → `tar@<=7.5.10` - new vulnerability discovered in 7.5.10
41
+ - Added `devalue@<=5.6.3` - new vulnerability in devalue <=5.6.3 (proto pollution)
42
+ - Added `unhead@<=2.1.10` - new vulnerability in unhead <=2.1.10
37
43
 
38
44
  Still required (keep these overrides):
39
45
 
40
46
  - `@hono/node-server@<1.19.10` - @prisma/dev requires 1.19.9 exactly
41
- - `hono@<4.12.4` - @prisma/dev requires 4.11.4 exactly
47
+ - `devalue@<=5.6.3` - nuxt requires ^5.6.3 which picks vulnerable 5.6.3; 5.6.4 is safe
48
+ - `hono@<4.12.7` - @prisma/dev requires 4.11.4 exactly (new vuln <4.12.7)
42
49
  - `lodash@>=4.0.0 <=4.17.22` - @chevrotain/gast requires 4.17.21 exactly (vulnerable)
43
50
  - `minimatch@>=9.0.0 <9.0.7` - editorconfig 1.0.4 requires 9.0.1 exactly (in vulnerable range)
44
- - `rollup@>=4.0.0 <4.59.0` - vite requires ^4.43.0 which could pick <4.59.0
45
- - `serialize-javascript@<=7.0.2` - @rollup/plugin-terser requires ^6.0.1 (6.x is vulnerable)
46
- - `svgo@=4.0.0` - postcss-svgo requires ^4.0.0 which could pick 4.0.0 (vulnerable)
47
- - `tar@<=7.5.9` - @mapbox/node-pre-gyp requires ^7.4.0 (7.4.x is vulnerable)
51
+ - `rollup@>=4.0.0 <4.59.0` - vite requires range that could pick <4.59.0
52
+ - `serialize-javascript@<=7.0.2` - nitropack uses @rollup/plugin-terser@0.4.4 which requires ^6.0.1 (6.x is vulnerable)
53
+ - `tar@<=7.5.10` - @mapbox/node-pre-gyp requires ^7.4.0 (7.4.x-7.5.10 are vulnerable)
54
+ - `unhead@<=2.1.10` - @nuxt/ui/@nuxtjs/seo use @unhead/vue which pulls vulnerable unhead
48
55
 
49
- ## Version History (2026-03-09)
56
+ ## Version History (2026-03-16)
50
57
 
51
58
  After maintenance, all packages at latest:
52
59
 
53
- - `@lenne.tech/nuxt-extensions`: 1.3.0
54
- - `nuxt`: 4.3.1
55
- - `vitest`: 4.0.18 (major from 3.x)
56
- - `@nuxt/test-utils`: 4.0.0 (major from 3.x, requires vitest ^4.0.2)
57
- - `vitest` v4 + `@nuxt/test-utils` v4 must be updated together (compatibility requirement)
58
- - Residual vulnerabilities: 1 moderate (nanotar, unfixable)
59
- - Removed: `@nuxtjs/color-mode` from devDeps (unused, conflicts with @nuxt/ui's internal 3.5.2)
60
+ - `@better-auth/passkey`: 1.5.5 (from 1.5.4)
61
+ - `better-auth`: 1.5.5 (from 1.5.4)
62
+ - `@lenne.tech/nuxt-extensions`: 1.5.0
63
+ - `@iconify-json/lucide`: 1.2.98 (from 1.2.96)
64
+ - `@vitejs/plugin-vue`: 6.0.5 (from 6.0.4)
65
+ - `happy-dom`: 20.8.4 (from 20.8.3)
66
+ - `@types/node`: 25.5.0 (from 25.4.0)
67
+ - `lint-staged`: 16.4.0 (from 16.3.2)
68
+ - `nuxt`: 4.4.2 (from 4.3.1)
69
+ - `vitest`: 4.1.0 (from 4.0.18)
70
+ - `@hey-api/openapi-ts`: 0.94.2 (from 0.94.0)
71
+ - `jsdom`: 29.0.0 (from 28.1.0) - fixes undici vulnerabilities (jsdom 29 requires undici ^7.24.3)
72
+ - Residual vulnerabilities: 0
73
+ - `@hey-api/client-fetch`: moved from dependencies → devDependencies
package/nuxt-base-template/README.md CHANGED
@@ -91,17 +91,17 @@ npm run generate-types
91
91
 
92
92
  ## Tech Stack
93
93
 
94
- | Technology | Version | Description |
95
- | --------------------- | ------- | -------------------------------- |
96
- | Nuxt | 4.2.x | Vue 3 meta-framework with SSR |
97
- | TypeScript | 5.9.x | Strict type checking |
98
- | Tailwind CSS | 4.1.x | Utility-first CSS (Vite plugin) |
99
- | NuxtUI | 4.3.x | Component library with dark mode |
100
- | Pinia | 0.11.x | State management |
101
- | Better Auth | 1.4.x | Authentication framework |
102
- | Playwright | 1.57.x | E2E testing |
103
- | @hey-api/client-fetch | 0.13.x | Type-safe API client |
104
- | Valibot | 1.2.x | Schema validation |
94
+ | Technology | Version | Description |
95
+ | ------------------- | ------- | -------------------------------- |
96
+ | Nuxt | 4.4.x | Vue 3 meta-framework with SSR |
97
+ | TypeScript | 5.9.x | Strict type checking |
98
+ | Tailwind CSS | 4.1.x | Utility-first CSS (Vite plugin) |
99
+ | NuxtUI | 4.3.x | Component library with dark mode |
100
+ | Pinia | 0.11.x | State management |
101
+ | Better Auth | 1.5.x | Authentication framework |
102
+ | Playwright | 1.57.x | E2E testing |
103
+ | @hey-api/openapi-ts | 0.94.x | API client code generation (dev) |
104
+ | Valibot | 1.2.x | Schema validation |
105
105
 
106
106
  ## Key Features
107
107
 
package/nuxt-base-template/nuxt.config.ts CHANGED
@@ -85,10 +85,10 @@ export default defineNuxtConfig({
85
85
  ltExtensions: {
86
86
  auth: {
87
87
  enabled: true,
88
- // baseURL is used when NUXT_PUBLIC_API_PROXY is NOT enabled (deployed stages)
89
- // With proxy: requests go through /api/iam (proxy strips /api/ and forwards to backend)
90
- // Without proxy: requests go directly to baseURL + basePath (e.g., https://api.example.com/iam)
91
- baseURL: process.env.NUXT_API_URL || 'http://localhost:3000',
88
+ // baseURL: resolved at runtime via NUXT_PUBLIC_API_URL (not baked at build time)
89
+ // Local dev: .env provides http://localhost:3000
90
+ // Production: deployment env provides the production API URL
91
+ baseURL: '',
92
92
  basePath: '/iam',
93
93
  loginPath: '/auth/login',
94
94
  twoFactorRedirectPath: '/auth/2fa',
@@ -154,11 +154,13 @@ export default defineNuxtConfig({
154
154
  // Runtime Configuration (Environment Variables)
155
155
  // ============================================================================
156
156
  runtimeConfig: {
157
- // Server-only — NUXT_API_URL overrides this
158
- apiUrl: 'http://localhost:3000',
157
+ // Server-only — NUXT_API_URL overrides at runtime
158
+ // Local dev: .env provides http://localhost:3000
159
+ apiUrl: '',
159
160
  public: {
160
- // Client-side — NUXT_PUBLIC_API_URL overrides this
161
- apiUrl: 'http://localhost:3000',
161
+ // Client-side — NUXT_PUBLIC_API_URL overrides at runtime
162
+ // Local dev: .env provides http://localhost:3000
163
+ apiUrl: '',
162
164
  // NUXT_PUBLIC_WEB_PUSH_KEY overrides this
163
165
  webPushKey: '',
164
166
  // API Proxy: Routes client-side /api/* requests through the Vite dev proxy
package/nuxt-base-template/openapi-ts.config.ts CHANGED
@@ -1,18 +1,10 @@
1
1
  import { defineConfig } from '@hey-api/openapi-ts';
2
2
 
3
3
  export default defineConfig({
4
- client: '@hey-api/client-fetch',
5
4
  input: process.env.NUXT_API_URL || 'http://127.0.0.1:3000/api-docs-json',
6
5
  output: {
7
- format: 'prettier',
8
- lint: 'eslint',
9
6
  path: './app/api-client',
7
+ postProcess: ['oxlint', 'oxfmt'],
10
8
  },
11
- plugins: [
12
- '@hey-api/sdk',
13
- {
14
- dates: true,
15
- name: '@hey-api/typescript',
16
- },
17
- ],
9
+ plugins: ['@hey-api/client-fetch', '@hey-api/sdk', '@hey-api/typescript', '@hey-api/transformers'],
18
10
  });
package/nuxt-base-template/package.json CHANGED
@@ -48,22 +48,22 @@
48
48
  "fix": "pnpm run lint:fix && pnpm run format"
49
49
  },
50
50
  "dependencies": {
51
- "@better-auth/passkey": "1.5.4",
52
- "@hey-api/client-fetch": "0.13.1",
51
+ "@better-auth/passkey": "1.5.5",
53
52
  "@lenne.tech/bug.lt": "latest",
54
- "@lenne.tech/nuxt-extensions": "1.3.0",
53
+ "@lenne.tech/nuxt-extensions": "1.5.1",
55
54
  "@nuxt/image": "2.0.0",
56
55
  "@nuxt/ui": "4.5.1",
57
56
  "@pinia/nuxt": "0.11.3",
58
57
  "@vueuse/nuxt": "14.2.1",
59
- "better-auth": "1.5.4",
58
+ "better-auth": "1.5.5",
60
59
  "qrcode": "1.5.4",
61
60
  "tus-js-client": "4.3.1",
62
61
  "valibot": "1.2.0"
63
62
  },
64
63
  "devDependencies": {
65
- "@hey-api/openapi-ts": "0.94.0",
66
- "@iconify-json/lucide": "1.2.96",
64
+ "@hey-api/client-fetch": "0.13.1",
65
+ "@hey-api/openapi-ts": "0.94.2",
66
+ "@iconify-json/lucide": "1.2.98",
67
67
  "@nuxt/devtools": "3.2.3",
68
68
  "@nuxt/test-utils": "4.0.0",
69
69
  "@nuxtjs/plausible": "3.0.2",
@@ -71,23 +71,23 @@
71
71
  "@playwright/test": "1.58.2",
72
72
  "@tailwindcss/typography": "0.5.19",
73
73
  "@tailwindcss/vite": "4.2.1",
74
- "@types/node": "25.4.0",
74
+ "@types/node": "25.5.0",
75
75
  "@types/qrcode": "1.5.6",
76
- "@vitejs/plugin-vue": "6.0.4",
76
+ "@vitejs/plugin-vue": "6.0.5",
77
77
  "@vue/test-utils": "2.4.6",
78
78
  "dayjs-nuxt": "2.1.11",
79
- "happy-dom": "20.8.3",
80
- "jsdom": "28.1.0",
81
- "lint-staged": "16.3.2",
79
+ "happy-dom": "20.8.4",
80
+ "jsdom": "29.0.0",
81
+ "lint-staged": "16.4.0",
82
82
  "mongodb": "7.1.0",
83
- "nuxt": "4.3.1",
83
+ "nuxt": "4.4.2",
84
84
  "oxfmt": "latest",
85
85
  "oxlint": "latest",
86
86
  "rimraf": "6.1.3",
87
87
  "simple-git-hooks": "2.13.1",
88
88
  "tailwindcss": "4.2.1",
89
89
  "typescript": "5.9.3",
90
- "vitest": "4.0.18"
90
+ "vitest": "4.1.0"
91
91
  },
92
92
  "simple-git-hooks": {
93
93
  "pre-commit": "npx lint-staged",
@@ -116,13 +116,14 @@
116
116
  ],
117
117
  "overrides": {
118
118
  "@hono/node-server@<1.19.10": ">=1.19.10",
119
- "hono@<4.12.4": ">=4.12.4",
119
+ "devalue@<=5.6.3": ">=5.6.4",
120
+ "hono@<4.12.7": ">=4.12.7",
120
121
  "lodash@>=4.0.0 <=4.17.22": ">=4.17.23",
121
122
  "minimatch@>=9.0.0 <9.0.7": ">=9.0.7",
122
123
  "rollup@>=4.0.0 <4.59.0": ">=4.59.0",
123
124
  "serialize-javascript@<=7.0.2": ">=7.0.3",
124
- "svgo@=4.0.0": ">=4.0.1",
125
- "tar@<=7.5.9": ">=7.5.10"
125
+ "tar@<=7.5.10": ">=7.5.11",
126
+ "unhead@<=2.1.10": ">=2.1.11"
126
127
  }
127
128
  }
128
129
  }