create-nuxt-base 2.6.2 → 2.6.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.oxfmtrc.jsonc +4 -0
- package/CHANGELOG.md +5 -2
- package/nuxt-base-template/.claude/agent-memory/lt-dev-npm-package-maintainer/MEMORY.md +1 -1
- package/nuxt-base-template/.claude/agent-memory/lt-dev-security-reviewer/MEMORY.md +1 -1
- package/nuxt-base-template/.claude/agent-memory/lt-dev-security-reviewer/project_dep_maintenance.md +1 -1
- package/nuxt-base-template/.editorconfig +18 -0
- package/nuxt-base-template/CLAUDE.md +2 -1
- package/nuxt-base-template/README.md +1 -1
- package/nuxt-base-template/package.json +9 -9
- package/nuxt-base-template/pnpm-lock.yaml +448 -389
- package/nuxt-base-template/scripts/check-server-start.sh +36 -21
- package/package.json +1 -1
package/.oxfmtrc.jsonc
CHANGED
|
@@ -4,4 +4,8 @@
|
|
|
4
4
|
"printWidth": 180,
|
|
5
5
|
"semi": true,
|
|
6
6
|
"singleQuote": true,
|
|
7
|
+
// nuxt-base-template has its own .editorconfig with `[*.md] insert_final_newline = false`
|
|
8
|
+
// which doesn't propagate up when oxfmt runs from the starter root. Skip it here;
|
|
9
|
+
// the sub-project has its own `pnpm run format:check`.
|
|
10
|
+
"ignorePatterns": ["node_modules", "dist", "nuxt-base-template"],
|
|
7
11
|
}
|
package/CHANGELOG.md
CHANGED
|
@@ -2,12 +2,15 @@
|
|
|
2
2
|
|
|
3
3
|
All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
|
|
4
4
|
|
|
5
|
-
### [2.6.
|
|
5
|
+
### [2.6.4](https://github.com/lenneTech/nuxt-base-starter/compare/v2.6.3...v2.6.4) (2026-04-23)
|
|
6
|
+
|
|
7
|
+
### [2.6.3](https://github.com/lenneTech/nuxt-base-starter/compare/v2.6.2...v2.6.3) (2026-04-18)
|
|
6
8
|
|
|
9
|
+
### [2.6.2](https://github.com/lenneTech/nuxt-base-starter/compare/v2.6.1...v2.6.2) (2026-04-17)
|
|
7
10
|
|
|
8
11
|
### Bug Fixes
|
|
9
12
|
|
|
10
|
-
|
|
13
|
+
- **deps:** sync pnpm-lock.yaml with pinned overrides ([26cf45d](https://github.com/lenneTech/nuxt-base-starter/commit/26cf45dad735f2ab9ba4f2e9f0870e3cc04c67e7))
|
|
11
14
|
|
|
12
15
|
### [2.6.1](https://github.com/lenneTech/nuxt-base-starter/compare/v2.6.0...v2.6.1) (2026-04-17)
|
|
13
16
|
|
|
@@ -70,4 +70,4 @@ After maintenance, all packages at latest:
|
|
|
70
70
|
- `@hey-api/openapi-ts`: 0.94.2 (from 0.94.0)
|
|
71
71
|
- `jsdom`: 29.0.0 (from 28.1.0) - fixes undici vulnerabilities (jsdom 29 requires undici ^7.24.3)
|
|
72
72
|
- Residual vulnerabilities: 0
|
|
73
|
-
- `@hey-api/client-fetch`: moved from dependencies → devDependencies
|
|
73
|
+
- `@hey-api/client-fetch`: moved from dependencies → devDependencies
|
|
@@ -1,3 +1,3 @@
|
|
|
1
1
|
# Security Reviewer Memory Index
|
|
2
2
|
|
|
3
|
-
- [Dependency Maintenance Pattern](project_dep_maintenance.md) — pnpm overrides use open upper bounds (>=) by convention; h3-next is intentionally aliased to RC pre-release
|
|
3
|
+
- [Dependency Maintenance Pattern](project_dep_maintenance.md) — pnpm overrides use open upper bounds (>=) by convention; h3-next is intentionally aliased to RC pre-release
|
package/nuxt-base-template/.claude/agent-memory/lt-dev-security-reviewer/project_dep_maintenance.md
CHANGED
|
@@ -10,4 +10,4 @@ The `h3-next` alias is pinned to `npm:h3@2.0.1-rc.20` because the Nuxt/Nitro eco
|
|
|
10
10
|
|
|
11
11
|
**Why:** Reviewed during 2026-04-04 dependency maintenance update (PR: TypeScript 5.9→6.0, @nuxtjs/seo 3.4→5.1, 14 overrides added/updated).
|
|
12
12
|
|
|
13
|
-
**How to apply:** Do not flag open-upper-bound `>=` override targets as findings unless they allow a known-malicious version. Flag only if the lower bound is incorrect (allows still-vulnerable versions) or the target package name is suspicious.
|
|
13
|
+
**How to apply:** Do not flag open-upper-bound `>=` override targets as findings unless they allow a known-malicious version. Flag only if the lower bound is incorrect (allows still-vulnerable versions) or the target package name is suspicious.
|
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
# EditorConfig is awesome: https://EditorConfig.org
|
|
2
|
+
|
|
3
|
+
# top-most EditorConfig file
|
|
4
|
+
root = true
|
|
5
|
+
|
|
6
|
+
# all files
|
|
7
|
+
[*]
|
|
8
|
+
charset = utf-8
|
|
9
|
+
indent_style = space
|
|
10
|
+
indent_size = 2
|
|
11
|
+
end_of_line = lf
|
|
12
|
+
insert_final_newline = true
|
|
13
|
+
trim_trailing_whitespace = true
|
|
14
|
+
|
|
15
|
+
# Markdown files
|
|
16
|
+
[*.md]
|
|
17
|
+
insert_final_newline = false
|
|
18
|
+
trim_trailing_whitespace = false
|
|
@@ -146,6 +146,7 @@ All override targets use fixed versions (not ranges) to prevent silent major-ver
|
|
|
146
146
|
| `defu@<=6.1.4` | GHSA-mchp-fgcf-hmfj | Prototype pollution |
|
|
147
147
|
| `devalue@<=5.6.3` | GHSA-77p6-w3v8-rqwf | XSS via crafted input |
|
|
148
148
|
| `effect@<3.20.0` | GHSA-j44v-mmf2-xvm9 | Denial of service |
|
|
149
|
+
| `fast-xml-parser@<5.7.0` | GHSA-gh4j-gqv2-49f6 | XMLBuilder: XML comment and CDATA injection via unescaped delimiters; transitive via @nuxtjs/seo>sitemap |
|
|
149
150
|
| `h3@<1.15.9` | GHSA-wr4h-v87w-p3r7 | Path traversal |
|
|
150
151
|
| `h3@>=2.0.0-0 <2.0.1-rc.18` | GHSA-q5pr-72pq-83v3 | Cookie DoS + SSE injection |
|
|
151
152
|
| `h3-next` | (alias fix) | `@nuxt/test-utils` pins h3-next to vulnerable RC; remove when h3 v2 stable releases |
|
|
@@ -169,4 +170,4 @@ The `ignoredOptionalDependencies` block suppresses 30 platform-specific native b
|
|
|
169
170
|
## Notable Version Changes (v2.5.x)
|
|
170
171
|
|
|
171
172
|
- **TypeScript 5.9 -> 6.0:** Changes `erasableSyntaxOnly` default and tightens module resolution. Run `pnpm run build` to verify no type regressions after upgrading existing projects.
|
|
172
|
-
- **@nuxtjs/seo 3.4 -> 5.1:** Major rewrite (v4 was skipped). The OG image engine switched to `@shikijs/*` for syntax highlighting (SSR/build-time only). `nuxt.config.ts` SEO options are backwards-compatible. The 30 `ignoredOptionalDependencies` entries are required for clean installs.
|
|
173
|
+
- **@nuxtjs/seo 3.4 -> 5.1:** Major rewrite (v4 was skipped). The OG image engine switched to `@shikijs/*` for syntax highlighting (SSR/build-time only). `nuxt.config.ts` SEO options are backwards-compatible. The 30 `ignoredOptionalDependencies` entries are required for clean installs.
|
|
@@ -202,4 +202,4 @@ tests/ # Playwright E2E tests
|
|
|
202
202
|
- [NuxtUI Documentation](https://ui.nuxt.com)
|
|
203
203
|
- [Better Auth Documentation](https://www.better-auth.com)
|
|
204
204
|
- [Tailwind CSS Documentation](https://tailwindcss.com/docs)
|
|
205
|
-
- [Vue 3 Documentation](https://vuejs.org)
|
|
205
|
+
- [Vue 3 Documentation](https://vuejs.org)
|
|
@@ -48,20 +48,20 @@
|
|
|
48
48
|
"fix": "pnpm run lint:fix && pnpm run format"
|
|
49
49
|
},
|
|
50
50
|
"dependencies": {
|
|
51
|
-
"@better-auth/passkey": "1.6.
|
|
51
|
+
"@better-auth/passkey": "1.6.7",
|
|
52
52
|
"@lenne.tech/bug.lt": "latest",
|
|
53
|
-
"@lenne.tech/nuxt-extensions": "1.5.
|
|
53
|
+
"@lenne.tech/nuxt-extensions": "1.5.4",
|
|
54
54
|
"@nuxt/image": "2.0.0",
|
|
55
55
|
"@nuxt/ui": "4.6.1",
|
|
56
56
|
"@pinia/nuxt": "0.11.3",
|
|
57
57
|
"@vueuse/nuxt": "14.2.1",
|
|
58
|
-
"better-auth": "1.6.
|
|
58
|
+
"better-auth": "1.6.7",
|
|
59
59
|
"qrcode": "1.5.4",
|
|
60
60
|
"tus-js-client": "4.3.1",
|
|
61
61
|
"valibot": "1.3.1"
|
|
62
62
|
},
|
|
63
63
|
"devDependencies": {
|
|
64
|
-
"@hey-api/openapi-ts": "0.96.
|
|
64
|
+
"@hey-api/openapi-ts": "0.96.1",
|
|
65
65
|
"@iconify-json/lucide": "1.2.102",
|
|
66
66
|
"@nuxt/devtools": "3.2.4",
|
|
67
67
|
"@nuxt/test-utils": "4.0.2",
|
|
@@ -69,24 +69,23 @@
|
|
|
69
69
|
"@nuxtjs/seo": "5.1.3",
|
|
70
70
|
"@playwright/test": "1.59.1",
|
|
71
71
|
"@tailwindcss/typography": "0.5.19",
|
|
72
|
-
"@tailwindcss/vite": "4.2.
|
|
72
|
+
"@tailwindcss/vite": "4.2.4",
|
|
73
73
|
"@types/node": "25.6.0",
|
|
74
74
|
"@types/qrcode": "1.5.6",
|
|
75
75
|
"@vitejs/plugin-vue": "6.0.6",
|
|
76
76
|
"@vue/test-utils": "2.4.6",
|
|
77
77
|
"dayjs-nuxt": "2.1.11",
|
|
78
78
|
"happy-dom": "20.9.0",
|
|
79
|
-
"jsdom": "29.0.2",
|
|
80
79
|
"lint-staged": "16.4.0",
|
|
81
|
-
"mongodb": "7.
|
|
80
|
+
"mongodb": "7.2.0",
|
|
82
81
|
"nuxt": "4.4.2",
|
|
83
82
|
"oxfmt": "latest",
|
|
84
83
|
"oxlint": "latest",
|
|
85
84
|
"rimraf": "6.1.3",
|
|
86
85
|
"simple-git-hooks": "2.13.1",
|
|
87
|
-
"tailwindcss": "4.2.
|
|
86
|
+
"tailwindcss": "4.2.4",
|
|
88
87
|
"typescript": "6.0.3",
|
|
89
|
-
"vitest": "4.1.
|
|
88
|
+
"vitest": "4.1.5"
|
|
90
89
|
},
|
|
91
90
|
"simple-git-hooks": {
|
|
92
91
|
"pre-commit": "npx lint-staged",
|
|
@@ -154,6 +153,7 @@
|
|
|
154
153
|
"defu@<=6.1.4": "6.1.7",
|
|
155
154
|
"devalue@<=5.6.3": "5.7.1",
|
|
156
155
|
"effect@<3.20.0": "3.21.0",
|
|
156
|
+
"fast-xml-parser@<5.7.0": "5.7.1",
|
|
157
157
|
"h3@<1.15.9": "1.15.11",
|
|
158
158
|
"h3@>=2.0.0-0 <2.0.1-rc.18": "2.0.1-rc.20",
|
|
159
159
|
"h3-next": "npm:h3@2.0.1-rc.20",
|