nuxt-security-module 4.2.0 → 4.3.3

package/dist/runtime/services/updateContentSecurityPolicy.d.ts

@@ -0,0 +1,3 @@
+import { ContentSecurityPolicy } from "../../models/ContentSecurityPolicy.js";
+import { SecurityState } from "./getSecurityState.js";
+export declare const updateContentSecurityPolicy: (policy: ContentSecurityPolicy, { hashes, nonce }: SecurityState) => ContentSecurityPolicy;

package/dist/runtime/services/updateContentSecurityPolicy.js

@@ -0,0 +1,14 @@
+import { NONCE_PLACEHOLDER } from "../constants.js";
+// src/runtime/services/updateContentSecurityPolicy.ts
+const SCRIPT_DIRECTIVES = /* @__PURE__ */ new Set(["script-src", "script-src-elem"]);
+const STYLE_DIRECTIVES = /* @__PURE__ */ new Set(["style-src", "style-src-elem"]);
+const updateContentSecurityPolicy = (policy, { hashes, nonce }) => Object.fromEntries(Object.keys(policy).map((directive) => {
+	const value = policy[directive];
+	if (!Array.isArray(value)) return [directive, value];
+	const sources = value.filter((source) => !checkIsStaticNonce(source)).map((source) => source === "'nonce-{{nonce}}'" && nonce ? `'nonce-${nonce}'` : source).filter((source) => source !== NONCE_PLACEHOLDER);
+	if (SCRIPT_DIRECTIVES.has(directive)) sources.push(...hashes.script);
+	if (STYLE_DIRECTIVES.has(directive)) sources.push(...hashes.style);
+	return [directive, sources];
+}));
+const checkIsStaticNonce = (source) => source.startsWith("'nonce-") && source !== "'nonce-{{nonce}}'";
+export { updateContentSecurityPolicy };

package/dist/schemas/allowedMethodsRestricterOptionsSchema.js

@@ -0,0 +1,4 @@
+import { z } from "zod";
+// src/schemas/allowedMethodsRestricterOptionsSchema.ts
+const allowedMethodsRestricterOptionsSchema = z.strictObject({ methods: z.array(z.string().min(1)).min(1) });
+export { allowedMethodsRestricterOptionsSchema };

package/dist/schemas/basicAuthOptionsSchema.js

@@ -0,0 +1,11 @@
+import { z } from "zod";
+// src/schemas/basicAuthOptionsSchema.ts
+const pathSchema = z.string().startsWith("/");
+const basicAuthOptionsSchema = z.strictObject({
+	exclude: z.array(pathSchema).optional(),
+	include: z.array(pathSchema).optional(),
+	message: z.string().optional(),
+	name: z.string().min(1),
+	pass: z.string().min(1)
+});
+export { basicAuthOptionsSchema };

package/dist/schemas/contentSecurityPolicySchema.js

@@ -0,0 +1,4 @@
+import { z } from "zod";
+// src/schemas/contentSecurityPolicySchema.ts
+const contentSecurityPolicySchema = z.record(z.string().min(1), z.union([z.boolean(), z.array(z.string().min(1))]).optional());
+export { contentSecurityPolicySchema };

package/dist/schemas/corsHandlerOptionsSchema.js

@@ -0,0 +1,13 @@
+import { z } from "zod";
+// src/schemas/corsHandlerOptionsSchema.ts
+const headerNameSchema = z.string().regex(/^[\w-]+$/u);
+const corsHandlerOptionsSchema = z.strictObject({
+	allowHeaders: z.array(headerNameSchema).optional(),
+	credentials: z.boolean().optional(),
+	exposeHeaders: z.array(headerNameSchema).optional(),
+	maxAge: z.string().regex(/^\d+$/u).optional(),
+	methods: z.array(z.string().min(1)).min(1),
+	origin: z.union([z.url(), z.array(z.url())]),
+	preflight: z.strictObject({ statusCode: z.int().min(200).max(299) }).optional()
+});
+export { corsHandlerOptionsSchema };

package/dist/schemas/csrfOptionsSchema.js

@@ -0,0 +1,8 @@
+import { z } from "zod";
+// src/schemas/csrfOptionsSchema.ts
+const tokenNameSchema = z.string().regex(/^[\w-]+$/u, "must be letters, digits, underscores or hyphens");
+const csrfOptionsSchema = z.strictObject({
+	cookieName: tokenNameSchema,
+	headerName: tokenNameSchema
+});
+export { csrfOptionsSchema };

package/dist/schemas/moduleOptionsSchema.js

@@ -0,0 +1,28 @@
+import { allowedMethodsRestricterOptionsSchema } from "./allowedMethodsRestricterOptionsSchema.js";
+import { basicAuthOptionsSchema } from "./basicAuthOptionsSchema.js";
+import { corsHandlerOptionsSchema } from "./corsHandlerOptionsSchema.js";
+import { csrfOptionsSchema } from "./csrfOptionsSchema.js";
+import { rateLimiterOptionsSchema } from "./rateLimiterOptionsSchema.js";
+import { requestSizeLimiterOptionsSchema } from "./requestSizeLimiterOptionsSchema.js";
+import { securityHeadersSchema } from "./securityHeadersSchema.js";
+import { ssgOptionsSchema } from "./ssgOptionsSchema.js";
+import { z } from "zod";
+// src/schemas/moduleOptionsSchema.ts
+const moduleOptionsSchema = z.strictObject({
+	allowedMethodsRestricter: z.union([allowedMethodsRestricterOptionsSchema, z.literal(false)]),
+	basicAuth: z.union([basicAuthOptionsSchema, z.literal(false)]),
+	contentSecurityPolicyReportOnly: z.boolean(),
+	corsHandler: z.union([corsHandlerOptionsSchema, z.literal(false)]),
+	csrf: z.union([csrfOptionsSchema, z.literal(false)]),
+	enabled: z.boolean(),
+	headers: z.union([securityHeadersSchema, z.literal(false)]),
+	hidePoweredBy: z.boolean(),
+	nonce: z.boolean(),
+	rateLimiter: z.union([rateLimiterOptionsSchema, z.literal(false)]),
+	removeLoggers: z.boolean(),
+	requestSizeLimiter: z.union([requestSizeLimiterOptionsSchema, z.literal(false)]),
+	sri: z.boolean(),
+	ssg: z.union([ssgOptionsSchema, z.literal(false)]),
+	strict: z.boolean()
+});
+export { moduleOptionsSchema };

package/dist/schemas/permissionsPolicySchema.js

@@ -0,0 +1,4 @@
+import { z } from "zod";
+// src/schemas/permissionsPolicySchema.ts
+const permissionsPolicySchema = z.record(z.string().min(1), z.union([z.literal(false), z.array(z.string().min(1))]).optional());
+export { permissionsPolicySchema };

package/dist/schemas/rateLimiterOptionsSchema.js

@@ -0,0 +1,7 @@
+import { z } from "zod";
+// src/schemas/rateLimiterOptionsSchema.ts
+const rateLimiterOptionsSchema = z.strictObject({
+	intervalInMilliseconds: z.int("must be a whole number of milliseconds").positive("must be more than zero milliseconds"),
+	tokensPerInterval: z.int("must be a whole number of requests").positive("must allow at least one request")
+});
+export { rateLimiterOptionsSchema };

package/dist/schemas/requestSizeLimiterOptionsSchema.js

@@ -0,0 +1,7 @@
+import { z } from "zod";
+// src/schemas/requestSizeLimiterOptionsSchema.ts
+const requestSizeLimiterOptionsSchema = z.strictObject({
+	maxRequestSizeInBytes: z.int("must be a whole number of bytes").positive("must be more than zero bytes"),
+	maxUploadFileRequestInBytes: z.int("must be a whole number of bytes").positive("must be more than zero bytes")
+});
+export { requestSizeLimiterOptionsSchema };

package/dist/schemas/securityHeadersSchema.js

@@ -0,0 +1,24 @@
+import { CrossOriginEmbedderPolicy } from "../models/CrossOriginEmbedderPolicy.js";
+import { XFrameOptions } from "../models/XFrameOptions.js";
+import { contentSecurityPolicySchema } from "./contentSecurityPolicySchema.js";
+import { permissionsPolicySchema } from "./permissionsPolicySchema.js";
+import { strictTransportSecurityOptionsSchema } from "./strictTransportSecurityOptionsSchema.js";
+import { z } from "zod";
+// src/schemas/securityHeadersSchema.ts
+const headerValueSchema = z.string().min(1);
+const securityHeadersSchema = z.strictObject({
+	contentSecurityPolicy: z.union([contentSecurityPolicySchema, z.literal(false)]).optional(),
+	crossOriginEmbedderPolicy: z.union([z.enum(CrossOriginEmbedderPolicy), z.literal(false)]).optional(),
+	crossOriginOpenerPolicy: z.union([headerValueSchema, z.literal(false)]).optional(),
+	crossOriginResourcePolicy: z.union([headerValueSchema, z.literal(false)]).optional(),
+	originAgentCluster: z.union([headerValueSchema, z.literal(false)]).optional(),
+	permissionsPolicy: z.union([permissionsPolicySchema, z.literal(false)]).optional(),
+	referrerPolicy: z.union([headerValueSchema, z.literal(false)]).optional(),
+	strictTransportSecurity: z.union([strictTransportSecurityOptionsSchema, z.literal(false)]).optional(),
+	xContentTypeOptions: z.union([headerValueSchema, z.literal(false)]).optional(),
+	xDNSPrefetchControl: z.union([headerValueSchema, z.literal(false)]).optional(),
+	xDownloadOptions: z.union([headerValueSchema, z.literal(false)]).optional(),
+	xFrameOptions: z.union([z.enum(XFrameOptions), z.literal(false)]).optional(),
+	xPermittedCrossDomainPolicies: z.union([headerValueSchema, z.literal(false)]).optional()
+});
+export { securityHeadersSchema };

package/dist/schemas/ssgOptionsSchema.js

@@ -0,0 +1,10 @@
+import { z } from "zod";
+// src/schemas/ssgOptionsSchema.ts
+const ssgOptionsSchema = z.strictObject({
+	exportToPresets: z.boolean(),
+	hashScripts: z.boolean(),
+	hashStyles: z.boolean(),
+	meta: z.boolean(),
+	nitroHeaders: z.boolean()
+});
+export { ssgOptionsSchema };

package/dist/schemas/strictTransportSecurityOptionsSchema.js

@@ -0,0 +1,8 @@
+import { z } from "zod";
+// src/schemas/strictTransportSecurityOptionsSchema.ts
+const strictTransportSecurityOptionsSchema = z.strictObject({
+	includeSubdomains: z.boolean(),
+	maxAge: z.int().nonnegative(),
+	preload: z.boolean()
+});
+export { strictTransportSecurityOptionsSchema };

package/dist/services/computeSubresourceIntegrityHashes.js

@@ -0,0 +1,28 @@
+import { SRI_HASH_ALGORITHM } from "../runtime/constants.js";
+import { generateHash } from "../runtime/services/generateHash.js";
+import { existsSync } from "node:fs";
+import { readFile, readdir } from "node:fs/promises";
+import { join, posix, relative, sep } from "node:path";
+// src/services/computeSubresourceIntegrityHashes.ts
+const computeSubresourceIntegrityHashes = async (nitro) => {
+	const { baseURL: appBaseUrl, cdnURL: appCdnUrl } = nitro.options.runtimeConfig.app;
+	const existingPublicAssets = nitro.options.publicAssets.filter(({ dir: directory }) => existsSync(directory));
+	const filesByPublicAsset = await Promise.all(existingPublicAssets.map(async ({ baseURL = "", dir: directory }) => {
+		return (await readdir(directory, {
+			recursive: true,
+			withFileTypes: true
+		})).filter((entry) => entry.isFile()).map((entry) => {
+			const filePath = join(entry.parentPath, entry.name);
+			return {
+				filePath,
+				fullPath: posix.join(baseURL, ...relative(directory, filePath).split(sep))
+			};
+		});
+	}));
+	const hashEntries = await Promise.all(filesByPublicAsset.flat().map(async ({ filePath, fullPath }) => {
+		const hash = await generateHash(await readFile(filePath), SRI_HASH_ALGORITHM);
+		return [appCdnUrl ? new URL(posix.isAbsolute(fullPath) ? fullPath.slice(1) : fullPath, appCdnUrl.endsWith("/") ? appCdnUrl : `${appCdnUrl}/`).href : posix.join("/", appBaseUrl, fullPath), hash];
+	}));
+	return Object.fromEntries(hashEntries);
+};
+export { computeSubresourceIntegrityHashes };

package/dist/services/formatZodIssues.js

@@ -0,0 +1,15 @@
+// src/services/formatZodIssues.ts
+const getDeepestPathLength = (leafIssues) => Math.max(-1, ...leafIssues.map(({ path }) => path.length));
+const getLeafIssues = (issue, parentPath) => {
+	const path = [...parentPath, ...issue.path];
+	if (issue.code !== "invalid_union") return [{
+		issue,
+		path
+	}];
+	return issue.errors.map((branch) => branch.flatMap((branchIssue) => getLeafIssues(branchIssue, path))).reduce((deepest, branch) => getDeepestPathLength(branch) > getDeepestPathLength(deepest) ? branch : deepest);
+};
+const formatLeafIssue = ({ issue, path }) => {
+	return `${path.map(String).join(".") || "(options)"}: ${issue.message}`;
+};
+const formatZodIssues = (issues) => issues.flatMap((issue) => getLeafIssues(issue, [])).map((leafIssue) => formatLeafIssue(leafIssue)).join("; ");
+export { formatZodIssues };

package/dist/services/getDefaultModuleOptions.js

@@ -0,0 +1,40 @@
+import { getDefaultSecurityHeaders } from "./getDefaultSecurityHeaders.js";
+// src/services/getDefaultModuleOptions.ts
+const getDefaultModuleOptions = (isDevelopment, devServerUrl, isStrict) => ({
+	allowedMethodsRestricter: false,
+	basicAuth: false,
+	contentSecurityPolicyReportOnly: false,
+	corsHandler: {
+		methods: [
+			"GET",
+			"HEAD",
+			"PUT",
+			"PATCH",
+			"POST",
+			"DELETE"
+		],
+		origin: devServerUrl,
+		preflight: { statusCode: 204 }
+	},
+	csrf: false,
+	enabled: true,
+	headers: getDefaultSecurityHeaders(isDevelopment, isStrict),
+	hidePoweredBy: true,
+	nonce: true,
+	rateLimiter: false,
+	removeLoggers: false,
+	requestSizeLimiter: {
+		maxRequestSizeInBytes: 2e6,
+		maxUploadFileRequestInBytes: 8e6
+	},
+	sri: true,
+	ssg: {
+		exportToPresets: true,
+		hashScripts: true,
+		hashStyles: false,
+		meta: true,
+		nitroHeaders: true
+	},
+	strict: isStrict
+});
+export { getDefaultModuleOptions };

package/dist/services/getDefaultSecurityHeaders.js

@@ -0,0 +1,84 @@
+import { NONCE_PLACEHOLDER } from "../runtime/constants.js";
+import { CrossOriginEmbedderPolicy } from "../models/CrossOriginEmbedderPolicy.js";
+import { XFrameOptions } from "../models/XFrameOptions.js";
+// src/services/getDefaultSecurityHeaders.ts
+const getDefaultSecurityHeaders = (isDevelopment, isStrict) => ({
+	contentSecurityPolicy: {
+		"base-uri": ["'none'"],
+		"default-src": ["'self'"],
+		"font-src": [
+			"'self'",
+			"https:",
+			"data:"
+		],
+		"form-action": ["'self'"],
+		"frame-ancestors": ["'self'"],
+		"img-src": ["'self'", "data:"],
+		"object-src": ["'none'"],
+		"script-src": isStrict ? [
+			"'self'",
+			"'strict-dynamic'",
+			NONCE_PLACEHOLDER
+		] : [
+			"'self'",
+			"https:",
+			"'unsafe-inline'",
+			"'strict-dynamic'",
+			NONCE_PLACEHOLDER
+		],
+		"script-src-attr": ["'none'"],
+		"style-src": [
+			"'self'",
+			"https:",
+			"'unsafe-inline'"
+		],
+		"upgrade-insecure-requests": true
+	},
+	crossOriginEmbedderPolicy: isDevelopment ? CrossOriginEmbedderPolicy.UnsafeNone : CrossOriginEmbedderPolicy.Credentialless,
+	crossOriginOpenerPolicy: "same-origin",
+	crossOriginResourcePolicy: "same-origin",
+	originAgentCluster: "?1",
+	permissionsPolicy: {
+		accelerometer: [],
+		autoplay: [],
+		camera: [],
+		"clipboard-read": [],
+		"clipboard-write": [],
+		"cross-origin-isolated": [],
+		"display-capture": [],
+		"encrypted-media": [],
+		fullscreen: [],
+		gamepad: [],
+		geolocation: [],
+		gyroscope: [],
+		hid: [],
+		"idle-detection": [],
+		"interest-cohort": [],
+		"keyboard-map": [],
+		magnetometer: [],
+		microphone: [],
+		midi: [],
+		payment: [],
+		"picture-in-picture": [],
+		"publickey-credentials-get": [],
+		"screen-wake-lock": [],
+		serial: [],
+		"sync-xhr": ["self"],
+		unload: [],
+		usb: [],
+		"web-share": [],
+		"xr-spatial-tracking": []
+	},
+	referrerPolicy: "no-referrer",
+	strictTransportSecurity: {
+		includeSubdomains: true,
+		maxAge: 63072e3,
+		preload: false
+	},
+	xContentTypeOptions: "nosniff",
+	xDNSPrefetchControl: "off",
+	xDownloadOptions: "noopen",
+	xFrameOptions: XFrameOptions.SameOrigin,
+	xPermittedCrossDomainPolicies: "none"
+});
+export { getDefaultSecurityHeaders };

package/dist/services/getPluginTemplate.js

@@ -0,0 +1,9 @@
+// src/services/getPluginTemplate.ts
+const getPluginTemplate = (factoryPath, factoryName, dataPath) => [
+	`import { ${factoryName} } from ${JSON.stringify(factoryPath)};`,
+	`import data from ${JSON.stringify(dataPath)};`,
+	"",
+	`export default ${factoryName}(data);`,
+	""
+].join("\n");
+export { getPluginTemplate };

package/dist/services/getRemoveLoggersViteConfig.js

@@ -0,0 +1,3 @@
+// src/services/getRemoveLoggersViteConfig.ts
+const getRemoveLoggersViteConfig = () => ({ build: { rolldownOptions: { output: { minify: { compress: { dropConsole: true } } } } } });
+export { getRemoveLoggersViteConfig };

package/dist/services/getRouteRulesTemplate.js

@@ -0,0 +1,3 @@
+// src/services/getRouteRulesTemplate.ts
+const getRouteRulesTemplate = (routes) => `export default ${JSON.stringify(routes)}\n`;
+export { getRouteRulesTemplate };

package/dist/services/getRouteSecurityRules.js

@@ -0,0 +1,16 @@
+import { moduleOptionsSchema } from "../schemas/moduleOptionsSchema.js";
+import { formatZodIssues } from "./formatZodIssues.js";
+import { mergeModuleOptions } from "./mergeModuleOptions.js";
+// src/services/getRouteSecurityRules.ts
+const getRouteSecurityRules = (routeRules, options) => {
+	const routeSecurityRules = {};
+	for (const [route, { security }] of Object.entries(routeRules)) {
+		if (security === void 0) continue;
+		if (Object.hasOwn(security, "basicAuth")) throw new TypeError(`nuxt-security-module: route ${route}: basicAuth cannot be set in a route rule`);
+		const result = moduleOptionsSchema.safeParse(mergeModuleOptions(options, security));
+		if (!result.success) throw new TypeError(`nuxt-security-module: route ${route}: ${formatZodIssues(result.error.issues)}`);
+		routeSecurityRules[route] = security;
+	}
+	return routeSecurityRules;
+};
+export { getRouteSecurityRules };

package/dist/services/getStaticResourceHeaders.js

@@ -0,0 +1,11 @@
+import { serializeSecurityHeaders } from "../runtime/services/serializeSecurityHeaders.js";
+// src/services/getStaticResourceHeaders.ts
+const getStaticResourceHeaders = (headers) => serializeSecurityHeaders({
+	referrerPolicy: headers.referrerPolicy,
+	strictTransportSecurity: headers.strictTransportSecurity,
+	xContentTypeOptions: headers.xContentTypeOptions,
+	xDownloadOptions: headers.xDownloadOptions,
+	xFrameOptions: headers.xFrameOptions,
+	xPermittedCrossDomainPolicies: headers.xPermittedCrossDomainPolicies
+});
+export { getStaticResourceHeaders };

package/dist/services/getTypeTemplate.js

@@ -0,0 +1,24 @@
+import { MODULE_NAME, ROUTE_RULES_HOOK } from "../runtime/constants.js";
+// src/services/getTypeTemplate.ts
+const getTypeTemplate = () => `// Generated by ${MODULE_NAME}
+import type { ModuleOptions } from '${MODULE_NAME}'
+
+declare module '#${MODULE_NAME}/route-rules.mjs' {
+  const routeRules: Record<string, Partial<ModuleOptions>>
+  export default routeRules
+}
+
+declare module '#${MODULE_NAME}/sri-hashes.mjs' {
+  const sriHashes: Record<string, string>
+  export default sriHashes
+}
+
+declare module 'nitro/types' {
+  interface NitroRuntimeHooks {
+    '${ROUTE_RULES_HOOK}': (routeRules: Record<string, Partial<ModuleOptions>>) => void | Promise<void>
+  }
+}
+
+export {}
+`;
+export { getTypeTemplate };

package/dist/services/mergeModuleOptions.js

@@ -0,0 +1,38 @@
+// src/services/mergeModuleOptions.ts
+const mergeModuleOptions = (defaults, overrides) => ({
+	...defaults,
+	...overrides,
+	headers: mergeHeaders(defaults.headers, overrides.headers),
+	ssg: overrides.ssg === false ? false : {
+		...defaults.ssg,
+		...overrides.ssg
+	}
+});
+const mergeHeaders = (defaults, overrides) => {
+	if (overrides === false || defaults === false) return overrides ?? defaults;
+	if (overrides === void 0) return defaults;
+	return {
+		...defaults,
+		...overrides,
+		contentSecurityPolicy: mergeDirectives(defaults.contentSecurityPolicy, overrides.contentSecurityPolicy),
+		permissionsPolicy: mergeFeatures(defaults.permissionsPolicy, overrides.permissionsPolicy)
+	};
+};
+const mergeDirectives = (defaults, overrides) => {
+	if (overrides === false || defaults === false) return overrides ?? defaults;
+	if (overrides === void 0) return defaults;
+	const merged = { ...defaults };
+	for (const [directive, value] of Object.entries(overrides)) if (value === false) delete merged[directive];
+	else if (Array.isArray(value)) merged[directive] = [.../* @__PURE__ */ new Set([...Array.isArray(merged[directive]) ? merged[directive] : [], ...value])];
+	else merged[directive] = value;
+	return merged;
+};
+const mergeFeatures = (defaults, overrides) => {
+	if (overrides === false || defaults === false) return overrides ?? defaults;
+	if (overrides === void 0) return defaults;
+	const merged = { ...defaults };
+	for (const [feature, sources] of Object.entries(overrides)) if (sources === false) delete merged[feature];
+	else merged[feature] = [.../* @__PURE__ */ new Set([...merged[feature] || [], ...sources || []])];
+	return merged;
+};
+export { mergeModuleOptions };

package/dist/services/parseModuleOptions.js

@@ -0,0 +1,9 @@
+import { moduleOptionsSchema } from "../schemas/moduleOptionsSchema.js";
+import { formatZodIssues } from "./formatZodIssues.js";
+// src/services/parseModuleOptions.ts
+const parseModuleOptions = (options) => {
+	const result = moduleOptionsSchema.safeParse(options);
+	if (!result.success) throw new TypeError(`nuxt-security-module: ${formatZodIssues(result.error.issues)}`);
+	return result.data;
+};
+export { parseModuleOptions };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-security-module",
-  "version": "4.2.0",
+  "version": "4.3.3",
   "description": "Nuxt security module for Nitro 3 and h3 2 — security headers, a per-request nonce Content Security Policy, subresource integrity, CORS, allowed methods, basic auth and a request size limit.",
   "license": "Apache-2.0",
   "author": "Jimmy Chen",
@@ -37,8 +37,6 @@
   "scripts": {
     "build": "tsdown",
     "bench": "vitest bench --run",
-    "format": "oxfmt",
-    "format:check": "oxfmt --check",
     "lint": "eslint .",
     "lint:fix": "eslint --fix .",
     "test": "vitest",
@@ -52,21 +50,16 @@
     "zod": "^4.6.7"
   },
   "devDependencies": {
-    "@arethetypeswrong/core": "^0.18.5",
-    "@esposter/configuration": "4.2.0",
-    "@esposter/shared-node": "4.2.0",
+    "@esposter/configuration": "4.3.3",
+    "@esposter/shared-node": "4.3.3",
     "@nuxt/nitro-server": "npm:@nuxt/nitro-server-nightly@5x",
     "@types/node": "^26.6.5",
-    "fast-check": "^4.10.2",
-    "h3": "^2.0.2",
-    "nitro": "npm:nitro-nightly@latest",
-    "publint": "^0.3.25",
-    "tsdown": "^0.23.1",
-    "vitest": "^5.0.4"
+    "h3": "^2.0.7",
+    "tsdown": "^0.23.1"
   },
   "peerDependencies": {
-    "nitro": "npm:nitro-nightly@latest",
+    "nitro": "npm:nitro-nightly@3.0.1-20261018-005730-bb9894fe",
     "nuxt": "npm:nuxt-nightly@5x"
   },
-  "gitHead": "fef4971cf6a621a2c1850f32fcec19ee4ec0de99"
+  "gitHead": "955bbc130ad9b28877fd4ae8efc73a045141ce01"
 }