Bump nuxt from 3.21.8 to 3.21.10

[dependabot]

Bumps nuxt from 3.21.8 to 3.21.10.

Release notes

Sourced from nuxt's releases.

v3.21.10

⚠️ This is a security release. We recommend upgrading as soon as possible with npx nuxt upgrade --dedupe.

It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.

If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.

Full details: Nuxt Security Patch Releases and GitHub Security Advisories.

👉 Changelog

compare changes

🩹 Fixes

• nuxt: Clear hide/reset timeouts in set() (#35534)
• nuxt: Preserve trailing slash in NuxtLink href when unset (#35501)
• vite: Resolve SSR inlined CSS module class name mismatch (#35610)
• nuxt: Sync layout meta during middleware on SSR (#35633)
• nuxt: Update client URL to match SSR on fatal middleware error (#35637)
• nuxt: Watch external component directories in development (#35652)
• nuxt: Don't cross-pollute useAsyncData cache on reactive key change (#35656)
• nuxt: Return global route for useRoute in detached effect scope (#35659)
• nuxt: Ignore custom name or path when reusing an existing page in pages:extend (#35661)
• nuxt: Preserve explicit useFetch method inference (#35671)
• nuxt: Correct default export detection in plugin metadata (#35676)
• nuxt: Reload real page module on HMR of JSX render-function pages (#35678)
• vite: Ensure server sourcemap-preserver plugin actually runs (#35680)
• nuxt: Resolve @unhead/vue/* from nuxt's dependency tree (#35690)
• nuxt: Don't apply scroll behaviour after a subsequent nav (#35719)
• vite: Preserve css suffix when extracting ssr inline styles (#35714)
• nuxt: Don't exclude client entry module from style extraction (#35720)
• kit: Avoid mutating layer configs when resolving options (#35729)
• nuxt: Generate layout types even when pages module is disabled (#35717)
• nitro: Skip resource hints for stylesheets already rendered as blocking links (#35691)
• nuxt: Revalidate cached route payloads instead of using force-cache (#35672)
• nuxt: Preserve query params in cached payload extraction (#35696)
• rspack,webpack: Resolve loaders and runtime deps from nuxt dirs (#35568)
• nuxt: Render client components in nested server components (#35669)
• nuxt: Remove dev error overlay when error is cleared (#35821)
• rspack,webpack: Resolve bundled postcss defaults from builder (#35823)
• schema: Normalise slashes in app.buildAssetsDir (#35833)
• nuxt: Case-fold route rule keys to match folded lookups (619963309)
• nitro: Require loopback peer for chrome devtools workspace endpoint (00f71bb65)
• nitro: Bound island props and v-for to prevent unauthenticated DoS (668cdfdfd)
• nuxt: Reject reserved template island prop under runtime compiler (5b60017f7)
• nuxt: Reject top-level as prop for islands (00a2b0494)

📖 Documentation

• Document relative baseURL workarounds (#34004)
• Warn about runtimeCompiler security best practices (b76c1a8bd)
• Warn about validating server component props (f6d72628d)

✅ Tests

... (truncated)

Commits

• deafc94 v3.21.10
• 00a2b04 fix(nuxt): reject top-level as prop for islands
• 5b60017 fix(nuxt): reject reserved template island prop under runtime compiler
• 668cdfd fix(nitro): bound island props and v-for to prevent unauthenticated DoS
• 6199633 fix(nuxt): case-fold route rule keys to match folded lookups
• aa5175b fix(nuxt): remove dev error overlay when error is cleared (#35821)
• a2271cc chore(deps): update all non-major dependencies (3.x) (#35819)
• d32dffa fix(nuxt): render client components in nested server components (#35669)
• 8958a22 fix(nuxt): preserve query params in cached payload extraction (#35696)
• e6c8ebb fix(nuxt): revalidate cached route payloads instead of using force-cache (#...
• Additional commits viewable in compare view

[mortifia]

@dependabot rebase