[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
nuxt (source)	4.6.3 → 4.6.4

---

Release Notes

nuxt/nuxt (nuxt)

v4.6.4

Compare Source

4.6.4 is a security release. It fixes eight advisories in Nuxt and pulls in nitropack 2.13.6, which fixes three more in Nitro. We recommend upgrading as soon as you can.

⚠️ Behaviour changes

These probably won't affect most apps, but it's worth flagging anyway:

1. Error details in production. When a page fails to render on the server, the error page and the payload now only carry message and data of errors you create with createError. Everything else is stripped.
2. Dev server Host checks. Webpack and rspack dev servers now reject requests with an unexpected Host header, as Vite already does. If you use a custom hostname or tunnel, you'll need to add it to the new devServer.allowedHosts option.
3. workspaceDir detection. When workspaceDir isn't set, Nuxt now only widens it past rootDir to an explicit workspace root or the closest git repository.
4. Nitropack cached routes. cache, swr and isr route rules now only cache GET and HEAD requests, and no longer store responses that set a cookie or send Cache-Control: private or no-store. Wildcard proxy and redirect rules also reject requests whose resolved target would leave the rule's scope.
5. Route rules and encoded slashes. Route rules now match paths that contain encoded slashes, so /api%2Fadmin is covered by a /api/** rule.

👉 Changelog

compare changes

🩹 Fixes

• nitro,nuxt: require unrouting 0.3.2 (768d21368)
• nitro: preserve wildcard tails in case-insensitive route rules (bf31e4cd8)
• nitro: require nitropack 2.13.6 (1b13c6981)
• nitro: keep leading double slash in renderer request path (75c12c6fb)
• nuxt: use unambiguous encoding for island hash (6f1b93c64)
• vite-server: resolve wildcard redirect tails from the matched segments (1e7dfa6a7)
• nuxt: do not expose details of untrusted thrown errors (8c56b71e4)
• nuxt: strip trailing slashes in linear time (97424dd21)
• nitro,webpack: include hosts the CLI allows after loading the config (8c11d965d)
• webpack: skip hot middleware for forbidden dev requests (3c9645326)
• rspack,webpack: reject unexpected Host headers in dev middleware (f8d64c9aa)
• schema,nitro,vite: add devServer.allowedHosts (3e1c7964e)
• nitro,nuxt: match route rules for paths with encoded slashes (084396b10)
• schema: only widen workspace dir to a declared workspace root (89d3306d1)
• nitro: only trust x-forwarded-proto in when opted-in (#​36818)
• nitro: stream the body read through a nuxt/server handler (#​36817)
• kit: suggest the specific fix when loading falls back to jiti (24d75659d)
• vite: use a single type checker (#​36774)
• nitro,vite: remove windows + virtual dev ssr css links after hydration (#​36765)
• nitro,vite: dedupe dev css by module node (#​36420)
• nuxt: avoid hoisting setup-only values from definePageMeta (#​36751)
• nuxt: only match hydration modifiers after lazy prefix (#​36750)
• kit,nitro,nuxt: make emitted tsconfig/types stable across reruns (#​36747)
• nuxt: render inlined component styles after stylesheet links (#​36714)
• webpack: use valid devtool for hidden client sourcemaps in dev (#​36555)

📖 Documentation

• clarify template dependency regeneration (#​36766)
• revise README structure and headings (#​36772)
• link the Nuxt DevTools docs on nuxt.com (#​36769)
• warn against spreading untrusted objects onto server components (1225ca7ff)
• update anchors for flat heading ids (#​36664)

🏡 Chore

• add 1000-row listing routes to the benchmark (c852d871f)
• add client page weight and browser timing suites (#​36788)

✅ Tests

• update bundle size snapshot (7528c3ce6)
• list new main-only diagnostic codes (545b5934c)
• tolerate node 26 proxy inspect output (40f72b40b)
• normalise rolldown comment (861e153dd)
• improve benchmark tests (#​36745)

🤖 CI

• check unversioned docs links against branch docs version (d093c88b1)
• skip unneeded checks for release prs (4b90681bd)
• skip benchmarks in merge groups (6428070e0)
• re-enable codspeed ⚡ (bc17c03d1)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Max (@​onmax)
• Sébastien Chopin (@​atinux)
• saini-25 (@​saini-25)
• Baptiste Leproux (@​larbish)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Terraform Plan

🚧 Changes detected — Plan: 6 to add, 1 to change, 1 to destroy.

Plan output

Acquiring state lock. This may take a few moments...

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.network.aws_security_group.tasks will be created
  + resource "aws_security_group" "tasks" {
      + arn                    = (known after apply)
      + description            = "ECS tasks of cupcake-cupcake; peer rules are managed by javabin-app-peers-sync"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = "cupcake-cupcake-tasks"
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = true
      + tags                   = {
          + "Name"            = "cupcake-cupcake-tasks"
          + "javabin-network" = "app"
        }
      + tags_all               = {
          + "Name"            = "cupcake-cupcake-tasks"
          + "environment"     = "production"
          + "javabin-network" = "app"
          + "managed-by"      = "terraform"
          + "repo"            = "javaBin/frosting"
          + "service"         = "cupcake"
          + "team"            = "cupcake"
        }
      + vpc_id                 = "vpc-0cd3502de2527a310"
    }

  # module.network.aws_service_discovery_service.this will be created
  + resource "aws_service_discovery_service" "this" {
      + arn           = (known after apply)
      + force_destroy = true
      + id            = (known after apply)
      + name          = "cupcake-cupcake"
      + namespace_id  = (known after apply)
      + tags_all      = {
          + "environment" = "production"
          + "managed-by"  = "terraform"
          + "repo"        = "javaBin/frosting"
          + "service"     = "cupcake"
          + "team"        = "cupcake"
        }
      + type          = (known after apply)

      + dns_config {
          + namespace_id   = "ns-4qfb7mei2fit4q4b"
          + routing_policy = "MULTIVALUE"

          + dns_records {
              + ttl  = 10
              + type = "A"
            }
        }

      + health_check_custom_config {
          + failure_threshold = 1
        }
    }

  # module.network.aws_ssm_parameter.network will be created
  + resource "aws_ssm_parameter" "network" {
      + arn            = (known after apply)
      + data_type      = (known after apply)
      + description    = "App-to-app request for cupcake-cupcake — read by the platform app-peers-sync Lambda"
      + has_value_wo   = (known after apply)
      + id             = (known after apply)
      + insecure_value = (known after apply)
      + key_id         = (known after apply)
      + name           = "/javabin/apps/cupcake/cupcake/network"
      + tags_all       = {
          + "environment" = "production"
          + "managed-by"  = "terraform"
          + "repo"        = "javaBin/frosting"
          + "service"     = "cupcake"
          + "team"        = "cupcake"
        }
      + tier           = (known after apply)
      + type           = "String"
      + value          = (sensitive value)
      + version        = (known after apply)
    }

  # module.network.aws_vpc_security_group_egress_rule.all will be created
  + resource "aws_vpc_security_group_egress_rule" "all" {
      + arn                    = (known after apply)
      + cidr_ipv4              = "0.0.0.0/0"
      + description            = "All outbound"
      + id                     = (known after apply)
      + ip_protocol            = "-1"
      + security_group_id      = (known after apply)
      + security_group_rule_id = (known after apply)
      + tags_all               = {
          + "environment" = "production"
          + "managed-by"  = "terraform"
          + "repo"        = "javaBin/frosting"
          + "service"     = "cupcake"
          + "team"        = "cupcake"
        }
    }

  # module.network.aws_vpc_security_group_ingress_rule.alb[0] will be created
  + resource "aws_vpc_security_group_ingress_rule" "alb" {
      + arn                          = (known after apply)
      + description                  = "ALB to the app port"
      + from_port                    = 3000
      + id                           = (known after apply)
      + ip_protocol                  = "tcp"
      + referenced_security_group_id = "sg-061000c0fa68a41b7"
      + security_group_id            = (known after apply)
      + security_group_rule_id       = (known after apply)
      + tags_all                     = {
          + "environment" = "production"
          + "managed-by"  = "terraform"
          + "repo"        = "javaBin/frosting"
          + "service"     = "cupcake"
          + "team"        = "cupcake"
        }
      + to_port                      = 3000
    }

  # module.service.aws_ecs_service.this will be updated in-place
  ~ resource "aws_ecs_service" "this" {
        id                                 = "arn:aws:ecs:eu-central-1:553637109631:service/javabin-platform/cupcake-cupcake"
        name                               = "cupcake-cupcake"
        tags                               = {}
      ~ task_definition                    = "arn:aws:ecs:eu-central-1:553637109631:task-definition/cupcake-cupcake:3" -> (known after apply)
        # (16 unchanged attributes hidden)

      ~ network_configuration {
          ~ security_groups  = [
              - "sg-0df9a0a3a22548c62",
            ] -> (known after apply)
            # (2 unchanged attributes hidden)
        }

      + service_registries {
          + registry_arn = (known after apply)
        }

        # (3 unchanged blocks hidden)
    }

  # module.service.aws_ecs_task_definition.this must be replaced
-/+ resource "aws_ecs_task_definition" "this" {
      ~ arn                      = "arn:aws:ecs:eu-central-1:553637109631:task-definition/cupcake-cupcake:3" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:eu-central-1:553637109631:task-definition/cupcake-cupcake" -> (known after apply)
      ~ container_definitions    = jsonencode(
          ~ [
              ~ {
                  ~ environment            = [
                        {
                            name  = "COGNITO_DOMAIN"
                            value = "javabin-internal.auth.eu-central-1.amazoncognito.com"
                        },
                      + {
                          + name  = "COGNITO_EXTRA_AUTH_PARAMS"
                          + value = "prompt=select_account"
                        },
                        {
                            name  = "COGNITO_GROUPS"
                            value = "helter"
                        },
                        # (6 unchanged elements hidden)
                    ]
                    name                   = "cupcake"
                  ~ portMappings           = [
                      ~ {
                          - hostPort      = 3000
                            # (2 unchanged attributes hidden)
                        },
                    ]
                  - systemControls         = []
                  - volumesFrom            = []
                    # (7 unchanged attributes hidden)
                },
            ] # forces replacement
        )
      ~ enable_fault_injection   = false -> (known after apply)
      ~ id                       = "cupcake-cupcake" -> (known after apply)
      ~ revision                 = 3 -> (known after apply)
      - tags                     = {} -> null
        # (10 unchanged attributes hidden)

      - volume {
          - configure_at_launch = false -> null
          - name                = "tmp" -> null
        }
      + volume {
          + configure_at_launch = (known after apply)
          + name                = "tmp"
        }
    }

Plan: 6 to add, 1 to change, 1 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

---

LLM Review

Risk: 🟡 MEDIUM

Creates networking/service-discovery resources for cupcake-cupcake and replaces its ECS task definition (6 to add, 1 to change, 1 to destroy), with no database or internet-facing security group opening.

• 💥 [destruction] The aws_ecs_task_definition.this resource is destroy-and-replace (forces replacement, driven by container_definitions changes). Task definition revisions are immutable, so this creates a new revision; the ECS service is updated in-place to point at it. Confirm the ECS service rollout succeeds and that the old revision is not referenced elsewhere. Also note the container port mapping change: hostPort 3000 is removed from portMappings, which is usually harmless on awsvpc networking but should be verified.
• 🔒 [security] The ECS service drops the existing security group sg-0df9a0a3a22548c62 from network_configuration and the plan shows the new tasks SG (aws_security_group.tasks) will be used via the service update. Verify the new SG is attached and the old SG removal does not unintentionally expose or cut traffic. The new ingress rule only allows TCP 3000 from the ALB SG sg-061000c0fa68a41b7, and egress is all-outbound to 0.0.0.0/0, which is standard for app tasks.
• 🔒 [security] A new SSM parameter /javabin/apps/cupcake/cupcake/network is created with a sensitive value and read by a platform Lambda (app-peers-sync) that also manages peer rules on the tasks security group. Confirm the Lambda's IAM scope is limited to this parameter path and to the intended SG.
• 🔒 [security] The task definition gains a COGNITO_EXTRA_AUTH_PARAMS env var (prompt=select_account). This is a benign auth-flow tweak, not a permission change, but it changes login behaviour for the app.
• 💰 [cost] New resources are low-cost: a security group, SG rules, a Cloud Map service, and an SSM standard parameter. No NAT gateway, RDS, or load balancer is created. Routine ECS task replacement has no meaningful cost impact.

[github-actions]

Terraform Plan

✅ No changes — infrastructure is up to date.

Plan output

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

[github-actions]

Terraform Plan

🚧 Changes detected — Plan: 1 to add, 0 to change, 1 to destroy.

Plan output

Acquiring state lock. This may take a few moments...

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.ecr.aws_ecr_lifecycle_policy.this must be replaced
-/+ resource "aws_ecr_lifecycle_policy" "this" {
      ~ id          = "cupcake-cupcake" -> (known after apply)
      ~ policy      = jsonencode(
          ~ {
              ~ rules = [
                    {
                        action       = {
                            type = "expire"
                        }
                        description  = "Keep last 5 semver releases"
                        rulePriority = 1
                        selection    = {
                            countNumber   = 5
                            countType     = "imageCountMoreThan"
                            tagPrefixList = [
                                "v",
                            ]
                            tagStatus     = "tagged"
                        }
                    },
                  ~ {
                      ~ selection    = {
                          ~ tagPrefixList = [
                                "main-",
                              - "master-",
                            ]
                            # (3 unchanged attributes hidden)
                        }
                        # (3 unchanged attributes hidden)
                    },
                    {
                        action       = {
                            type = "expire"
                        }
                        description  = "Expire untagged images after 1 day(s)"
                        rulePriority = 3
                        selection    = {
                            countNumber = 1
                            countType   = "sinceImagePushed"
                            countUnit   = "days"
                            tagStatus   = "untagged"
                        }
                    },
                    # (1 unchanged element hidden)
                ]
            } # forces replacement
        )
      ~ registry_id = "553637109631" -> (known after apply)
        # (1 unchanged attribute hidden)
    }

Plan: 1 to add, 0 to change, 1 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

---

LLM Review

Risk: 🟢 LOW

Replaces one ECR lifecycle policy (module.ecr.aws_ecr_lifecycle_policy.this) to drop the "master-" tag prefix from the semver/branch retention rule; no infrastructure, network, IAM, or billable resources change.

• 💥 [destruction] The aws_ecr_lifecycle_policy is destroyed and recreated because the policy JSON change forces replacement. The gap between destroy and create is brief, and the only effect is that lifecycle rules are briefly absent. ECR images are not deleted by this, since lifecycle policies only expire images when they run. Image data is not at risk.
• ✅ [routine] Rule 2 (the rule for tag prefixes such as 'main-' and 'master-') drops the 'master-' prefix from tagPrefixList. Images tagged 'master-' will no longer be matched by this rule, so they will stop being expired by it and will accumulate. Confirm this is intended, since the rule may be the one keeping old master- images under control.
• 💰 [cost] Because 'master-' images are no longer matched, ECR storage may grow over time. The impact is small and only applies if master- images are pushed frequently.
• 🔒 [security] No IAM, security group, public access, or permission boundary changes are present in this plan.