[DPEDE-1784](deps): Bump nuxt from 4.4.2 to 4.5.0

[dependabot]

Bumps nuxt from 4.4.2 to 4.5.0.

Release notes

Sourced from nuxt's releases.

v4.5.0

4.5.0 is the next minor release.

📣 Some News

Preparing for Nuxt 5

A good chunk of this release is (hopefully) invisible plumbing for Nuxt 5. We've moved onto the latest major versions of several core dependencies (unhead v3, unctx v3, and Vite 8), switched the framework's own build over to tsdown, and introduced a stable nuxt/* build output contract with dev exports so that type-checking in the Nuxt monorepo works without a build step (#35463, #35605).

Much of this is working to shrink the gap between v4 and v5 internally, so that the migration will be as boring as possible.

[!TIP] If you want to test some of the breaking changes of Nuxt v5, you can already opt in with future.compatibilityVersion: 5. Keep an eye on the Upgrade Guide for details as they land.

With the release of Nuxt v4.5, our focus as a team will turn to stabilising Nuxt v5 and creating compatibility utilities to make the upgrade as smooth as possible.

Nuxt 3 End-of-Life

Nuxt 3 reaches end-of-life on July 31, 2026, so this is one of the last few 3.x releases we'll ship. If you're still on v3, now is a great time to move across. Most people told us the v3 to v4 upgrade was smooth, and we've kept the upgrade guide up to date.

Alongside v4.5.0 we're publishing a maintenance patch for the 3.x line (v3.21.9) with the compatible bug fixes and smaller improvements from this release backported. The headline items here (Vite 8, Rspack 2, unhead v3, unctx v3) are major upgrades and stay v4-only, so 3.x remains stable as it approaches end-of-life.

👀 Highlights

Nuxt 4.5 is a big one. This release ships three major upgrades to the build layer (Vite 8, Rspack 2, and a brand new Rsbuild-powered pipeline for the Rspack builder), an experimental SSR streaming mode, a handful of new composables and conventions, and a lot of groundwork that brings us closer to Nuxt 5.

There's a lot here, so grab a coffee. ☕️

⚡️ Vite 8

Nuxt now runs on Vite 8 (#34256). This brings faster cold starts, the latest Rolldown-powered internals, and many upstream improvements from the Vite team.

For most apps this is a transparent upgrade. If you have custom Vite plugins or config, it's worth skimming the Vite migration guide to check for anything that affects you.

[!WARNING] Vite 8 is a major version bump. If you depend on Vite directly (custom plugins, vite.config tweaks, or ecosystem plugins that pin a Vite version), make sure those are compatible before upgrading in production.

🦀 Rspack 2 and Rsbuild

If you use the Rspack builder, this release is a substantial upgrade. We've moved to Rspack 2 (#34929), which is faster and lighter, and rebuilt the builder on top of @rsbuild/core (#35489).

The public surface stays the same. You still opt in with builder: 'rspack' and the existing rspack:* hooks continue to work:

// nuxt.config.ts
export default defineNuxtConfig({
  builder: 'rspack',
})

... (truncated)

Commits

• 5761457 v4.5.0
• b5f9830 feat(nuxt): warn when parent page lacks NuxtPage (#35639)
• 76cb01d fix(nuxt): update client URL to match SSR on fatal middleware error (#35637)
• 6d94a14 fix(nuxt): apply latest navigation on concurrent navigateTo in built-in rou...
• d566626 feat(nuxt): require keyed function 'source' with compatibilityVersion 5
• c699cc0 fix(nuxt): drop extension on diagnostics import
• 881e5ef feat: error code system (#35429)
• 379c22f feat(nuxt): support enabled option in useFetch (#35627)
• 353164b fix(nuxt): re-add computeIslandHash for backwards compatibility
• 881d5c4 docs: clarify usage of await with useFetch (#33745)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[lumen-jenkins-prod]

The CI pipeline did not run successfully in https://jenkinsprod.corp.intranet:8443/job/UX-CHI/job/Productive/job/Chi/job/PR-2117/1/. ❌

[cl-aifel-test]

🔖 aifel-verdict — AiFEL dependency-triage verdict (schema 1.1)

AiFEL verdict — 🚨 Escalate (ci-health) — human review required

Minor bump nuxt 4.4.2→4.5.0 is safe on dependency and security axes (no in-repo usage, 6 advisories resolved, none still active), but escalated because critical CI confidence is low (53.6% pass rate over 28 runs driven by concurrent failing Dependabot PRs).

TL;DR

• Merge: 🔍 review CI, then merge — the dependency and security axes are both clear; the low CI pass rate is caused by other concurrent Dependabot bump PRs (@babel, js-yaml, brace-expansion) that are failing, not by regressions in this PR; once those are resolved or accounted for, this bump is safe to land.
• Breaks your code? ✅ Most likely not — nuxt is not imported in your source files.
• Security? ✅ this bump fixes GHSA-mm7m-92g8-7m47, GHSA-934w-87qh-qr26, GHSA-c9cv-mq2m-ppp3, GHSA-534h-c3cw-v3h9, GHSA-m3q2-p4fw-w38m, GHSA-rq7w-g337-39qq.
• Update: nuxt — you have 4.4.2, this PR installs 4.5.0 (minor, spans 1 release). Fixes 6 security advisories (XSS, route-rule middleware bypass, vite-node IPC exposure, URL-handling weaknesses, dev-server path disclosure); no code changes needed in your repo.

Signal	Value	Interpretation
Bump type	minor	y-version change (4.4.2→4.5.0); SemVer minor means backward-compatible, additive features only — no breaking API removals expected for consumers of the public surface.
Dependency risk	low	Minor bump; nuxt is not imported in this repo's source (api_usage_found: false) so no API-level breakage is possible on merge. Framework-internal upgrades (Vite 8, unhead v3 type-narrowing, NuxtLink custom-slot prefetch change) are in scope for nuxt's own internals but do not reach this codebase. Dependency axis is safe.
Security risk	low	Fixes GHSA-mm7m-92g8-7m47 (CVE-2026-53721, high — route-rule middleware bypass), GHSA-934w-87qh-qr26 (CVE-2026-53722, medium — reflected XSS in <NuxtLink>), GHSA-c9cv-mq2m-ppp3 (CVE-2026-56326, medium — navigateTo/reloadNuxtApp URL-handling weaknesses), GHSA-534h-c3cw-v3h9 (CVSS 5.5, medium — vite-node IPC world-connectable on Linux), GHSA-m3q2-p4fw-w38m (low — XSS via <NoScript> slot), GHSA-rq7w-g337-39qq (low — dev-server path disclosure; patched in 4.4.7, 4.5.0 is outside the vulnerable range). No advisories still affect 4.5.0; max_cvss is null after clearing.
CI health risk	high	28 critical runs observed: pass rate 53.6% (below the 70% threshold), flakiness 0%. CI confidence is low. The failures are concentrated in Dependabot update PRs for @babel/preset-env (group), js-yaml, and brace-expansion — unrelated to this PR. "Push on master" (6/6 ✅) and "Scheduled" (4/4 ✅) are healthy. No informational workflows excluded.
API usage in repo	false	0 import sites found across a complete local scan using all npm import patterns for nuxt (import … from 'nuxt', require('nuxt'), dynamic import('nuxt'), export … from 'nuxt'). Nuxt is consumed as a CLI/build-tool framework via config and auto-imports; it is not referenced with an explicit import in your source.
Cross-repo signal	standalone	No publishable root manifest found in the repository root.
Data completeness	complete	All 5 signals obtained: classification ✅, API usage ✅, release notes ✅, CI health ✅, cascade scan ✅.

📋 Why this route + what AiFEL checked (click to expand)

Why this route?

escalate because: critical CI confidence is low — pass rate 53.6% is below the 70% floor over 28 observed critical runs.

Escalation category: ci-health (the CI-low rule fired; dependency risk is low and security risk is low — this escalation is entirely attributable to CI, not to the bump itself).

Confidence breakdown — score: 0.85:

• ✅ Minor bump — backward-compatible SemVer delta; no breaking API removals

• ✅ No in-repo API usage — confirmed by complete local scan; nuxt not imported in source

• ✅ All 6 security advisories resolved by 4.5.0; none still active; max_cvss null

• ✅ No cascade conflicts — no other open Dependabot PRs bumping nuxt to a different version

• ✅ Complete data — all 5 required signals obtained

• ⚠️ Critical CI low: 53.6% pass rate (28 runs) — failing runs are from other concurrent Dependabot PRs (@babel group, js-yaml, brace-expansion), not from master branch regressions; "Push on master" and "Scheduled" remain 100% green

• 💡 To reach a lower route: Merge or close the other failing Dependabot PRs (the @babel/preset-env group and js-yaml/brace-expansion bumps) so the critical-CI pass rate rises above 70% on the default branch. This nuxt bump's own triggered run (npm_and_yarn in /. for nuxt - Update #1467389242) passed 1/1.

What AiFEL checked

1. Triage — classified minor (nuxt 4.4.2→4.5.0).
2. Symbol extraction — 0 import sites across a complete local scan of the repository; nuxt is not explicitly imported in source.
3. Release-notes comparator — changelog available for 4.4.2→4.5.0 (truncated): framework-layer upgrades (Vite 8, Rspack 2/Rsbuild, unhead v3, unctx v3), experimental SSR streaming, new composables (useLayout, enabled option for useFetch/useAsyncData), stable error codes, named views. No documented breaking changes touch any API this repo calls (no in-repo usage found).
4. CI health — 28 critical runs: pass 53.6%, flaky 0% → confidence low; no informational excluded.
5. Cascade coordinator — 0 conflicts.
6. Data completeness — obtained 5/5 signals; missing: none.

Will merging break your code?

✅ Per AiFEL analysis, most likely won't impact your code. Nuxt is not imported in your source files — it is consumed as a CLI/build framework via auto-imports and config — so the framework-internal upgrades in this release (Vite 8, unhead v3 type-narrowing, NuxtLink custom-slot prefetch behaviour change) have no bearing on your codebase.

Security advisories

✅ Nothing still affects 4.5.0

✅ Resolved by this bump (6): GHSA-mm7m-92g8-7m47, GHSA-934w-87qh-qr26, GHSA-c9cv-mq2m-ppp3, GHSA-534h-c3cw-v3h9, GHSA-m3q2-p4fw-w38m, GHSA-rq7w-g337-39qq — no action needed (highest recorded CVSS 5.5; highest severity label: high).

Packages — what you have vs what this PR installs

Ecosystem	Package	You have	This PR installs	What changes for you
npm	nuxt	4.4.2	4.5.0	Minor — framework upgrades (Vite 8, unhead v3, experimental SSR streaming, new composables); fixes 6 security advisories; no code impact (nuxt not imported in source)

---

Machine-readable verdict

{
  "schema_version": "1.1",
  "classification": "minor",
  "risk_band": "low",
  "ci_confidence": "low",
  "decision_route": "escalate",
  "data_completeness": "complete",
  "escalate_reason": "risk",
  "missing_signals": [],
  "confidence": 0.85,
  "packages": [
    {
      "ecosystem": "npm",
      "name": "nuxt",
      "old_version": "4.4.2",
      "new_version": "4.5.0"
    }
  ],
  "breaking_changes": [],
  "cascade_conflicts": [],
  "summary": "Minor bump nuxt 4.4.2→4.5.0: no in-repo API usage, 6 security advisories resolved (none still affect 4.5.0), critical CI confidence low (53.6% pass rate / 28 runs driven by concurrent failing Dependabot PRs). Escalated on ci-health; dependency and security axes are clear.",
  "upgrade_risk_note": null,
  "cross_repo_signal": "standalone",
  "api_usage_found": false,
  "advisory_ids": [],
  "max_cvss": null,
  "feedback_capture_marker": "aifel-CenturyLink-Chi-2117",
  "agent_version": "1.1.1-aw"
}

🤖 Generated by AiFEL — AI-assisted Dependabot triage. Advisory only; a human reviewer still decides and merges.
📝 Share your AiFEL experience

[dependabot]

Superseded by #2126.

[lumen-jenkins-prod]

Removed the Kubernetes allocated resources

[lumen-jenkins-prod]

Removed the Kubernetes allocated resources

[lumen-jenkins-prod]

Removed the Kubernetes allocated resources