[dependabot]

Bumps the minor-and-patch group with 6 updates in the / directory:

Package	From	To
nuxt	4.6.3	4.6.4
vue	3.5.44	3.5.45
@iconify-json/simple-icons	1.2.101	1.2.102
@takumi-rs/core	2.19.0	2.20.0
baseline-browser-mapping	2.11.34	2.11.35
oxlint	1.90.0	1.93.0

Updates nuxt from 4.6.3 to 4.6.4

Release notes

Sourced from nuxt's releases.

v4.6.4

4.6.4 is a security release. It fixes eight advisories in Nuxt and pulls in nitropack 2.13.6, which fixes three more in Nitro. We recommend upgrading as soon as you can.

⚠️ Behaviour changes

These probably won't affect most apps, but it's worth flagging anyway:

1. Error details in production. When a page fails to render on the server, the error page and the payload now only carry message and data of errors you create with createError. Everything else is stripped.
2. Dev server Host checks. Webpack and rspack dev servers now reject requests with an unexpected Host header, as Vite already does. If you use a custom hostname or tunnel, you'll need to add it to the new devServer.allowedHosts option.
3. workspaceDir detection. When workspaceDir isn't set, Nuxt now only widens it past rootDir to an explicit workspace root or the closest git repository.
4. Nitropack cached routes. cache, swr and isr route rules now only cache GET and HEAD requests, and no longer store responses that set a cookie or send Cache-Control: private or no-store. Wildcard proxy and redirect rules also reject requests whose resolved target would leave the rule's scope.
5. Route rules and encoded slashes. Route rules now match paths that contain encoded slashes, so /api%2Fadmin is covered by a /api/** rule.

👉 Changelog

compare changes

🩹 Fixes

• nitro,nuxt: require unrouting 0.3.2 (768d21368)
• nitro: preserve wildcard tails in case-insensitive route rules (bf31e4cd8)
• nitro: require nitropack 2.13.6 (1b13c6981)
• nitro: keep leading double slash in renderer request path (75c12c6fb)
• nuxt: use unambiguous encoding for island hash (6f1b93c64)
• vite-server: resolve wildcard redirect tails from the matched segments (1e7dfa6a7)
• nuxt: do not expose details of untrusted thrown errors (8c56b71e4)
• nuxt: strip trailing slashes in linear time (97424dd21)
• nitro,webpack: include hosts the CLI allows after loading the config (8c11d965d)
• webpack: skip hot middleware for forbidden dev requests (3c9645326)
• rspack,webpack: reject unexpected Host headers in dev middleware (f8d64c9aa)
• schema,nitro,vite: add devServer.allowedHosts (3e1c7964e)
• nitro,nuxt: match route rules for paths with encoded slashes (084396b10)
• schema: only widen workspace dir to a declared workspace root (89d3306d1)
• nitro: only trust x-forwarded-proto in when opted-in (#36818)
• nitro: stream the body read through a nuxt/server handler (#36817)
• kit: suggest the specific fix when loading falls back to jiti (24d75659d)
• vite: use a single type checker (#36774)
• nitro,vite: remove windows + virtual dev ssr css links after hydration (#36765)
• nitro,vite: dedupe dev css by module node (#36420)
• nuxt: avoid hoisting setup-only values from definePageMeta (#36751)
• nuxt: only match hydration modifiers after lazy prefix (#36750)
• kit,nitro,nuxt: make emitted tsconfig/types stable across reruns (#36747)
• nuxt: render inlined component styles after stylesheet links (#36714)
• webpack: use valid devtool for hidden client sourcemaps in dev (#36555)

📖 Documentation

• clarify template dependency regeneration (#36766)
• revise README structure and headings (#36772)
• link the Nuxt DevTools docs on nuxt.com (#36769)

... (truncated)

Commits

• b9a6b68 v4.6.4 (#36823)
• 6f1b93c fix(nuxt): use unambiguous encoding for island hash
• 8c56b71 fix(nuxt): do not expose details of untrusted thrown errors
• 97424dd fix(nuxt): strip trailing slashes in linear time
• 084396b fix(nitro,nuxt): match route rules for paths with encoded slashes
• 99b85f4 chore(deps): update all non-major dependencies (4.x) (#36820)
• 545b593 test: list new main-only diagnostic codes
• 861e153 test: normalise rolldown comment
• c75ca36 fix(nuxt): avoid hoisting setup-only values from definePageMeta (#36751)
• 34c56e5 fix(nuxt): only match hydration modifiers after lazy prefix (#36750)
• Additional commits viewable in compare view

Updates vue from 3.5.44 to 3.5.45

Release notes

Sourced from vue's releases.

v3.5.45

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.45 (2026-11-05)

Bug Fixes

• compiler-core: copy loc in cloneLoc instead of recomputing it (#16092) (3cee79a), closes #16091
• compiler-dom: preserve static boolean binding semantics (#16055) (05db7e8), closes #16051
• compiler-sfc: respect catch and switch lexical scopes (fix #16098) (#16101) (0f20152)
• hmr: retry reloads after pending async roots resolve (#16060) (fbaa794)
• hydration: only update component el when replacing its host node (#16001) (51fd0cb)
• KeepAlive: cache a resolved Suspense child right away (#16119) (716a29e)
• KeepAlive: unmount a child deactivated before it was cached (#15981) (02d2c2b)
• reactivity: run onScopeDispose in a stopped scope (#16108) (21dd33c)
• runtime-core: anchor on the async placeholder when a component root has no el (#16122) (b5abf8c)
• runtime-core: call directive mounted hooks with the latest binding (#16120) (6416207), closes #12460 #12482
• runtime-core: remove the placeholder of an unmounted pending async component (#15982) (2b9a0bb)
• runtime-core: render nothing for a component whose async setup rejects (#16111) (f64bfa5)
• runtime-core: skip stopped error boundaries for async failures (#16061) (0326ed8)
• runtime-dom: treat disablepictureinpicture and disableremoteplayback as boolean attributes (#15952) (ef81ddc)
• suspense: do not mount the fallback after the boundary is unmounted (#15939) (4fd6a6b)
• suspense: drop the unmount hooks of a pending branch when the boundary is unmounted (d04b662)
• suspense: enter transitions nested in the pending branch on reveal (#16121) (b8074de), closes #12435 #15294
• suspense: keep a discarded component marked unmounted (1dc8cdf)
• suspense: keep the async root update retry across a discarded pending branch (#16107) (06bea73)
• suspense: keep the internal cleanup of a discarded component (79b80b7)
• suspense: keep the timeout counting when the root is switched again while pending (#16143) (a045acd)
• suspense: patch same-root updates of nested boundaries in retained content (#16109) (2dbcea8), closes #15878
• suspense: release parent dep on suspensible unmount (#15870) (46e5dbf)
• suspense: resolve async deps whose pending cycle was discarded (#15980) (f7d0811)
• suspense: resolve the boundary when an async setup rejects without an error handler in dev (#16110) (a14aa0b)
• suspense: skip a root replacement in a retained nested boundary showing its fallback (#16125) (a47af77)
• suspense: skip the out-in afterLeave of an unmounted boundary (#16115) (85e71c0), closes #11037 #11059
• transition: handle leave immediately done in out-in mode (#11824) (70599b5), closes #15727
• transition: switch modes around a keyed suspense boundary (#16124) (ff0b341)
• types: add dialog closedby attribute (#16064) (24c9d0b)
• v-model: respect number modifier for Set select values (0ff253b)

Performance Improvements

• compiler-sfc: skip unused tsconfig include enumeration (#15899) (1612403), closes #15898
• compiler-ssr: render static style attributes at compile time (#16010) (2629c89)
• mark internal initializers as pure (#16012) (34fbeb1)
• runtime-core: copy raw attrs when setup context attrs are passed as vnode props (#16129) (823c744)

Commits

• 8b479a8 release: v3.5.45
• 9f9b71c chore(deps): bump source-map-js from 1.2.1 to 1.2.2 (#16150)
• 1d718d2 chore(deps): update dependency @​types/node to v26 (#16087)
• 68583ce chore(deps): bump undici from 8.9.0 to 8.12.3 (#16149)
• 91f2625 chore(deps): bump fast-uri from 3.1.0 to 3.1.9 (#16148)
• a8ab1f8 chore(deps): update build (#15918)
• a0d1388 chore(deps): update dependency minimatch to v11 [security] (#16145)
• 923f70d fix(deps): update compiler (#15920)
• 3cb1161 chore(deps): update lint (#15921)
• 0ce9e16 chore(deps): update dawidd6/action-download-artifact action to v28 (#16086)
• Additional commits viewable in compare view

Updates @iconify-json/simple-icons from 1.2.101 to 1.2.102

Commits

• See full diff in compare view

Updates @takumi-rs/core from 2.19.0 to 2.20.0

Release notes

Sourced from @​takumi-rs/core's releases.

takumi@2.20.0

• takumi-js@2.20.0
• @​takumi-rs/helpers@​2.20.0
• @​takumi-rs/wasm@​2.20.0
• @​takumi-rs/core@​2.20.0
• @​takumi-rs/image-response@​2.20.0
• takumi@2.20.0

registerFont registers one buffer again under another name, weight, style or unicodeRange

Passing the same data buffer to registerFont a second time with other descriptors used to return the first registration, so the new family or weight never existed. Each set of descriptors now registers its own face, as @font-face rules sharing one src do. A lazy font's key includes its unicodeRange too.

A unicodeRange subset without a glyph falls back to the next family again

A font in fonts whose unicodeRange claims a character it has no glyph for now hands that character on to the next family in the stack, as a browser does and as 0.18 did. Before, the render left the next family's subset unloaded. The PDF render then failed with "No registered font covers". That error now reads "No font the text can use draws", and suggests checking each font's unicodeRange and the font-family stack, because a registered font can have the glyph and still be out of reach.

A using block frees a renderer

Renderer, PdfRenderer and Painter implement Symbol.dispose, so using renderer = new Renderer() frees the renderer's WebAssembly memory when the block ends, as calling free() does.

prepare downloads the fonts @font-face rules load

An @font-face rule in css or a <style> element now loads its font in prepare, render, and ImageResponse. A src that fails to download falls back to the next one.

Load fonts from @font-face rules

With the font-face feature, on by default in takumi, @font-face rules add fonts to a render. needs reports the files the text uses in RenderNeeds::font_files. Pass each to Fonts::load_font_file, or to Fonts::fail_font_file to fall back to the next src.

Changelog

Sourced from @​takumi-rs/core's changelog.

@​takumi-rs/core@​2.20.0

A unicodeRange subset without a glyph falls back to the next family again

A font in fonts whose unicodeRange claims a character it has no glyph for now hands that character on to the next family in the stack, as a browser does and as 0.18 did. Before, the render left the next family's subset unloaded. The PDF render then failed with "No registered font covers". That error now reads "No font the text can use draws", and suggests checking each font's unicodeRange and the font-family stack, because a registered font can have the glyph and still be out of reach.

prepare downloads the fonts @font-face rules load

An @font-face rule in css or a <style> element now loads its font in prepare, render, and ImageResponse. A src that fails to download falls back to the next one.

registerFont registers one buffer again under another name, weight, style or unicodeRange

Passing the same data buffer to registerFont a second time with other descriptors used to return the first registration, so the new family or weight never existed. Each set of descriptors now registers its own face, as @font-face rules sharing one src do. A lazy font's key includes its unicodeRange too.

Commits

• ae2a350 Version Packages (#2438)
• bf13f76 Bindings: load the next family when a unicodeRange subset has no glyph for ...
• 4fd9276 Register one font buffer again under other descriptors without copying it (#2...
• 61b10e4 Bindings: download the files @​font-face rules load during prepare (#2435)
• See full diff in compare view

Updates baseline-browser-mapping from 2.11.34 to 2.11.35

Commits

• cc41ca0 Patch to 2.11.35 because browser or feature data changed
• 75c7f38 Browser or feature data changed
• da69b21 Updating static site
• See full diff in compare view

Updates oxlint from 1.90.0 to 1.93.0

Release notes

Sourced from oxlint's releases.

oxlint v1.93.0

🚀 Features

• 6195265 linter/promise/prefer-catch: Implement suggestion (#28919) (Mikhail Baev)

🐛 Bug Fixes

• 866664e linter/unicorn/no-useless-undefined: Skip var initializers (#29007) (camc314)
• 30603cb linter/react/exhaustive-deps: Preserve comments in dependency removals (#29047) (camc314)
• 4630fe4 linter/unicorn/no-useless-undefined: Narrow return type exemptions (#29000) (camc314)
• b63870a linter/vitest/expect-expect: Recognize benchmark fixtures (#29044) (camc314)
• 9c62d2a linter/eslint/no-unreachable-loop: Ignore enclosing finalizers for continues (#29004) (camc314)
• 6303df1 jsdoc: Preserve param tags after unmatched description delimiters (#28923) (Vishal Punjabi)
• fe66fa7 linter/eslint/no-lone-blocks: Report redundant blocks in function bodies (#29043) (camc314)
• e1694bd linter/unicorn/no-useless-undefined: Preserve shadowed bindings (#29046) (camc314)
• 791b5f5 linter/unicorn/prefer-regexp-test: Restrict automatic argument swaps (#29045) (camc314)
• e7654f6 linter/react/display-name: Ignore unrelated memo and forwardRef calls (#29005) (camc314)
• 2487360 linter/unicorn/no-useless-undefined: Report guarded indexed access (#29014) (camc314)
• a791a5b cfg: Resolve continues through stacked loop labels (#29016) (camc314)
• 287ba19 linter/eslint/id-length: Ignore TypeScript qualified references (#29037) (camc314)
• b71234f cfg: Skip labeled contexts for unlabeled jumps (#29001) (camc314)
• bb21a3c linter/import/no-anonymous-default-export: Report parenthesized exports (#29002) (camc314)
• f38f738 linter/eslint/prefer-destructuring: Skip fixes that remove comments (#29003) (camc314)
• bf11006 linter/react/exhaustive-deps: Suggest dependency removals (#28925) (camc314)
• 6bbb92a linter: Remove unused oxlint-disable directives with --fix (#27698) (Ryan Tsao)
• 3b35cb6 linter/disable-directives: Preserve separators and disable spans (#28921) (camc314)
• 1253445 linter/eslint/no-restricted-imports: Report re-exported imports once (#28920) (Ramy Akin Saidi)

⚡ Performance

• da620e6 linter: Start tsgolint before the regular lint pass (#28824) (Max Schwenk)

oxlint v1.92.0

🚀 Features

• 4a52ba2 oxlint: Discover tsrs for type-aware linting (#28751) (camc314)
• b7d2c75 linter/eslint/no-redeclare: Add ignoreDeclarationMerge option (#28816) (Cam McHenry)

🐛 Bug Fixes

• fa66fde oxlint,oxfmt: Resolve Vite+ config root from the config file directory (#28801) (MK (fengmk2))
• 2091564 linter/jsdoc/require-param: Ignore enclosing function JSDoc (#28866) (camc314)
• c6ec50b linter/react/only-export-components: Classify JSX values as non-components (#28761) (camc314)
• 3c051ab linter/vitest/prefer-called-exactly-once-with: Preserve neighboring code in autofix (#28864) (camc314)
• 674b962 linter/eslint/no-misleading-character-class: Use lazy regex for combining marks (#28822) (Sysix)
• 838d339 linter/vitest/prefer-called-exactly-once-with: Avoid panic on non-ASCII text (#28850) (YT)
• 8d24c26 linter/jsx-a11y/aria-role: Allow role={undefined} (#28804) (Abhay Godavarthy)
• a7143bf linter/eslint/no-restricted-imports: Respect allowTypeImports correctly for empty patterns (#28842) (Cam McHenry)
• 3d3a6f4 react-compiler: Ignore callback-local reassignments (#28820) (camc314)
• 0cc6515 linter/unicorn/prefer-type-error: Report throws in unbraced if branches (#28819) (camc314)

... (truncated)

Changelog

Sourced from oxlint's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

[1.92.0] - 2026-11-06

🚀 Features

• b7d2c75 linter/eslint/no-redeclare: Add ignoreDeclarationMerge option (#28816) (Cam McHenry)

[1.91.0] - 2026-11-02

🚀 Features

• 419c1b0 linter: Add allow and allowPattern options to react/capitalized-calls (Christian Vuerings)

Commits

• 7d8e1f4 release(apps): oxlint v1.93.0 && oxfmt v0.78.0 (#29090)
• 29daf90 release(apps): oxlint v1.92.0 && oxfmt v0.77.0 (#28906)
• b7d2c75 feat(linter/eslint/no-redeclare): add ignoreDeclarationMerge option (#28816)
• f3fcdcc release(apps): oxlint v1.91.0 && oxfmt v0.76.0 (#28718)
• 419c1b0 feat(linter): add allow and allowPattern options to react/capitalized-calls
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions