Skip to content

chore(deps): bump brace-expansion, nuxt and @primevue/nuxt-module - #37

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-b020a9a349
Open

chore(deps): bump brace-expansion, nuxt and @primevue/nuxt-module#37
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-b020a9a349

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 31, 2026

Copy link
Copy Markdown
Contributor

Bumps brace-expansion to 5.0.9 and updates ancestor dependencies brace-expansion, nuxt and @primevue/nuxt-module. These dependencies need to be updated together.

Updates brace-expansion from 2.0.3 to 5.0.9

Release notes

Sourced from brace-expansion's releases.

v4.0.1

  • fmt 5a5cc17
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 0b6a978

juliangruber/brace-expansion@v4.0.0...v4.0.1

v4.0.0

  • feat: use string replaces instead of splits (#64) 278132b
  • fmt dd72a59
  • add tea.yaml 70e4c1b

juliangruber/brace-expansion@v3.0.0...v4.0.0

As a precaution to not risk breaking anything with 278132b, this is a new semver major release

v3.0.1

  • pkg: publish on tag 3.x 3059c07
  • fmt 8229e6f
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 15f9b3c

juliangruber/brace-expansion@v3.0.0...v3.0.1

v3.0.0

  • Switch to ES Modules and balanced-match 3.0.0 (#62) c0360e8
  • added jsdoc (#55) 68c0e37
  • node 16 is EOL 9e781e9
  • add standard 3494c4d
  • use const and let (#57) dd5a4cb
  • docs 6dad209
  • remove test e3dd8ae
  • ci: update node versions d23ede9
  • docs: add @​lanodan to contributors 1eb3fa4
  • docs 1e7c9cd
  • switch from tape to test module (#60) 2520537
  • Bump minimist from 1.2.5 to 1.2.6 (#59) 61a94f1
  • Bump path-parse from 1.0.6 to 1.0.7 (#51) dc741cf
  • docs: add back ci badge 8ee5626
  • Add github actions, remove travis. Closes #52 (#53) 5c8756a
  • CI: Drop unused sudo: false Travis directive (#50) 05978a7

juliangruber/brace-expansion@v2.0.1...v3.0.0

v2.1.1

  • Backport v5.0.6 change to v2 (#109) c3a817c

... (truncated)

Commits
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates nuxt from 3.17.5 to 3.21.10

Release notes

Sourced from nuxt's releases.

v3.21.10

⚠️ This is a security release. We recommend upgrading as soon as possible with npx nuxt upgrade --dedupe.

It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.

If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.

Full details: Nuxt Security Patch Releases and GitHub Security Advisories.

👉 Changelog

compare changes

🩹 Fixes

  • nuxt: Clear hide/reset timeouts in set() (#35534)
  • nuxt: Preserve trailing slash in NuxtLink href when unset (#35501)
  • vite: Resolve SSR inlined CSS module class name mismatch (#35610)
  • nuxt: Sync layout meta during middleware on SSR (#35633)
  • nuxt: Update client URL to match SSR on fatal middleware error (#35637)
  • nuxt: Watch external component directories in development (#35652)
  • nuxt: Don't cross-pollute useAsyncData cache on reactive key change (#35656)
  • nuxt: Return global route for useRoute in detached effect scope (#35659)
  • nuxt: Ignore custom name or path when reusing an existing page in pages:extend (#35661)
  • nuxt: Preserve explicit useFetch method inference (#35671)
  • nuxt: Correct default export detection in plugin metadata (#35676)
  • nuxt: Reload real page module on HMR of JSX render-function pages (#35678)
  • vite: Ensure server sourcemap-preserver plugin actually runs (#35680)
  • nuxt: Resolve @unhead/vue/* from nuxt's dependency tree (#35690)
  • nuxt: Don't apply scroll behaviour after a subsequent nav (#35719)
  • vite: Preserve css suffix when extracting ssr inline styles (#35714)
  • nuxt: Don't exclude client entry module from style extraction (#35720)
  • kit: Avoid mutating layer configs when resolving options (#35729)
  • nuxt: Generate layout types even when pages module is disabled (#35717)
  • nitro: Skip resource hints for stylesheets already rendered as blocking links (#35691)
  • nuxt: Revalidate cached route payloads instead of using force-cache (#35672)
  • nuxt: Preserve query params in cached payload extraction (#35696)
  • rspack,webpack: Resolve loaders and runtime deps from nuxt dirs (#35568)
  • nuxt: Render client components in nested server components (#35669)
  • nuxt: Remove dev error overlay when error is cleared (#35821)
  • rspack,webpack: Resolve bundled postcss defaults from builder (#35823)
  • schema: Normalise slashes in app.buildAssetsDir (#35833)
  • nuxt: Case-fold route rule keys to match folded lookups (619963309)
  • nitro: Require loopback peer for chrome devtools workspace endpoint (00f71bb65)
  • nitro: Bound island props and v-for to prevent unauthenticated DoS (668cdfdfd)
  • nuxt: Reject reserved template island prop under runtime compiler (5b60017f7)
  • nuxt: Reject top-level as prop for islands (00a2b0494)

📖 Documentation

  • Document relative baseURL workarounds (#34004)
  • Warn about runtimeCompiler security best practices (b76c1a8bd)
  • Warn about validating server component props (f6d72628d)

✅ Tests

... (truncated)

Commits
  • deafc94 v3.21.10
  • 00a2b04 fix(nuxt): reject top-level as prop for islands
  • 5b60017 fix(nuxt): reject reserved template island prop under runtime compiler
  • 668cdfd fix(nitro): bound island props and v-for to prevent unauthenticated DoS
  • 6199633 fix(nuxt): case-fold route rule keys to match folded lookups
  • aa5175b fix(nuxt): remove dev error overlay when error is cleared (#35821)
  • a2271cc chore(deps): update all non-major dependencies (3.x) (#35819)
  • d32dffa fix(nuxt): render client components in nested server components (#35669)
  • 8958a22 fix(nuxt): preserve query params in cached payload extraction (#35696)
  • e6c8ebb fix(nuxt): revalidate cached route payloads instead of using force-cache (#...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nuxt since your current version.


Updates @primevue/nuxt-module from 4.0.4 to 4.5.5

Release notes

Sourced from @​primevue/nuxt-module's releases.

PrimeVue 4.5.5

What's Changed

New Contributors

Full Changelog: primefaces/primevue@4.5.4...4.5.5

PrimeVue 4.5.4

Full Changelog: primefaces/primevue@4.5.3...4.5.4

PrimeVue 4.5.3

What's Changed

New Contributors

Full Changelog: primefaces/primevue@4.5.2...4.5.3

PrimeVue 4.5.2

Full Changelog: primefaces/primevue@4.5.1...4.5.2

PrimeVue 4.5.1

What's Changed

New Contributors

Full Changelog: primefaces/primevue@4.5.0...4.5.1

... (truncated)

Changelog

Sourced from @​primevue/nuxt-module's changelog.

4.5.5 (2026-04-08)

Full Changelog

Implemented New Features and Enhancements:

  • Timeline: use ordered list for Timeline component to improve accessibility #8155

Fixed bugs:

  • Tree: add filteredNodes to Tree filter event and forward filter event in TreeSelect #8525
  • PrimeIcons: Missing EXPAND key in PrimeIcons #8524
  • broken zIndex with global primevue zIndex undefined #8523
  • Galleria ZIndex Clear throws error when container is unmounted in fullscreen #8519
  • Splitter does not re-initialize when SplitterPanel :size prop changes reactively #8517
  • AutoComplete enter key behavior #8516
  • TieredMenu: popup menu does not reposition when triggered from different elements #8509
  • Select: option selection can run when overlay is already hidden #8508
  • Date column filters cannot take in strings to compare #8506
  • DataTable cannot handle sparse arrays #8503
  • Tooltip elements are not being removed from the DOM when hideDelay is active #8480
  • Splitter does not initialize panels added dynamically via v-if after mount #8477
  • Tab: TabPanel slot types missing scope when asChild is true #8470
  • DatePicker Range throws TypeError on days before 12/1/1969 #8469
  • DatePicker manual input fails when using custom AM/PM locale labels #8462
  • DataTable Column Filter Overlay requires double click to close after internal interaction #8460
  • Autocomplete's clear event not emitted when clicking the clear X button #8459
  • MultiSelect with optionValue object and display="chip" removes 2 chips instead of 1 #8456
  • DatePicker: externally updated modelValue can open with incorrect header year #8455
  • InputNumber: Cursor freezes after first digit when using currency="PYG" and locale="es-PY" #8453
  • DataTable/VirtualScroller: Table errors when virtual loading true and no loading slot provided #8451
  • DatePicker throws error when v-model is initialized with string value #8450
  • DatePicker: year-change event emits inconsistent month values depending on navigation method #8436
  • Select options still selectable after dropdown is hidden #8431
  • Select - Filter - Only able to type one character when Input is not focused #8427
  • FileUpload: TypeError on drag events when component unmounts #8424
  • FormField.d.ts exports duplicate FormEmits type colliding with Form #8420
  • TreeTable: missing types #8419
  • ScrollPanel: horizontal scroll bar goes outside the content div when scrollXRatio is too small #8415
  • Datepicker overlay loses focus capture when selecting different month or year #8402
  • InputOTP allows paste when readonly #8401
  • TieredMenu: hasSubmenu holds items (array) instead of boolean #8397
  • InputNumber allows paste input when disabled #8391
  • Splitter seperator role should be on gutter-handle not gutter #8381
  • Step and StepPanel not reactive after mount #8377
  • SpeedDial: MenuItem disabled not working at all #8375
  • TreeTable: TreeNode children are not sorted #8361
  • Tree: Expose dropPosition or relativePosition in node-drop event #8360
  • Tree Drag and Drop Does Not Prevent Dropping a Node Into Itself or Descendants #8353
  • Wrong step values in nested Stepper (Horizontal in Vertical) #8310

... (truncated)

Commits
  • 66dde67 chore: version 4.5.5 released
  • c74bd80 chore: version 4.5.4 released
  • 93fd6f0 chore: version 4.5.3 released
  • a5701a7 chore: add summary
  • d28757f chore: version 4.5.1 released
  • 0ce30cd chore: 4.5.0 summary updates
  • 4840092 fix: exclude BadgeDirective from style registration
  • 6245fb0 chore: release version 4.4.1
  • 4efb354 chore: version 4.4.0 released
  • 5fd3fb0 Released version 4.3.9
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) to 5.0.9 and updates ancestor dependencies [brace-expansion](https://github.com/juliangruber/brace-expansion), [nuxt](https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt) and [@primevue/nuxt-module](https://github.com/primefaces/primevue/tree/HEAD/packages/nuxt-module). These dependencies need to be updated together.


Updates `brace-expansion` from 2.0.3 to 5.0.9
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.0.3...v5.0.9)

Updates `nuxt` from 3.17.5 to 3.21.10
- [Release notes](https://github.com/nuxt/nuxt/releases)
- [Commits](https://github.com/nuxt/nuxt/commits/v3.21.10/packages/nuxt)

Updates `@primevue/nuxt-module` from 4.0.4 to 4.5.5
- [Release notes](https://github.com/primefaces/primevue/releases)
- [Changelog](https://github.com/primefaces/primevue/blob/master/CHANGELOG.md)
- [Commits](https://github.com/primefaces/primevue/commits/4.5.5/packages/nuxt-module)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 5.0.9
  dependency-type: indirect
- dependency-name: nuxt
  dependency-version: 3.21.10
  dependency-type: direct:production
- dependency-name: "@primevue/nuxt-module"
  dependency-version: 4.5.5
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants