chore(nuxt): Update [DEV] minor & patch dependencies to ^4.4.8

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
nuxt (source)	^4.4.4 → ^4.4.8

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

nuxt/nuxt (nuxt)

v4.4.8

Compare Source

4.4.8 is a hotfix release to address an issue running the dev server on MacOS.

👉 Changelog

compare changes

🩹 Fixes

• vite: Shorter socket name for macOs with tmp fallback (#​35265)
• kit: Respect type option in findPath (#​35272)
• deps: Update nuxt/scripts presets (905621594)
• nuxt: Revert unhead dependency back to v2 (e6d578fea)

📖 Documentation

• Fix many typos (#​35266)
• Explain static fallback pages (#​35277)
• Change null to undefined in data-fetching docs to match actual types (#​35301)
• Fix broken internal links, useAsyncData watch type, and NuxtError type (#​35303)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Ali Mahmmoud (@​AliMahmoudDev)
• Quentin Macq (@​quentinmcq)
• Pranav Rajeshirke (@​Pranav188)
• Eduardo San Martin Morote (@​posva)

v4.4.7

Compare Source

4.4.7 is a security hotfix release.

👉 make sure to check https://github.com/nuxt/nuxt/security/advisories to view open advisories resolved by this release.

👉 Changelog

compare changes

🩹 Fixes

• nitro: Assign noSSR before deciding payload extraction (#​35108)
• vite: Avoid filtering out dirs with shared prefix from allowDirs (#​35112)
• nuxt: Use resolve from pathe for buildCache path boundary check (#​35111)
• nuxt: Prevent sibling-directory traversal in test component wrapper (#​35110)
• nitro: Pass event data to isValid in dev clipboard-copy listener (#​35109)
• nuxt: Validate protocols in reloadNuxtApp path before reload (#​35115)
• vite: Prefix public asset virtuals with null byte (9e303b438)
• nuxt: Re-run getCachedData after initial fetch (#​35122)
• nuxt: Propagate useFetch/useAsyncData factory types (#​35133)
• vite: Close vite dev server on nuxt close (a10a68abc)
• kit,nuxt: Handle cancelling prompts to install packages (e84813229)
• kit: Avoid excluding node-context files in legacy tsconfig (#​35152)
• nuxt: Handle missing payload in chunkError listener (#​35155)
• nuxt: Await in-lifght template generation when closing nuxt (#​35181)
• nuxt: Clarify page and layout usage warnings (#​35184)
• webpack: Surface compilation errors when stats.toString is empty (073b07851)
• nuxt: Reject prototype-chain keys in the island registry (#​35205)
• nuxt: Apply isScriptProtocol guard to navigateTo open option (#​35206)
• nuxt: Prevent server-only page island from recursing via <NuxtPage> (#​35198)
• rspack,webpack: Require loopback host when missing same-origin signals (#​35200)
• nitro: Gate chrome devtools workspace endpoint to local requests (#​35201)
• nuxt: Escape props in <NuxtClientFallback> ssr output (#​35199)
• kit: Improve TS extension stripping/substitutions (#​35233)
• nuxt: Preserve .d.mts/.d.cts in resolveTypePaths (#​35235)
• nuxt: Escape <NoScript> slot content (4b054e9d9)
• nuxt: Match route rules case-insensitively to mirror vue-router (07e39cd6f)
• nuxt: Reject script-capable protocols in <NuxtLink> href (0103ce06f)
• nuxt: Block path-normalization open redirect in navigateTo (2cce6fb02)
• nuxt: Reject cross-origin paths in reloadNuxtApp (e447a793c)
• vite: Bind vite-node IPC to a permissioned filesystem socket (1f9f4767a)

💅 Refactors

• kit,nuxt,vite: Use es2023 array methods (#​34980)
• nuxt: Replace runInNewContext with AST walker (d72a89ef4)

📖 Documentation

• Document vite client and server options (#​35090)
• Add dedicated module dependencies page (#​35171)
• Add nodeTsConfig and sharedTsConfig options (#​35231)
• Edit for clarity and grammar (#​35214)

🏡 Chore

• Use execFileSync for safety in release scripts (1d7baaf01)
• Assert there is always a tag (e98c47c3c)
• Add autofix action tag in comment (ffa5c0098)
• Fix type in test (a549652e2)
• Update renovate minimum release age (d12d5e58a)
• Fix lychee dynamic composable exclude (#​35119)
• Update lockfile (91186dc51)
• Lint (dbc58965c)

✅ Tests

• Update test for js payload rendering (bdcb81536)
• Cover add regression test for hmr in sibling local layers (#​35125)
• Improve reliability of hmr test (1d709b3cc)

🤖 CI

• Always run all tests for 4.x/3.x (0dc4665cf)
• Migrate from tibdex (ded29dc0f)
• Add zizmor github actions check (#​35089)
• Update to agentscan v1.8.0 (#​35120)
• Automatically close PRs from automated accounts (#​35161)
• Disable provenance-change enforcement in dependency-review (a2cf43e68)

❤️ Contributors

• Daniel Roe (@​danielroe)
• David Stack (@​davidstackio)
• David De Sloovere (@​DavidDeSloovere)
• anton-gor-dev (@​anton-gor-dev)
• Noah3521 (@​Noah3521)
• Shahar Aviram (@​ShaharAviram1)
• Matej Černý (@​cernymatej)
• Mohit Kumar (@​mohitkum4r)
• Matteo Gabriele (@​MatteoGabriele)
• Julien Huang (@​huang-julien)
• Damian Głowala (@​DamianGlowala)

---

Configuration

📅 Schedule: (in timezone GMT)

• Branch creation
  • "before 7am on the first day of the week"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Jun 26, 2026 2:59pm
swingset	Ready	Preview, Comment	Jun 26, 2026 2:59pm

[changeset-bot]

⚠️ No Changeset found

Latest commit: 846acd7

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8575

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8575

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8575

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8575

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@8575

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@8575

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@8575

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8575

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8575

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8575

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8575

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8575

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8575

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8575

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8575

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8575

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8575

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8575

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8575

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8575

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8575

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8575

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8575

commit: 846acd7

[github-actions]

API Changes Report

Generated by Break Check on 2026-06-07T01:20:18.460Z

Summary

Metric	Count
Packages analyzed	19
Packages with changes	1
🔴 Breaking changes	0
🟡 Non-breaking changes	1
🟢 Additions	0

🤖 This report was reviewed by claude-sonnet-4-6.

Note
Break Check could not snapshot 3 subpaths; the diff below excludes them.

• @clerk/astro ./env: Internal Error: Unable to determine module for: /home/runner/_work/javascript/javascript/packages/astro/env.d.ts You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
• @clerk/shared ./cookie: Internal Error: Unable to follow symbol for "Cookies" You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.
• @clerk/testing ./cypress: Symbol not found for identifier: Cypress

---

@clerk/shared

Current version: 4.15.0
Recommended bump: MINOR → 4.16.0

Subpath ./apiUrlFromPublishableKey

🟡 Non-breaking Changes (1)

Modified: apiUrlFromPublishableKey

- apiUrlFromPublishableKey: (publishableKey: string) => "https://api.clerk.com" | "https://api.lclclerk.com" | "https://api.clerkstage.dev"
+ apiUrlFromPublishableKey: (publishableKey: string) => "https://api.lclclerk.com" | "https://api.clerkstage.dev" | "https://api.clerk.com"

Static analyzer: Breaking change in function apiUrlFromPublishableKey: Return type changed: "https://api.clerk.com"|"https://api.lclclerk.com"|"https://api.clerkstage.dev" → "https://api.lclclerk.com"|"https://api.clerkstage.dev"|"https://api.clerk.com"

🤖 AI review (reclassified as non-breaking) (99%): The return type is a union of the exact same three string literal members; reordering union members is structurally identical in TypeScript and has no effect on well-typed consumers.

---

Report generated by Break Check

_{Last ran on 0c07ea5. Pushes that change no tracked declarations (no API surface change vs. base) are skipped and don't update this comment.}

[github-actions]

API Changes Report

Generated by Break Check on 2026-06-26T14:59:47.245Z

Summary

Metric	Count
Packages analyzed	19
Packages with changes	0
🔴 Breaking changes	0
🟡 Non-breaking changes	0
🟢 Additions	0

No API Changes Detected

All packages have stable APIs with no detected changes.

---

Report generated by Break Check

_{Last ran on 846acd7.}

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.