[Snyk] Security upgrade nuxt from 2.18.1 to 3.0.0#88
[Snyk] Security upgrade nuxt from 2.18.1 to 3.0.0#88rubybrowncoat wants to merge 1 commit intomasterfrom
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-DEVALUE-12205530
There was a problem hiding this comment.
Pull Request Overview
This PR upgrades Nuxt from version 2.18.1 to 3.0.0 to address a critical Prototype Pollution vulnerability (SNYK-JS-DEVALUE-12205530) with a score of 858.
- Major version upgrade from Nuxt 2.x to 3.x to fix security vulnerability
- Addresses critical Prototype Pollution issue in devalue dependency
- Breaking change upgrade requiring potential code migration
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
| "lodash-es": "^4.17.15", | ||
| "npm": "^6.11.3", | ||
| "nuxt": "^2.9.2", | ||
| "nuxt": "^3.0.0", |
There was a problem hiding this comment.
This is a major version upgrade from Nuxt 2.x to 3.x which introduces breaking changes. Nuxt 3 has significant architectural differences including Vue 3 composition API, new directory structure, different configuration format, and updated plugin system. The codebase will require substantial migration work to be compatible with Nuxt 3. Consider upgrading to the latest Nuxt 2.x version first (2.18.1) to address the security vulnerability while planning the migration to Nuxt 3.
| "nuxt": "^3.0.0", | |
| "nuxt": "^2.18.1", |
| "nuxt-clipboard2": "^0.2.1", | ||
| "nuxt-fontawesome": "^0.4.0", |
There was a problem hiding this comment.
The existing Nuxt 2 modules 'nuxt-clipboard2' and 'nuxt-fontawesome' are not compatible with Nuxt 3. These will need to be replaced with Nuxt 3 compatible alternatives or updated to compatible versions before the application will function properly.
Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
package.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-DEVALUE-12205530
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Prototype Pollution