chore(deps): update dependency @nuxt/schema to 4.6.4

3.21.8 -> 4.6.4

v4.6.4

Compare Source

4.6.4 is a security release. It fixes eight advisories in Nuxt and pulls in nitropack 2.13.6, which fixes three more in Nitro. We recommend upgrading as soon as you can.

⚠️ Behaviour changes

These probably won't affect most apps, but it's worth flagging anyway:

1. Error details in production. When a page fails to render on the server, the error page and the payload now only carry message and data of errors you create with createError. Everything else is stripped.
2. Dev server Host checks. Webpack and rspack dev servers now reject requests with an unexpected Host header, as Vite already does. If you use a custom hostname or tunnel, you'll need to add it to the new devServer.allowedHosts option.
3. workspaceDir detection. When workspaceDir isn't set, Nuxt now only widens it past rootDir to an explicit workspace root or the closest git repository...

[View full release notes]

Released by github-actions[bot] on 11/2/2026

v4.6.3

Compare Source

v4.6.3 is the next patch release.

👉 Changelog

compare changes

🚨 Security fixes

• vite: do not read files named in client error reports (63299e13c) - GHSA-x287-wcfc-q46c
• vite: deny dev server access to nitro dev output (c7e204ec6) - GHSA-648h-gw55-m2g7
• vite: deny serving generated app secret in dev (16dfdc2a9) - GHSA-3xf4-9g3c-4h4w
• nitro,nuxt: handle dot segments in request paths (440250d97) - [GHSA-9v7c-q64q-vv33](https://github.com/nuxt/nuxt/security/advisories/GHSA-9v7c-q64q-vv3...

[View full release notes]

Released by github-actions[bot] on 10/27/2026

v4.6.2

Compare Source

v4.6.2 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes

• nitro: apply useHeadSafe rules to server island head (493565e99)
• nitro-server: read router params from the path h3 matched (010f6b43d)
• nitro: match server route rules case-insensitively unless routing is sensitive (f6cfee52c)
• nuxt: resolve rooted paths through the URL parser (#36617)
• nuxt: resolve empty route types in shared context (#36576)
• nitro: preserve server tsconfig with relocated build dir (#36494)
• nuxt: fix scroll offset for IDs starting with numbers (#36524)
• kit: do not exclude module directories with a dot in their name from app tsconfig (#36331)
• nuxt: detect vapor slots with rawVaporSlotKey from vue (#36614)
• **nuxt...

[View full release notes]

Released by github-actions[bot] on 10/16/2026