Repository navigation
feat!: require Nuxt 4.6 and run the server code on nuxt/server - #92
Merged
Merged
Conversation
Parity: convex 1.46.0 → 1.47.0. Nothing to port. No commits touch the mapped entry points, src/browser/sync, src/browser/http_client.ts or src/common, and the published dist for react, nextjs, react-clerk, react-auth0 and browser is byte-identical. The exports map and the peer dependencies are unchanged. @convex-dev/better-auth and @convex-dev/polar have no new releases. Nuxt: the repository and the website move from 4.5 to 4.6.2 (catalog, @nuxt/schema, docus 5.15, @nuxt/content 3.16.2, @nuxt/fonts 1, devtools 3.4.4, test-utils 4.3.4). cssnano 9.9.0 passes the trust policy, so no exclusions are needed. The Dependabot holds on nuxt, @nuxt/kit and @nuxt/schema are gone. The module's floor and its @nuxt/kit dependency range stay where they were. addServerPlugin stays too, because addNitroPlugin only exists from kit 4.6. The website now lists @nuxt/ui, which it imports through #ui. Description: README and the site's SEO default take the wording the nuxt.com registry entry uses. Process: - pnpm parity:diff <tier> [to] [from] diffs an upstream release over the mapped and re-implemented paths. Those paths now include src/common and http_client for convex, and the plugin clients for better-auth. - The ported upstreams get their own Dependabot group. - Scheduled CI failures go to the weekly drift issue. - The skill gains a Job 4 for Nuxt minors and drops its stale gate copies, commit type and SHAs. - Links follow Convex's org rename (get-convex → convex). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
nuxt.com parses a README into a tree, so the opening <div align="center"> became an empty element and nothing was centred. Each top block now carries align="center" itself, and the hero sits in a link so it centres too. The separator images rendered as blocks there, one per line; they are gone. nuxt.com trims whitespace at text edges inside HTML blocks, so the link-row dots live inside the links. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Listing @nuxt/ui in website/package.json makes docus 5.15's own OgImage component fail `nuxt typecheck` (TS2731), which turned CI's website job red. fallow flags the `#ui` alias imports as an unlisted dependency on Nuxt 4.6, so it is ignored there with the reason instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
nuxt.com is dark by default, but a <picture> picks its source by the OS theme, so most visitors saw the dark-ink wordmark on a dark page; npm keeps the <picture> too and is always white. hero.svg uses one slate grey with the same contrast on white and on near-black (4.3:1), so it needs no theme switch. nuxt.com now renders READMEs with comark 0.8.1, which keeps spaces inside a line but drops line breaks. Every header row is one line, the badge groups are split by a raised bullet that centres on the badges on GitHub and nuxt.com, and a test keeps prose paragraphs on one line. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Better Auth component's docs moved from convex-better-auth.netlify.app to labs.convex.dev/better-auth, which failed the weekly link check. OSV's remaining finding, node-forge GHSA-86w9-cpqp-85rv, has no patched release and only reaches the dev server's certificate generation, so it is ignored until 2027-01-31 with the reason. The braces advisory was withdrawn, and the simple-git ones go with @nuxt/devtools 3.4.4. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The module's server code now uses Nuxt 4.6's portable `nuxt/server` API, so one implementation runs on nitropack 2, on Nitro 3 (Nuxt 5) and on other server builders, and `h3` is no longer a dependency. - Better Auth proxy: a `nuxt/server` handler. The method allow-list and the traversal guard stay; the guard now refuses any `.`/`..` segment (encoded or not) in the part of the path the route matched, since `nuxt/server` exposes only the normalised URL. A new e2e test sends raw traversal paths to a real build. - `convexAuth(event)` accepts the `nuxt/server` event (`req`) or the h3 event Nuxt 4 routes and `useRequestEvent()` still pass (`headers`), typed as the new public `ConvexAuthEvent`. `handler()` needs the former and says so. - The SSR plugin sets `Cache-Control` through `useResponseHeader`. - The nuxt-security CSP plugin reads runtime config from `nuxt/server` and is registered for both Nitro majors with `addNitroPlugin`. - The DevTools panel is served by a portable dev handler instead of h3's `serveStatic`; checked in `nuxt dev` against the built package. - `@nuxt/kit` ^4.6.2; the h3 Dependabot hold goes with the dependency. BREAKING CHANGE: Nuxt >= 4.6.0 is required (was >= 4.1.0). Apps on 4.1-4.5 can update Nuxt within 4.x, which needs no code changes, or stay on 0.11. `convexAuth`'s parameter type is `ConvexAuthEvent` instead of h3's `H3Event`; existing calls keep working. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 47 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…check From CodeRabbit's review: `* item`, `+ item` and numbered items read as prose and could fail valid formatting, and a continuation line that starts with inline code was skipped. One pattern now names the lines that are blocks of their own; everything else is paragraph text. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
commit: |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #92 +/- ##
==========================================
- Coverage 90.09% 89.66% -0.43%
==========================================
Files 52 52
Lines 1757 1771 +14
Branches 438 448 +10
==========================================
+ Hits 1583 1588 +5
- Misses 79 82 +3
- Partials 95 101 +6 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
slavarazum
added a commit
that referenced
this pull request
Oct 23, 2026
#88's integrations app now matches this branch: its declared ranges are the narrowed peer ranges, Nuxt ^4.6.2, and <CheckoutLink> gets the polarApi it now requires (a placeholder reference; nothing calls it during SSR). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merged
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of 0.12.0. Stacked on #87: review after it, and I'll rebase onto
mainonce #87 is squash-merged.What changes
The module's server code now uses Nuxt 4.6's portable
nuxt/server. One implementation runs on nitropack 2, on Nitro 3 (Nuxt 5) and on other server builders, andh3is no longer a dependency.@nuxt/kitmoves to^4.6.2.assertMethod,toWebRequest, raw-path vs normalised-path comparenuxt/serverhandler. Method allow-list kept. The traversal guard refuses any./..segment (encoded or not) in the routed**match, becausenuxt/serveronly exposes the normalised URLconvexAuth(event)H3Event+ h3getRequestHeaders/toWebRequestnuxt/serverevent (req) or the h3 event Nuxt 4 routes anduseRequestEvent()pass (headers). The new public type isConvexAuthEvent.handler()needs the former and throws a documented error otherwiseCache-ControlsetResponseHeaderuseResponseHeaderfrom#app, captured before the firstawaitaddServerPlugin(deprecated in kit 4.6)addNitroPlugin({ nitro2, nitro3 }): the same file, which imports onlynuxt/serverserveStaticpushed intodevServerHandlersaddDevServerHandler({ nuxt }), serving files asRequest→ResponseStill on
#imports:src/runtime/nuxt/config.tsreads runtime config through#imports. App and server code share it, and Nuxt forbidsnuxt/serverin app code. It works on every Nuxt 4 build; it's noted as the one item to check on Nuxt 5.Breaking
>=4.6.0(was>=4.1.0). Moving within Nuxt 4.x needs no code changes; apps that can't move stay on 0.11.convexAuth's parameter type isConvexAuthEventinstead of h3'sH3Event. Existing calls keep working.Verification
pnpm dev:prepare,lint,test:types,test(1232 passed),test:quality,test:security.pnpm test:e2e: 13 passed. A new case sends raw../and%2e%2epaths to the built Better Auth fixture and expects 400 with nothing forwarded. It fails when the guard is removed (checked)./and a docs page return 200.nuxt devagainst the built package:no-store;POSTreturns 405;..%2f) returns 404.🤖 Generated with Claude Code