chore(deps): update dependency @nuxt/kit to 4.5.2

[github-actions]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@nuxt/kit (source)	3.21.8 -> 4.5.2

---

Release Notes

nuxt/nuxt (@nuxt/kit)

3.21.8 -> 4.5.2

v4.5.2

Compare Source

4.5.2 is the next patch release.

👉 Changelog

compare changes

🔥 Performance

• nuxt,kit: Skip rewriting unchanged generated files (#35902)
• kit,nuxt: Use lazy imports to improve parsing speed (#35901)
• vite: Skip html entry probes in bare-import resolver (#35907)
• nuxt: Reuse app and component scans for unchanged structures (#35912)

🩹 Fixes

• vite: Resolve client manifest path from resolved config (#35883)
• nuxt: Use client-side navigation for links inside islands (#35806)
• nuxt: Generate types for route params defined with definePageMeta (#35857)
• nuxt: Serialize island payloads for components with underscores in keys (#35807)
• nitro: Dedupe island renders when prerendering ([#35835](`nuxt...

[View full release notes]

Released by danielroe on 8/5/2026

v3.21.11

Compare Source

3.21.11 is a patch release.

[!IMPORTANT]
Nuxt v3 is now end-of-life. Please upgrade to Nuxt v4.

👉 Changelog

compare changes

🩹 Fixes

• nuxt: Serialize island payloads for components with underscores in keys (#35807)
• nitro: Dedupe island renders when prerendering (#35835)
• nitro: Reject non-object island props (#35867)
• nuxt: Re-check for preview mode after prerendered page hydration (#35886)
• nuxt: Settle asyncData status when bailing (#35908)
• kit: Clone resolved config with klona rather than klona/full (#35914)
• nuxt: Use client-side navigation for links inside islands (#35806)
• nuxt: Match route rules against decoded paths (81f86ac5e)

🏡 Chore

• Unpin `oxc-w...

[View full release notes]

Released by danielroe on 8/5/2026

v4.5.1

Compare Source

⚠️ This is a security release. We recommend upgrading as soon as possible with npx nuxt upgrade --dedupe.

It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, cross-user payload disclosure on cached pages, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.

If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.

If you use the cache, swr or isr route rules, purge any CDN or edge cache after upgrading; a leaked _payload.json may already be cached upstream.

Full details: Nuxt Security Patch Releases and [GitHub Security Advisories](https://github.com/nuxt/nu...

[View full release notes]

Released by danielroe on 7/27/2026

---

📊 Package Statistics

• @nuxt/kit: 6,861,734 weekly downloads

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Buddy 🤖