Skip to content

build(deps): bump @nuxt/image from 2.1.0 to 2.2.1 - #129

Merged
GiulioTognetto merged 1 commit into
mainfrom
dependabot/bun/nuxt/image-2.2.1
Nov 2, 2026
Merged

GiulioTognetto merged 1 commit into
mainfrom
dependabot/bun/nuxt/image-2.2.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps @nuxt/image from 2.1.0 to 2.2.1.

Release notes

Sourced from @​nuxt/image's releases.

v2.2.1

v2.2.1 is a security release.

🚨 Security

This release fixes a vulnerability in the /_ipx image transformation route. ipx was affected by an integer overflow when decoding a multi-page image, so a crafted source image could corrupt memory in the server process with a single unauthenticated request (GHSA-qf89-6xm4-66wm; our advisory for the @nuxt/image side is GHSA-p5vf-pjf5-ggj3). Sites where an attacker cannot control any image source are not affected.

@nuxt/image now requires ipx ^4.1.0, which rejects oversized multi-page images with a 400 before decoding them. ipx is an optional dependency, so after upgrading run npm ls ipx to confirm a patched version resolves.

Behaviour change: /_ipx now only accepts common web image formats as input (JPEG, PNG, WebP, GIF, SVG, AVIF, HEIC) and responds 403 to anything else, before decoding it. If you transform other formats (for example TIFF), list them with the new image.ipx.allowedInputFormats option. For sources you do not fully trust, also consider image.ipx.restrictDecoders, which blocks the decoders of every other format for the whole process.

👉 Changelog

compare changes

🩹 Fixes

  • ipx: require patched ipx and restrict input formats for /_ipx route (GHSA-p5vf-pjf5-ggj3) (750a4f0)
  • ipx: use IPXFetchHandler so srvx/node is not required at runtime (#2336)
  • ipx: import NitroRuntimeConfig from nitropack/types (#2354)

🎉 New Contributors

❤️ Contributors

v2.2.0

v2.2.0 is the next minor release.

👉 Changelog

compare changes

🚀 Enhancements

  • deps: upgrade to released ipx v4 (#2352)
  • support nuxt v5 (#2281)

🩹 Fixes

  • use explicit imports in nitro v2 server runtime (#2347)
  • directus: remove deprecated sharpen option (#2294)

🏡 Chore

... (truncated)

Commits
  • 6e2e251 v2.2.1 (#2357)
  • 750a4f0 fix(ipx): require patched ipx and restrict input formats for /_ipx route (GHS...
  • f3e294c chore(deps): update nuxt framework to ^4.6.3 (#2367)
  • 3c8b6a1 chore(deps): update dependency @​nuxt/ui to ^4.12.0 (#2363)
  • a49b6ab chore(deps): update devdependency happy-dom to v21 [security] (#2364)
  • 33b4177 chore(deps): update all non-major dependencies (#2362)
  • 5bd8766 fix(ipx): use IPXFetchHandler so srvx/node is not required at runtime (#2336)
  • 8729b2e fix(ipx): import NitroRuntimeConfig from nitropack/types (#2354)
  • c0f6432 chore(deps): update nuxt framework to ^4.6.2 (#2351)
  • 5a39fd0 v2.2.0 (#2346)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [@nuxt/image](https://github.com/nuxt/image) from 2.1.0 to 2.2.1.
- [Release notes](https://github.com/nuxt/image/releases)
- [Changelog](https://github.com/nuxt/image/blob/main/CHANGELOG.md)
- [Commits](nuxt/image@v2.1.0...v2.2.1)

---
updated-dependencies:
- dependency-name: "@nuxt/image"
  dependency-version: 2.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 2, 2026
@GiulioTognetto
GiulioTognetto merged commit 5aa92db into main Nov 2, 2026
3 checks passed
@dependabot
dependabot Bot deleted the dependabot/bun/nuxt/image-2.2.1 branch November 2, 2026 19:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant