chore(deps): update all non-major dependencies#98
chore(deps): update all non-major dependencies#98renovate[bot] wants to merge 7 commits intomainfrom
Conversation
renovate
bot
added
chore
dependencies
✅ Deploy Preview for wolfstar-rocks-et34281 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
from
c2b18b9 to
ad7a5a5
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
from
ad7a5a5 to
ebed7f2
Compare
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
There was a problem hiding this comment.
Pull request overview
This PR updates non-major npm dependencies (Nuxt SEO + OG image related packages, Takumi, Discord API types) and refreshes the locally vendored skilld reference docs under .claude/skills/ to match the new upstream versions.
Changes:
- Bumped runtime/dev dependencies in
package.json(notablynuxt-og-image,@takumi-rs/*,discord-api-types) and updatedpnpm-lock.yaml. - Refreshed
skilldlock + skill metadata for@nuxtjs/seo@5.1.0andnuxt-og-image@6.3.1. - Updated/added multiple
skilldreference docs (migration guides + guides) for the updated Nuxt SEO / OG Image versions.
Reviewed changes
Copilot reviewed 26 out of 27 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
pnpm-lock.yaml |
Lockfile updates reflecting bumped dependencies (including new transitive deps like React via Takumi). |
package.json |
Updates version pins for nuxt-og-image, @takumi-rs/*, and discord-api-types. |
.claude/skills/skilld-lock.yaml |
Updates skilld sync metadata and versions for Nuxt SEO / OG Image skills. |
.claude/skills/nuxtjs-seo-skilld/SKILL.md |
Updates skill header/version for @nuxtjs/seo@5.1.0. |
.claude/skills/nuxtjs-seo-skilld/references/docs/content/6.migration-guide/5.v4-to-v5.md |
Expands migration documentation for Nuxt SEO v4 → v5 (Nuxt Content v3 collections + sitemap changes). |
.claude/skills/nuxtjs-seo-skilld/references/docs/content/6.migration-guide/3.nuxt-seo-kit.md |
Adds/adjusts migration notes (key takeaways + clarified breaking changes). |
.claude/skills/nuxtjs-seo-skilld/references/docs/content/6.migration-guide/1.beta-to-rc.md |
Small wording tweak in migration guide. |
.claude/skills/nuxtjs-seo-skilld/references/docs/content/6.migration-guide/0.rc-to-stable.md |
Adds key takeaways + warnings and clarifies guidance. |
.claude/skills/nuxtjs-seo-skilld/references/docs/content/2.guides/7.updating-modules.md |
New guide content about updating Nuxt SEO modules. |
.claude/skills/nuxtjs-seo-skilld/references/docs/content/2.guides/6.debugging-modules.md |
New guide content for disabling modules + reproductions. |
.claude/skills/nuxtjs-seo-skilld/references/docs/content/2.guides/5.site-config.md |
New guide explaining Site Config usage. |
.claude/skills/nuxtjs-seo-skilld/references/docs/content/2.guides/4.llms-txt.md |
New guide documenting llms.txt routes and usage in AI tools. |
.claude/skills/nuxtjs-seo-skilld/references/docs/content/2.guides/3.mcp.md |
New guide documenting Nuxt SEO MCP server setup + tool list. |
.claude/skills/nuxtjs-seo-skilld/references/docs/content/2.guides/0.using-the-modules.md |
Updates module overview copy and adds related links. |
.claude/skills/nuxtjs-seo-skilld/references/docs/content/1.getting-started/3.troubleshooting.md |
Updates troubleshooting content structure and adds new sections/warnings. |
.claude/skills/nuxtjs-seo-skilld/references/docs/content/1.getting-started/1.installation.md |
Updates installation doc (standalone modules section + related pages). |
.claude/skills/nuxtjs-seo-skilld/references/docs/content/1.getting-started/0.introduction.md |
Major rewrite of Nuxt SEO introduction content and module dependency examples. |
.claude/skills/nuxtjs-seo-skilld/references/docs/_INDEX.md |
Regenerated docs index for Nuxt SEO references (currently has incorrect titles/labels). |
.claude/skills/nuxtjs-seo-skilld/PROMPT_best-practices.md |
Updates prompt to v5.1.0 (currently contains a malformed markdown link). |
.claude/skills/nuxtjs-seo-skilld/PROMPT_api-changes.md |
Updates prompt to v5.1.0 (currently contains a malformed markdown link). |
.claude/skills/nuxt-og-image-skilld/SKILL.md |
Updates skill header/version for nuxt-og-image@6.3.1. |
.claude/skills/nuxt-og-image-skilld/references/docs/content/4.api/3.config.md |
Adds docs for URL signing/strict mode config and env var usage. |
.claude/skills/nuxt-og-image-skilld/references/docs/content/4.api/0.define-og-image.md |
Adds docs for new options (url, cacheKey, takumi) and deprecations (html). |
.claude/skills/nuxt-og-image-skilld/references/docs/content/3.guides/13.security.md |
Expanded security guidance (URL signing + strict mode + DoS concerns). |
.claude/skills/nuxt-og-image-skilld/references/docs/_INDEX.md |
Updates OG Image docs index summaries. |
.claude/skills/nuxt-og-image-skilld/PROMPT_best-practices.md |
Updates prompt to v6.3.1 (currently contains a malformed markdown link). |
.claude/skills/nuxt-og-image-skilld/PROMPT_api-changes.md |
Updates prompt to v6.3.1 (currently contains a malformed markdown link). |
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
|
✅ Contribution guidelines check passed. This automated dependency update PR meets all contribution requirements:
The
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Dependency update review
This is a clean Renovate batch update. Here's a summary of what changed and what's worth knowing.
CI status
| Check | Status |
|---|---|
| 🔠 Lint | ✅ Passed |
| 🧪 Unit tests | ✅ Passed |
| 🧪 Component tests | ✅ Passed |
| 🧹 Unused code | ✅ Passed |
| 🛡️ GitGuardian | ✅ Passed |
| 🖥️ Browser tests | ⏳ In progress |
| ♿ Accessibility (light/dark) | ⏳ In progress |
| ⚡ Benchmarks | ⏳ In progress |
Core quality gates are green; the remaining checks were still running at review time.
Notable changes
nuxt-og-image 6.2.6 → 6.3.1 — security opportunity
6.3.0 introduced URL signing to prevent unauthenticated callers from crafting arbitrary image generation requests to /_og/d/ and exhausting server CPU/memory. The existing config (maxQueryParamSize: 2048) is still valid, but the new opt-in hardening is worth considering:
// nuxt.config.ts
ogImage: {
security: {
strict: true, // requires NUXT_OG_IMAGE_SECRET to be set
}
}Generate a secret with npx nuxt-og-image generate-secret and add NUXT_OG_IMAGE_SECRET=<value> to your production environment. This isn't a breaking change — everything works as-is — but it would close the DoS vector on the runtime OG endpoint if you're not prerendering all OG images.
@takumi-rs/* beta.20 → rc.9 — new react transitive dependency
The rc channel now lists react@19.2.4 as a runtime dep of @takumi-rs/helpers (used server-side for OG template rendering). This is reflected in pnpm-lock.yaml — react is now present in the install. This appears intentional (React is used as the server-side rendering engine for Takumi OG templates), but it does add a new runtime package to the graph. No action needed, just worth being aware of.
@nuxtjs/seo 5.0.2 → 5.1.0
Minor feature bump (skew protection, AI-ready standalone). No config changes needed.
discord-api-types ^0.38.41 → ^0.38.42
Resolves to 0.38.43 in the lock file; contains nullability corrections and new fields. No breaking changes expected.
No blocking issues found. Merge once the remaining CI checks complete.
Generated by WolfStar Code Quality Reviewer for issue #98
There was a problem hiding this comment.
CI is failing — blocking issue found
All CI jobs are red due to a single root cause introduced by this PR.
🚨 Root cause: nuxt-og-image v6.3.0 breaking change
The upgrade of nuxt-og-image from v6.2.6 → v6.3.1 introduced security.strict mode. This PR correctly updates nuxt.config.ts to enable strict: true, but strict mode requires a signing secret (NUXT_OG_IMAGE_SECRET). Without it, nuxt prepare throws a fatal error during the postinstall hook, causing every job that runs vp install to fail:
[error] [nuxt-og-image] `security.strict` requires a signing secret.
Generate one with: npx nuxt-og-image generate-secret
✅ Fix checklist
- Run
npx nuxt-og-image generate-secretand store the output as a repository/environment secret namedNUXT_OG_IMAGE_SECRET - Add
NUXT_OG_IMAGE_SECRETto CI secrets (used bynuxt prepareduring install) - Add
NUXT_OG_IMAGE_SECRETto production deployment environment
CI summary
| Check | Status |
|---|---|
| 🔠 Lint | ✅ Passed |
| 🛡️ GitGuardian | ✅ Passed |
| 🧪 Unit tests | ❌ Failed (install error) |
| 🧪 Component tests | ❌ Failed (install error) |
| 🖥️ Browser tests | ❌ Failed (install error) |
| ⚡ Benchmarks | ❌ Failed (install error) |
| ♿ Accessibility (light/dark) | ❌ Failed (install error) |
| 🧹 Unused code | ❌ Failed (install error) |
| Netlify deploy | ❌ Failed (build error) |
Once NUXT_OG_IMAGE_SECRET is in place, all jobs should recover. The dependency updates themselves (discord-api-types, @nuxtjs/seo, @takumi-rs) and the skill doc updates look fine.
Generated by WolfStar Code Quality Reviewer for issue #98
| @@ -372,7 +372,7 @@ export default defineNuxtConfig({ | |||
|
|
|||
| ogImage: { | |||
| security: { | |||
There was a problem hiding this comment.
🚨 Blocking: strict: true requires a signing secret
nuxt-og-image v6.3.0 introduced security.strict mode. When strict: true, the module requires a signing secret to be configured, and will throw a fatal error during nuxt prepare if it is missing:
[error] [nuxt-og-image] `security.strict` requires a signing secret.
Generate one with: npx nuxt-og-image generate-secret
This is exactly why all CI jobs are failing — the postinstall step runs nuxt prepare, which aborts with this error.
To fix, you need to:
- Generate a secret:
npx nuxt-og-image generate-secret
- Add
NUXT_OG_IMAGE_SECRETto your environment (CI secrets + production deployment).
Alternatively, if strict mode is not yet intended here, revert to the previous explicit options:
ogImage: {
security: {
maxQueryParamSize: 2048,
restrictRuntimeImagesToOrigin: true,
},
},Note: the new strict: true flag is a good security improvement (URL signing, SSRF protection), so enabling it with the proper secret is the recommended path going forward.
There was a problem hiding this comment.
Review: Dependency updates look good — one blocking CI issue
The package upgrades are straightforward and the Renovate confidence ratings are reasonable. The intentional config change (nuxt-og-image strict mode) is a positive security improvement, but it has introduced a missing runtime-environment requirement that breaks CI.
✅ What's good
- All five packages are minor/patch upgrades.
- Enabling
security.strict: true(URL-parameter signing) is a correct and desirable response to the newnuxt-og-image6.3.0 security feature. .env.exampleis correctly updated withNUXT_OG_IMAGE_SECRET=.- Skill reference docs in
.claude/skills/are in sync with the new versions. 🔠 Lint projectpasses.
❌ Blocking issue
All CI jobs fail at install time because nuxt prepare (run during postinstall) throws:
[nuxt-og-image] `security.strict` requires a signing secret.
NUXT_OG_IMAGE_SECRET must be available in the environment when vp install runs. It is not currently set in any CI job or in the Netlify deploy environment.
Required before merge
- Generate a secret:
npx nuxt-og-image generate-secret - Add it as a repository secret (
NUXT_OG_IMAGE_SECRET) - Expose it in
.github/workflows/continuous-integration.yml(e.g., top-levelenv: NUXT_OG_IMAGE_SECRET: $\{\{ secrets.NUXT_OG_IMAGE_SECRET }}) - Add the same secret to the Netlify project environment variables
See the inline comment on nuxt.config.ts:375 for details.
Generated by WolfStar Code Quality Reviewer for issue #98
There was a problem hiding this comment.
CI is fully broken — 6 of 7 jobs fail 🔴
All jobs except 🔠 Lint are failing. The root cause is the nuxt-og-image 6.2.6 → 6.3.1 bump: v6.3.0 introduced security.strict mode which throws a hard error if NUXT_OG_IMAGE_SECRET is not present during nuxt prepare (i.e. at install/postinstall time, not just at runtime).
[nuxt-og-image] `security.strict` requires a signing secret.
Generate one with: npx nuxt-og-image generate-secret
The PR correctly adds NUXT_OG_IMAGE_SECRET to build and test steps — but setup-vp (with cache: true) internally runs vp install, which triggers the postinstall script (nuxt prepare), before those steps ever execute. Lint passes only because it uses run-install: false.
What must be fixed
- Add
NUXT_OG_IMAGE_SECRET: ci-test-og-image-secret-at-least-32-characters-longas a job-levelenv(or to thesetup-vpstep'senv) in every job that usessetup-vpwithcache: true:unit(env var currently absent from the entire job)test/ component tests (env var currently absent)browser(env var present on build/test steps only — not install)benchmark(env var currently absent)a11y(env var present on build/test steps only — not install)knip(env var currently absent)
See the inline comment for a concrete example.
Everything else looks correct ✅
- Enabling
security.strict: trueinnuxt.config.tsis the right upgrade path frommaxQueryParamSize. NUXT_OG_IMAGE_SECRET=added to.env.exampleis correct.discord-api-types^0.38.42bump is a patch/minor with bug-fix nullability corrections — low risk.@nuxtjs/seo5.0.2 → 5.1.0adds skew-protection features — no breaking changes.@takumi-rs/coreand@takumi-rs/wasmjump frombeta.20 → rc.9is notable, but these are dev/OG-image deps; once CI is green the build will validate them.
Once the install-step env vars are in place, this PR should merge cleanly.
Generated by WolfStar Code Quality Reviewer for issue #98
| NODE_OPTIONS: --max-old-space-size=4096 | ||
| NUXT_PUBLIC_SITE_URL: https://wolfstar.rocks | ||
| NUXT_SESSION_PASSWORD: ci-test-session-password-at-least-32-characters-long | ||
| NUXT_OG_IMAGE_SECRET: ci-test-og-image-secret-at-least-32-characters-long |
There was a problem hiding this comment.
Root cause of all CI failures is here (and in the other missing jobs below).
nuxt-og-image 6.3.0 added security.strict mode which validates the signing secret during nuxt prepare, not just at runtime. nuxt prepare runs as part of the postinstall script (stale-dep -u && nuxt prepare && vp config), which is triggered by vp install inside the setup-vp action (when cache: true).
NUXT_OG_IMAGE_SECRET is correctly added to the build and test steps here, but those steps run after installation has already failed.
Affected jobs that need the fix:
browser— needsNUXT_OG_IMAGE_SECRETon thesetup-vpstep (or as a job-levelenv)unit— env var is absent entirely from this jobtest(component tests) — env var is absent entirely from this jobbenchmark— env var is absent entirely from this jobknip— env var is absent entirely from this joba11y— needsNUXT_OG_IMAGE_SECRETon thesetup-vpstep (or as job-levelenv)
The cleanest fix is to add a job-level env block to each affected job, e.g.:
unit:
name: 🧪 Unit tests
runs-on: ubuntu-24.04-arm
env:
NUXT_OG_IMAGE_SECRET: ci-test-og-image-secret-at-least-32-characters-longThis ensures the secret is available for every step including setup-vp → vp install → postinstall → nuxt prepare.
This PR contains the following updates:
5.0.2→5.1.01.0.0-beta.20→1.0.0-rc.91.0.0-beta.20→1.0.0-rc.9^0.38.41→^0.38.426.2.6→6.3.1Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
harlan-zw/nuxt-seo (@nuxtjs/seo)
v5.1.0Compare Source
🚀 Features
View changes on GitHub
kane50613/takumi (@takumi-rs/core)
v1.0.0-rc.9Compare Source
Patch Changes
v1.0.0-rc.8Compare Source
Patch Changes
v1.0.0-rc.7Compare Source
Patch Changes
v1.0.0-rc.6Compare Source
Patch Changes
v1.0.0-rc.5Compare Source
Patch Changes
v1.0.0-rc.4Compare Source
Patch Changes
7ff886b]7ff886b]v1.0.0-rc.3Compare Source
Patch Changes
532bc96: Fix bun compile fails to resolve native module #606v1.0.0-rc.2Compare Source
Patch Changes
26b5557: Fix dist folder not includedv1.0.0-rc.1Compare Source
Patch Changes
v1.0.0-rc.0Compare Source
discordjs/discord-api-types (discord-api-types)
v0.38.43Compare Source
Bug Fixes
Features
Unsetbase theme type (#1577) (e65e02f)50278(#1587) (662cb0c)nuxt-modules/og-image (nuxt-og-image)
v6.3.1Compare Source
🐞 Bug Fixes
View changes on GitHub
v6.3.0Compare Source
🚀 Features
🐞 Bug Fixes
html- by @harlan-zw in #545 (25c05)View changes on GitHub
Configuration
📅 Schedule: Branch creation - "on Monday" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.