Sourced from nuxt's releases.

v2.6.2

Fixes

• cli: Apply nuxt.config.js changes and watch for all imported files (#5500)
• cli: Fix problem for users that have tsconfig.json but do not use typescript (#5478)
• cli: Show memory usage after build for nuxt dev (#5514)
• server Fix bug with SPA mode with CSP enabled (#5474)
• vue-renderer: Use modulepreload for modern mode when using spa generate (#5489)
• webpack: Suggest using official @nuxtjs/style-resources package (#5499)
• Custom router.base support for banner url and loading screen (#5470) (Displaying loading resource path is not resolved router.base nuxt/loading-screen#8)

Security Fixes

• Prevent potential XSS vulnerabiliy when using vuex-router-sync (fix: escape unsafe key chars nuxt-contrib/devalue#8) (Potential XSS when using with SSR vuejs/vuex-router-sync#89)

Thanks to our awesome contributors to this release

• Damian Stasik (@​visualfanatic)
• Andreas Zoellner (@​zoellner)
• Vasyl Boroviak (@​koresar)

v2.6.0

Migration Guide

This version is addressing most of the problems of 2.5 and is without any breaking changes. For most of the users, a normal version upgrade would be enough. However, reading this guide can help to have a smooth upgrade.

General Tips

• Using yarn as the package manager is more preferred as Nuxt is internally being tested against yarn
• Before upgrade ensure to remove yarn.lock, package-lock.json and node_modules
• After full install and testing, also consider upgrading other dependencies. The yarn outdated command can be used.

Missing App Dependencies

Because of how package managers (yarn, npm) work, a wrong version of a dependency from one of the other dependencies may be hoisted into node_modules. Nuxt is strict about this and provides instructions for dependency resolution so please follow it.

The well-known problem is with firebase package that requires to manually install node-fetch dependency in your project.

Reverting breaking changes

We accidentially introduced a change that broke the prod build for many people who are using Nuxt programatically. This has been resolved through #5413. Sorry for the inconveniences!

Core-js

Since core-js@2 and core-js@3 are both supported from babel 7.4.0, Starting from 2.6 Nuxt supports both versions (#5411). It is highly advised to stick with 2 (default) unless having a special dependency that needs 3. (Instructions for core-js@2 are not required but recommended)

core-js@2

• yarn: yarn add -D core-js@2 @babel/runtime-corejs2
• npm: npm i -D core-js@2 @babel/runtime-corejs2

... (truncated)

• 6cee893 v2.6.2
• ff340ab v2.6.2 (#5523)
• 6823ea0 sync readme
• c0776eb v2.6.1
• 53915c5 fix: pin esm to 3.2.20 (#5464)
• f00a675 v2.6.0 (#5352)
• 0e51676 v2.6.0
• 737c4d0 chore(deps): update dependency rollup-plugin-commonjs to ^9.3.3 (#5459)
• 615351d chore(deps): update all non-major dependencies (#5458)
• 75e8a89 chore(deps): update all non-major dependencies (#5454)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.