⬆️ Bump nuxt from 2.4.3 to 2.6.3

[dependabot-preview]

Bumps nuxt from 2.4.3 to 2.6.3.

Release notes

Sourced from nuxt's releases.

v2.6.3

Fixes

• cli: Watch and reload nuxt.config (#5574)
• utils: serialize inline functions (#5051) (#5580)
• vue-app: Fix context req and res types (#5560)
• webpack: Fix production font preloading (#5436)
• Don't customize esm options (91c3642e64166a939683b856e5b34ef42d12bb0e)

Dependency Upgrades

• Update webpackbar to ^3.2.0
• Update vue-router to ^3.0.6
• Update @nuxt/loading-screen to ^0.5.0

v2.6.2

Fixes

• cli: Apply nuxt.config.js changes and watch for all imported files (#5500)
• cli: Fix problem for users that have tsconfig.json but do not use typescript (#5478)
• cli: Show memory usage after build for nuxt dev (#5514)
• server Fix bug with SPA mode with CSP enabled (#5474)
• vue-renderer: Use modulepreload for modern mode when using spa generate (#5489)
• webpack: Suggest using official @nuxtjs/style-resources package (#5499)
• Custom router.base support for banner url and loading screen (#5470) (Displaying loading resource path is not resolved router.base nuxt/loading-screen#8)

Security Fixes

• Prevent potential XSS vulnerabiliy when using vuex-router-sync (fix: escape unsafe key chars nuxt-contrib/devalue#8) (Potential XSS when using with SSR vuejs/vuex-router-sync#89)

Thanks to our awesome contributors to this release

• Damian Stasik (@​visualfanatic)
• Andreas Zoellner (@​zoellner)
• Vasyl Boroviak (@​koresar)

v2.6.0

Migration Guide

This version is addressing most of the problems of 2.5 and is without any breaking changes. For most of the users, a normal version upgrade would be enough. However, reading this guide can help to have a smooth upgrade.

General Tips

• Using yarn as the package manager is more preferred as Nuxt is internally being tested against yarn
• Before upgrade ensure to remove yarn.lock, package-lock.json and node_modules
• After full install and testing, also consider upgrading other dependencies. The yarn outdated command can be used.

Missing App Dependencies

Because of how package managers (yarn, npm) work, a wrong version of a dependency from one of the other dependencies may be hoisted into node_modules. Nuxt is strict about this and provides instructions for dependency resolution so please follow it.

... (truncated)

Commits

• 2108cd6 v2.6.3
• 8d14cd4 Merge branch 'dev' into 2.x
• 0849684 sync readme
• afd8a40 v2.6.2
• 6cee893 v2.6.2
• ff340ab v2.6.2 (#5523)
• 1309a52 chore(deps): lock file maintenance (#5534)
• 6927f6d add external authors to the release notes
• 6db8ec9 chore(deps): update all non-major dependencies (#5533)
• 0d5dfe7 chore(deps): update all non-major dependencies (#5529)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in the .dependabot/config.yml file in this repo:

• Update frequency (including time of day and day of week)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.

[dependabot-preview]

Superseded by #22.