[dependabot]

Bumps the minor-and-patch group with 3 updates in the / directory: @nuxt/image, @takumi-rs/core and vue-tsc.

Updates @nuxt/image from 2.2.0 to 2.2.1

Release notes

Sourced from @​nuxt/image's releases.

v2.2.1

v2.2.1 is a security release.

🚨 Security

This release fixes a vulnerability in the /_ipx image transformation route. ipx was affected by an integer overflow when decoding a multi-page image, so a crafted source image could corrupt memory in the server process with a single unauthenticated request (GHSA-qf89-6xm4-66wm; our advisory for the @nuxt/image side is GHSA-p5vf-pjf5-ggj3). Sites where an attacker cannot control any image source are not affected.

@nuxt/image now requires ipx ^4.1.0, which rejects oversized multi-page images with a 400 before decoding them. ipx is an optional dependency, so after upgrading run npm ls ipx to confirm a patched version resolves.

Behaviour change: /_ipx now only accepts common web image formats as input (JPEG, PNG, WebP, GIF, SVG, AVIF, HEIC) and responds 403 to anything else, before decoding it. If you transform other formats (for example TIFF), list them with the new image.ipx.allowedInputFormats option. For sources you do not fully trust, also consider image.ipx.restrictDecoders, which blocks the decoders of every other format for the whole process.

👉 Changelog

compare changes

🩹 Fixes

• ipx: require patched ipx and restrict input formats for /_ipx route (GHSA-p5vf-pjf5-ggj3) (750a4f0)
• ipx: use IPXFetchHandler so srvx/node is not required at runtime (#2336)
• ipx: import NitroRuntimeConfig from nitropack/types (#2354)

🎉 New Contributors

• Chairul Akmal (@​chairulakmal)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Chairul Akmal (@​chairulakmal)
• Luke Nelson (@​luc122c)

Commits

• 6e2e251 v2.2.1 (#2357)
• 750a4f0 fix(ipx): require patched ipx and restrict input formats for /_ipx route (GHS...
• f3e294c chore(deps): update nuxt framework to ^4.6.3 (#2367)
• 3c8b6a1 chore(deps): update dependency @​nuxt/ui to ^4.12.0 (#2363)
• a49b6ab chore(deps): update devdependency happy-dom to v21 [security] (#2364)
• 33b4177 chore(deps): update all non-major dependencies (#2362)
• 5bd8766 fix(ipx): use IPXFetchHandler so srvx/node is not required at runtime (#2336)
• 8729b2e fix(ipx): import NitroRuntimeConfig from nitropack/types (#2354)
• c0f6432 chore(deps): update nuxt framework to ^4.6.2 (#2351)
• See full diff in compare view

Updates @takumi-rs/core from 2.18.2 to 2.19.0

Release notes

Sourced from @​takumi-rs/core's releases.

takumi@2.19.0

• @​takumi-rs/wasm@​2.19.0
• @​takumi-rs/image-response@​2.19.0
• @​takumi-rs/helpers@​2.19.0
• takumi-js@2.19.0
• @​takumi-rs/core@​2.19.0
• takumi@2.19.0

Render on Nitro's bun preset instead of failing

Nitro's bun preset used to answer every request with a 500 and ENOENT ... _libs/@takumi-rs/[object WebAssembly.Module]. The WASM packages now load their binary through unwasm there, as they do on other Nitro presets.

Renderers take HTML directly

render, renderSvg, measure, and the WASM renderAsDataUrl accept an HTML string in place of a node tree. The markup is parsed in Rust, and the CSS of its <style> elements follows the css option. A <style> with a media attribute applies only where its query matches. takumi-html adds parse_html, which returns that CSS with the tree. fromHtml from @takumi-rs/helpers/html is deprecated in favor of passing the string and will be removed in v3.

Renderer.prepare fetches what a render needs ahead of it

renderer.prepare(source, options) styles an HTML string or node tree, fetches the images it draws, and loads the font subsets its text uses. render, renderSvg, and measure take the prepared source with only output options such as format. renderer.prepareAnimation(options) does the same for every scene of an animation, and renderAnimation takes its result. prepareImages from @takumi-rs/helpers is deprecated in favor of prepare.

takumi-js renders through prepare, so it fetches the images the styled tree draws. An image that css, a <style> element, or a ::before rule sets now renders, an image under display: none is no longer fetched, and a custom fetch now receives relative URLs such as /logo.png.

Parse HTML strings in Rust in every renderer

takumi-paint and takumi-pdf take HTML strings as @takumi-rs/core and @takumi-rs/wasm do, and takumi-pdf takes them for header and footer bands too. A renderAnimation scene can be an HTML string, its <style> rules applying to the animation. With emoji: "from-font", takumi-js hands HTML to the renderer instead of parsing it in JavaScript.

Font subsets load as a browser loads them

When fonts holds unicodeRange subsets, as googleFonts returns, a render now loads only the subsets that font matching reaches for each character, through that text's own font stack, weight, and style. With font-family: Inter, "Noto Sans JP", Latin text no longer loads Noto Sans JP's Latin subset, and a bold subset loads only when bold text uses it.

The text comes from the styled tree, so a subset needed only by a stylesheet's generated content, a list marker, text-transform, the text elements of an SVG image, or a takumi-pdf page counter now loads. collectCodepoints, LIST_MARKER_CHARACTERS, and subsetFonts are deprecated.

Editors point imports of @takumi-rs/image-response and @takumi-rs/wasm/vite to their replacements

Editors now flag imports from @takumi-rs/image-response, which only re-exports takumi-js/response, and from @takumi-rs/wasm/vite, which resolves to the same loader as @takumi-rs/wasm/auto under Vite. Both keep working and will be removed in v3.

PdfRenderer and Painter prepare a document too

PdfRenderer.prepare and Painter.prepare, and the shared prepare each package exports, fetch the images a document draws and load the font subsets its text uses, a PDF's header, footer, and page bands included. render, measure, and paint take the prepared document, a PDF with only file options such as metadata and pdfa.

Emoji images download once per process

Without a fetchCache, every render used to download each emoji's SVG again. Emoji images from the emoji providers are now kept across renders in a cache of up to 8 MB per fetch function. Other remote images still need a fetchCache to be reused. The fluent and fluentFlat sets now load from a pinned commit of shuding/fluentui-emoji-unicode, as the other sets load from a pinned version, so a cached image cannot go stale.

Editors flag imports from @takumi-rs/helpers/renderer

The entry holds glue internal to the renderer packages, which no longer import it. Its exports keep working and will be removed in v3. Import types such as FontLoader and ImagesInput from the renderer package you use.

Render on the native backend under Nitro's !unwasm opt-in

... (truncated)

Changelog

Sourced from @​takumi-rs/core's changelog.

@​takumi-rs/core@​2.19.0

Renderers take HTML directly

render, renderSvg, measure, and the WASM renderAsDataUrl accept an HTML string in place of a node tree. The markup is parsed in Rust, and the CSS of its <style> elements follows the css option. A <style> with a media attribute applies only where its query matches. takumi-html adds parse_html, which returns that CSS with the tree. fromHtml from @takumi-rs/helpers/html is deprecated in favor of passing the string and will be removed in v3.

Renderer.prepare fetches what a render needs ahead of it

renderer.prepare(source, options) styles an HTML string or node tree, fetches the images it draws, and loads the font subsets its text uses. render, renderSvg, and measure take the prepared source with only output options such as format. renderer.prepareAnimation(options) does the same for every scene of an animation, and renderAnimation takes its result. prepareImages from @takumi-rs/helpers is deprecated in favor of prepare.

takumi-js renders through prepare, so it fetches the images the styled tree draws. An image that css, a <style> element, or a ::before rule sets now renders, an image under display: none is no longer fetched, and a custom fetch now receives relative URLs such as /logo.png.

Parse HTML strings in Rust in every renderer

takumi-paint and takumi-pdf take HTML strings as @takumi-rs/core and @takumi-rs/wasm do, and takumi-pdf takes them for header and footer bands too. A renderAnimation scene can be an HTML string, its <style> rules applying to the animation. With emoji: "from-font", takumi-js hands HTML to the renderer instead of parsing it in JavaScript.

Font subsets load as a browser loads them

When fonts holds unicodeRange subsets, as googleFonts returns, a render now loads only the subsets that font matching reaches for each character, through that text's own font stack, weight, and style. With font-family: Inter, "Noto Sans JP", Latin text no longer loads Noto Sans JP's Latin subset, and a bold subset loads only when bold text uses it.

The text comes from the styled tree, so a subset needed only by a stylesheet's generated content, a list marker, text-transform, the text elements of an SVG image, or a takumi-pdf page counter now loads. collectCodepoints, LIST_MARKER_CHARACTERS, and subsetFonts are deprecated.

Loading a font no longer blocks rendering

FontResource::into_resolved now also limits the cmap to the unicode_range and hashes the font, so registering a resolved font takes the same short time whatever its size. @takumi-rs/core registers fonts on the JavaScript thread after decompressing them in the background, and renders no longer wait on a lock while fonts load. The font cache budget now counts a unicode-range subset by the bytes it keeps.

Commits

• d482d86 Version Packages (#2376)
• 7b8a501 Core: take the HTML parser in as the html module (#2426)
• 4d96eaf HTML: shrink the bindings' HTML tables and options code (#2422)
• 8ae6001 Fonts: copy font bytes into the binding once (#2409)
• 34b10b0 JS: move the binding glue into a private package (#2408)
• 21a1943 Bindings: read render options into one set of types (#2410)
• 8e6ecb4 Bindings: parse HTML and prepare renders in Rust in every renderer (#2406)
• 04eff1b Drop every lock from the napi renderer (#2404)
• 34ae2c1 Bindings: pass node trees to wasm as JSON, as napi does (#2383)
• fd2f3cd Bindings: render HTML passed as { html } (#2378)
• See full diff in compare view

Updates vue-tsc from 3.3.13 to 3.3.14

Release notes

Sourced from vue-tsc's releases.

v3.3.14

language-core

• fix: isolate template virtual code from setup control flow (d31557b)
• fix: re-assert dot-value bindings in template closures (4524874) (f9c908f) (b65e458)
• fix: avoid TS2454 from the withDotValue assertion (c774144)
• fix: use a const type parameter in __VLS_unwrap to keep literal bindings on TS 7.1 (ce6c1de)
• fix: avoid never slot props for dynamic slot names in generic components (7957e7f)
• fix: omit emitted events from inherited attrs of generic components (2d94d89)
• fix: check bindings of generic directive hooks (0cb7d92)
• fix: wrap the v-model assignment target in parentheses (9bb1dc9)
• fix: type the $event parameter of inline handlers explicitly (d3b42a1)
• fix: type unknown components without diagnostic filters (b3909a3)
• fix: keep leading @ts-nocheck and /// <reference> effective in script setup (c2e2e6f)
• fix: declare component context vars before slot code (b7c773d)
• fix: avoid non-null assertion in JS slot codegen (5633525)
• fix: restore tag navigation for barrel imports (6358d15)
• fix: map the whole hyphenated directive name in the auto-import access (beb0151)

language-service

• fix: prevent crash on malformed html.customData configuration (3961653)

typescript-plugin

• fix: show unwrapped type when hovering setup refs in template (c742c14)

Contributors: @​johnsoncodehk, @​lazerg, @​ValentinYoushkevich, @​so1ve, @​WangKepeople

Changelog

Sourced from vue-tsc's changelog.

3.3.14 (2026-10-30)

language-core

• fix: isolate template virtual code from setup control flow (d31557b)
• fix: re-assert dot-value bindings in template closures (4524874) (f9c908f) (b65e458)
• fix: avoid TS2454 from the withDotValue assertion (c774144)
• fix: use a const type parameter in __VLS_unwrap to keep literal bindings on TS 7.1 (ce6c1de)
• fix: avoid never slot props for dynamic slot names in generic components (7957e7f)
• fix: omit emitted events from inherited attrs of generic components (2d94d89)
• fix: check bindings of generic directive hooks (0cb7d92)
• fix: wrap the v-model assignment target in parentheses (9bb1dc9)
• fix: type the $event parameter of inline handlers explicitly (d3b42a1)
• fix: type unknown components without diagnostic filters (b3909a3)
• fix: keep leading @ts-nocheck and /// <reference> effective in script setup (c2e2e6f)
• fix: declare component context vars before slot code (b7c773d)
• fix: avoid non-null assertion in JS slot codegen (5633525)
• fix: restore tag navigation for barrel imports (6358d15)
• fix: map the whole hyphenated directive name in the auto-import access (beb0151)

language-service

• fix: prevent crash on malformed html.customData configuration (3961653)

typescript-plugin

• fix: show unwrapped type when hovering setup refs in template (c742c14)

Contributors: @​johnsoncodehk, @​lazerg, @​ValentinYoushkevich, @​so1ve, @​WangKepeople

Commits

• df80037 v3.3.14
• d31557b fix(language-core): isolate template virtual code from setup control flow (#6...
• b3909a3 fix(language-core): type unknown components without diagnostic filters (fix #...
• 845975c chore: bump @volar/* to 2.4.30
• 0cb7d92 fix(language-core): check bindings of generic directive hooks (#6291)
• See full diff in compare view

[kbrdn1]

@dependabot rebase