supabase / supabase / 41817824661

87%

push

github

chore(deps): bump nuxt to 4.6.3 to resolve audit advisory (#52714)

## Problem

`pnpm audit` reports a moderate advisory for `nuxt` (patched in
`>=4.6.2`). The lockfile resolves `nuxt` to 4.5.2 for `blocks/vue`.

## Solution

- Ran `pnpm tsx scripts/fix-audit-vulnerability.ts nuxt --json`. It
resolved `nuxt` from 4.5.2 to 4.6.3 without a permanent override
(`pnpm-lock.yaml` only). The other lockfile changes are the transitive
re-resolutions that come with the nuxt upgrade.
- nuxt 4.6 types `useRequestEvent()` through `ServerTypes`, which
`@nuxt/nitro-server` augments inside a Nuxt app. `blocks/vue` is not a
Nuxt app, so the call resolved to the generic `RequestEvent`, and
`@supabase/vue-blocks` failed typecheck where it passes that value to
`createSupabaseServerClient(event: H3Event | undefined)`. The nuxtjs
`is-authenticated` middleware now casts the event to h3's `H3Event`.
Under Nitro that is its runtime type, so the block works the same in
user apps.
- Regenerated `apps/ui-library/public/r/supabase-client-nuxtjs.json`
with `pnpm build:registry`.

## Review instructions

1. `pnpm install --frozen-lockfile` succeeds.
2. `pnpm audit --json` lists no advisory for `nuxt`.
3. `pnpm turbo run typecheck --filter='...[origin/master]'` passes
(17/17 tasks, including `@supabase/vue-blocks`).
4. `pnpm turbo run lint --filter='[origin/master]'` passes.
5. On the UI library preview, the Supabase client for Nuxt.js block
shows the updated `is-authenticated.ts` middleware with the `H3Event`
cast.

Verification: ran all of the commands above, plus Prettier on the
changed files. The first studio typecheck run was killed for running out
of memory (exit 137). Rerun with turbo concurrency 1, it passed.

## Checklist

- [ ] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
- [ ] If I wrote a new docs topic or edited an existing topic, I used
the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs
[style
guid... (continued)

1987 of 2358 branches covered (84.27%)

Branch coverage included in aggregate %.

2804 of 3163 relevant lines covered (88.65%)

196.07 hits per line