[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
nitropack	2.13.5 → 2.13.6

---

Release Notes

nitrojs/nitro (nitropack)

v2.13.6

Compare Source

compare changes

🔒 Security

This release contains 3 security fixes and additional hardening for cache, proxy and redirect route rules. If you're on nitropack v2 (including Nuxt 3 and 4), please upgrade.

• GHSA-39r7-wfcx-99xg: Cached event handlers might share entries across HTTP methods or replay per-user Set-Cookie headers
• GHSA-rhhp-7488-3qwf: Proxy route rule scope bypass via empty // segment and prefix re-entry
• GHSA-pqxc-r4h5-jc95: Open redirect via backslash and control characters in wildcard redirect route rules

🔥 Performance

• externals: Memoize tryResolve per importer directory in node-externals (v2) (#​4800)

🩹 Fixes

• Add typeFrom support for autoimports exports generation (#​3963)
• cache: Only cache GET/HEAD and never store per-user responses (9c2691d9)
• route-rules: Validate final proxy/redirect target scope (353eff5c)
• route-rules: Prevent open redirect via backslash and control characters in wildcard redirects (f16a4fad)

Dependencies

• Update archiver to v8 (#​4936)

Preset Changes

• vercel: Support node.js 26 (#​4968)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Ali Smesseim (@​ali-vercel)
• Liang Xu (@​lx3133584)
• Octavio Araiza (@​8ctavio)
• @​agustin18

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.