Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion knip.json
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,6 @@
"@clack/prompts",
"c12",
"confbox",
"copy-paste",
"debug",
"defu",
"exsolve",
Expand All @@ -53,6 +52,7 @@
"scule",
"semver",
"srvx",
"tinyclip",
"ufo",
"youch"
]
Expand Down
3 changes: 1 addition & 2 deletions packages/nuxi/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -38,15 +38,13 @@
"@nuxt/kit": "^4.3.1",
"@nuxt/schema": "^4.3.1",
"@nuxt/test-utils": "^4.0.0",
"@types/copy-paste": "^2.1.0",
"@types/debug": "^4.1.12",
"@types/node": "^24.10.12",
"@types/semver": "^7.7.1",
"c12": "^3.3.3",
"citty": "^0.2.0",
"confbox": "^0.2.4",
"consola": "^3.4.2",
"copy-paste": "^2.2.0",
"debug": "^4.4.3",
"defu": "^6.1.4",
"exsolve": "^1.0.8",
Expand All @@ -72,6 +70,7 @@
"semver": "^7.7.4",
"srvx": "^0.11.2",
"std-env": "^3.10.0",
"tinyclip": "^0.1.10",
"tinyexec": "^1.0.2",
"tsdown": "^0.20.3",
"typescript": "^5.9.3",
Expand Down
5 changes: 2 additions & 3 deletions packages/nuxi/src/commands/info.ts
Original file line number Diff line number Diff line change
Expand Up @@ -7,12 +7,11 @@ import process from 'node:process'
import { box } from '@clack/prompts'
import { defineCommand } from 'citty'
import { colors } from 'consola/utils'
import { copy as copyToClipboard } from 'copy-paste'
import { detectPackageManager } from 'nypm'
import { resolve } from 'pathe'
import { readPackageJSON } from 'pkg-types'

import { isBun, isDeno, isMinimal } from 'std-env'
import { writeText } from 'tinyclip'

import { version as nuxiVersion } from '../../package.json'
import { getBuilder } from '../utils/banner'
Expand Down Expand Up @@ -143,7 +142,7 @@ export default defineCommand({
}
}

const copied = !isMinimal && await new Promise(resolve => copyToClipboard(copyStr, err => resolve(!err)))
const copied = !isMinimal && await writeText(copyStr).then(() => true).catch(() => false)

if (copied) {
box(
Expand Down
2 changes: 1 addition & 1 deletion packages/nuxt-cli/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,6 @@
"citty": "^0.2.0",
"confbox": "^0.2.4",
"consola": "^3.4.2",
"copy-paste": "^2.2.0",
"debug": "^4.4.3",
"defu": "^6.1.4",
"exsolve": "^1.0.8",
Expand All @@ -66,6 +65,7 @@
"semver": "^7.7.4",
"srvx": "^0.11.2",
"std-env": "^3.10.0",
"tinyclip": "^0.1.10",
Copy link

@coderabbitai coderabbitai bot Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Fetch registry metadata for tinyclip
curl -fsSL https://registry.npmjs.org/tinyclip -o /tmp/tinyclip-registry.json 2>/dev/null || echo "Failed to fetch registry"

python3 - <<'PY'
import json
try:
    with open("/tmp/tinyclip-registry.json") as f:
        data = json.load(f)
    latest = data["dist-tags"]["latest"]
    meta = data["versions"][latest]
    print(f"latest={latest}")
    print(f"engines={meta.get('engines', 'not specified')}")
    print(f"tarball={meta['dist']['tarball']}")
except Exception as e:
    print(f"Error: {e}")
PY

# Download published tarball and inspect shipped files
TARBALL_URL="$(python3 - <<'PY'
import json
try:
    with open('/tmp/tinyclip-registry.json') as f:
        data=json.load(f)
    latest=data['dist-tags']['latest']
    print(data['versions'][latest]['dist']['tarball'])
except Exception as e:
    print(f"Error: {e}")
PY
)"

if [ -n "$TARBALL_URL" ] && [ "$TARBALL_URL" != "Error: "* ]; then
  TMPDIR="$(mktemp -d)"
  trap 'rm -rf "$TMPDIR"' EXIT
  curl -fsSL "$TARBALL_URL" -o "$TMPDIR/tinyclip.tgz" 2>/dev/null
  tar -xzf "$TMPDIR/tinyclip.tgz" -C "$TMPDIR"

  echo "---- published package.json ----"
  cat "$TMPDIR/package/package.json" 2>/dev/null || echo "package.json not found"

  echo ""
  echo "---- AbortSignal.timeout occurrences ----"
  rg -n 'AbortSignal\.timeout' "$TMPDIR/package" 2>/dev/null || echo "No AbortSignal.timeout found"

  echo ""
  echo "---- Main entry point ----"
  head -50 "$TMPDIR/package/dist/index.js" 2>/dev/null || cat "$TMPDIR/package/index.js" 2>/dev/null || echo "Main file not found"
fi

Repository: nuxt/cli

Length of output: 3411


Tighten Node engine requirement: tinyclip 0.1.10 uses AbortSignal.timeout() which requires Node 17.3.0+.

The added dependency uses AbortSignal.timeout() unconditionally (in lines 45 and 91 of its dist), but this API was introduced only in Node 17.3.0. The current engine declaration ^16.10.0 allows Node 16.10.0–16.13.2, which do not support this API and will fail at runtime. Either:

  1. Update engines.node in packages/nuxt-cli/package.json to ^17.3.0 || >=18.0.0, or
  2. Use a different clipboard implementation that supports the declared Node range.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@packages/nuxt-cli/package.json` at line 68, The package.json addition of
"tinyclip": "^0.1.10" uses AbortSignal.timeout(), which requires Node >=17.3.0,
so update the engines.node declaration in packages/nuxt-cli/package.json (the
engines.node field) to a compatible range such as "^17.3.0 || >=18.0.0" to match
tinyclip, or alternatively remove/replace the "tinyclip" dependency with a
clipboard implementation that supports the existing engines.node range (or add a
runtime polyfill/shim) and ensure package.json's dependencies and engines.node
remain consistent with the chosen approach.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Given Nuxt 4 supports node >=20, should the requirements in the CLI be bumped as well?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@florian-lefebvre — That's a great point. Nuxt 4 officially requires Node.js 20.x or newer (with the active LTS release recommended), so the current CLI engine declaration of ^16.10.0 || >=18.0.0 is indeed stale relative to what Nuxt 4 users actually need.

Bumping engines.node to >=20.0.0 (or ^20.0.0 || >=22.0.0 to mirror the current LTS lines explicitly) would:

  1. Align the CLI with Nuxt 4's stated prerequisites.
  2. Fully resolve the tinyclip/AbortSignal.timeout() compatibility concern raised in this review (that API has been available since Node 17.3.0, so Node 20+ covers it unconditionally).

Suggested change in packages/nuxt-cli/package.json:

  "engines": {
-   "node": "^16.10.0 || >=18.0.0"
+   "node": ">=20.0.0"
  },

This would be the cleanest fix — it reflects reality for Nuxt 4 users and eliminates the need to carry the old Node 16/18 range. Worth doing in this PR or a follow-up, depending on whether it's considered in-scope here.

"tinyexec": "^1.0.2",
"ufo": "^1.6.3",
"youch": "^4.1.0-beta.13"
Expand Down
45 changes: 11 additions & 34 deletions pnpm-lock.yaml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading