[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@nuxt/image (source)	2.2.0 → 2.2.1

---

Release Notes

nuxt/image (@​nuxt/image)

v2.2.1

Compare Source

v2.2.1 is a security release.

🚨 Security

This release fixes a vulnerability in the /_ipx image transformation route. ipx was affected by an integer overflow when decoding a multi-page image, so a crafted source image could corrupt memory in the server process with a single unauthenticated request (GHSA-qf89-6xm4-66wm; our advisory for the @nuxt/image side is GHSA-p5vf-pjf5-ggj3). Sites where an attacker cannot control any image source are not affected.

@nuxt/image now requires ipx ^4.1.0, which rejects oversized multi-page images with a 400 before decoding them. ipx is an optional dependency, so after upgrading run npm ls ipx to confirm a patched version resolves.

Behaviour change: /_ipx now only accepts common web image formats as input (JPEG, PNG, WebP, GIF, SVG, AVIF, HEIC) and responds 403 to anything else, before decoding it. If you transform other formats (for example TIFF), list them with the new image.ipx.allowedInputFormats option. For sources you do not fully trust, also consider image.ipx.restrictDecoders, which blocks the decoders of every other format for the whole process.

👉 Changelog

compare changes

🩹 Fixes

• ipx: require patched ipx and restrict input formats for /_ipx route (GHSA-p5vf-pjf5-ggj3) (750a4f0)
• ipx: use IPXFetchHandler so srvx/node is not required at runtime (#​2336)
• ipx: import NitroRuntimeConfig from nitropack/types (#​2354)

🎉 New Contributors

• Chairul Akmal (@​chairulakmal)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Chairul Akmal (@​chairulakmal)
• Luke Nelson (@​luc122c)

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	launchpad	f9986e6	Commit Preview URL Branch Preview URL	Oct 31 2026, 10:03 PM