[Snyk] Upgrade @nuxtjs/supabase from 0.3.7 to 1.5.1

[nerdy-tech-com-gitub]

Snyk has created this PR to upgrade @nuxtjs/supabase from 0.3.7 to 1.5.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

• The recommended version is 55 versions ahead of your current version.

• The recommended version was released a month ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Excessive Platform Resource Consumption within a Loop SNYK-JS-BRACES-6838727	140	Proof of Concept
	Insecure Randomness SNYK-JS-UNDICI-8641354	140	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-CROSSSPAWN-8303230	140	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-ES5EXT-6095076	140	Proof of Concept
	Inefficient Regular Expression Complexity SNYK-JS-MICROMATCH-6838728	140	No Known Exploit
	Acceptance of Extraneous Untrusted Data With Trusted Data SNYK-JS-NUXT-9486043	140	No Known Exploit
	Incorrect Authorization SNYK-JS-VITE-9653016	140	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-BABELHELPERS-9397697	140	Proof of Concept
	Prototype Pollution SNYK-JS-PARSEGITCONFIG-9403763	140	Proof of Concept
	Cross-site Scripting (XSS) SNYK-JS-ROLLUP-8073097	140	Proof of Concept
	Information Exposure SNYK-JS-VITE-8023174	140	Proof of Concept
	Origin Validation Error SNYK-JS-VITE-8648411	140	Proof of Concept
	Incorrect Authorization SNYK-JS-VITE-9512410	140	Mature
	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	140	Proof of Concept
	Improper Input Validation SNYK-JS-NANOID-8492085	140	No Known Exploit
	Improper Input Validation SNYK-JS-NANOID-8492085	140	No Known Exploit
	Origin Validation Error SNYK-JS-NUXTVITEBUILDER-8663232	140	Proof of Concept
	Access Control Bypass SNYK-JS-VITE-9576207	140	Proof of Concept
	Information Exposure SNYK-JS-VITE-9685035	140	Proof of Concept
	Directory Traversal SNYK-JS-VITE-9919777	140	Proof of Concept
	Cross-site Scripting SNYK-JS-SEND-7926862	140	No Known Exploit
	Cross-site Scripting SNYK-JS-SERVESTATIC-7926865	140	No Known Exploit
	Missing Release of Memory after Effective Lifetime SNYK-JS-UNDICI-10176064	140	Proof of Concept
	Cross-site Scripting (XSS) SNYK-JS-VITE-8022916	140	Proof of Concept

Release notes

Package name: @nuxtjs/supabase

• 1.5.1 - 2025-05-13
  

  1.5.1 (2025-05-13)

  📖 New Documentation

  https://supabase.nuxtjs.org/

  First Nuxt module documentation built with Docus v2 powered by Nuxt UI Pro (coming soon 👀)

  🐛 Bug Fixes

  • plugins: do not set states on client (#490) (6152a64)
  • serverSupabaseClient: pass H3Event into useRuntimeConfig (#491) (548e21e)
• 1.5.1-20250513-081139-6152a64 - 2025-05-13
• 1.5.1-20250507-152647-116e7bc - 2025-05-07
• 1.5.1-20250507-151621-ad39fd5 - 2025-05-07
• 1.5.1-20250507-144712-b68323c - 2025-05-07
• 1.5.1-20250507-144615-54b13f1 - 2025-05-07
• 1.5.1-20250507-144539-79a77ad - 2025-05-07
• 1.5.1-20250507-142059-13476cc - 2025-05-07
• 1.5.1-20250507-132306-410463e - 2025-05-07
• 1.5.1-20250507-130758-aa719d1 - 2025-05-07
• 1.5.1-20250506-160232-ab685fd - 2025-05-06
• 1.5.1-20250506-153253-e0cbd07 - 2025-05-06
• 1.5.1-20250506-152735-312f331 - 2025-05-06
• 1.5.1-20250506-152025-44f899e - 2025-05-06
• 1.5.1-20250506-145213-b2d2dca - 2025-05-06
• 1.5.1-20250506-141515-6ee3f8e - 2025-05-06
• 1.5.1-20250506-140734-57b5776 - 2025-05-06
• 1.5.1-20250506-140357-e283834 - 2025-05-06
• 1.5.1-20250506-135817-1a15832 - 2025-05-06
• 1.5.1-20250506-130717-6ce1f40 - 2025-05-06
• 1.5.1-20250506-130540-d2008e0 - 2025-05-06
• 1.5.1-20250505-120850-548e21e - 2025-05-05
• 1.5.1-20250409-075938-fc284c0 - 2025-04-09
• 1.5.1-20250409-075900-f69899f - 2025-04-09
• 1.5.1-20250304-101902-be41d94 - 2025-03-04
• 1.5.0 - 2025-03-04
  

  1.5.0 (2025-03-04)

  Bug Fixes

  This release addresses multiple inconsistencies with cookie handling x customization that might fix several issues:

  • Setting persistSession: false still persists auth session (#390)
  • The module doesn't recognize supabase.clientOptions.auth.flowType key (#449)
  • Detecting session in URL is not working when sending "Password recovery" email manually from Supabase dashboard (#397)
  • Static Hosting: Client side only rendering gives error when signing in with email - pw (#138)

  Features

  • Added useSsrCookies option (default: true) → Resolves #186

  This new option controls whether the module uses cookies to share session info between server and client. You must enable this option if you need to access session or user info from the server. It will use the SSR client from the @ supabase/ssr library.

  When disabled, the module will use the default Supabase client from the @ supabase/supabase-js library which stores session info in local storage. This is useful in certain cases, such as statically generated sites or mobile apps where cookies might not be available.

  • Renamed cookieName → cookiePrefix – More accurate naming.

  • Renamed cookieRedirect → saveRedirectToCookie – More accurate naming.

  • New useSupabaseCookieRedirect composable – Simplifies handling redirect cookies without hardcoded names

  • Docs updated:

    • useSsrCookies → https://supabase.nuxtjs.org/get-started#usessrcookies
    • cookiePrefix → https://supabase.nuxtjs.org/get-started#cookieprefixa
    • saveRedirectToCookie→ https://supabase.nuxtjs.org/get-started#redirectoptions
    • useSupabaseCookieRedirect → https://supabase.nuxtjs.org/usage/composables/usesupabasecookieredirect

  Breaking Changes?

  No. useSsrCookies default value keep the old behaviour and deprecated options (cookieName, cookieRedirect) maintain backward compatibility.

  Contributor 💚

  A massive thanks to @ Jordan-Ellis for this improvement.

• 1.4.7-20250228-164219-e3f6a24 - 2025-02-28
• 1.4.6 - 2025-01-20
  

  What's Changed

  Bug Fixes

  • serverSupabaseServiceRole: Pass H3Event into useRuntimeConfig (#450) (2de1c08)

  Full changelog (2025-01-20)

  Contributors 💚

  @ blackburn32

• 1.4.5 - 2024-12-18
  

  What's Changed

  Fix

  • deps: Update supabase-js to fix #442 and #264

  Full changelog (2024-12-18)

• 1.4.4 - 2024-12-10
  

  What's Changed

  Feature

  • deps: Update supabase-js to fix realtime issue (#436)

  Full changelog (2024-12-10)

  Contributors 💚

  @ felixgabler

• 1.4.3 - 2024-11-20
  

  What's Changed

  Refactor

  • client: inject earlier (#433) [6a5bb33]

  Full changelog (2024-11-20)

  Contributors 💚

  @ felixgabler

• 1.4.2 - 2024-11-07
  

  What's Changed

  Full changelog (2024-11-07)

  Contributors 💚

  @ felixgabler

• 1.4.1 - 2024-10-11
  

  What's Changed

  Bug Fixes

  • session: ssr getSession warning (#418) (95d905b)
  • types: added explicit types annotations for serverSupabaseClient and serverSupabaseServiceRole (#411) (3f98640)

  Full changelog (2024-08-30)

  Contributors 💚

  @ th1m0

• 1.4.0 - 2024-08-30
  

  What's Changed

  Bug Fixes

  • types: add explicit type annotations for plugins (#408) (09bff84)
  • types: add explicit types for composables & remove baseUrl from tsconfig (#404) (596ece2)
  • types: nullable composable types (#407) (cbbfd86)

  Features

  • client: add retries to fetch (#382) (98ca959)

  Full changelog (2024-08-30)

  Contributors 💚

  @ felixgabler
  @ th1m0

• 1.3.5 - 2024-07-15
• 1.3.4 - 2024-07-10
• 1.3.3 - 2024-07-10
• 1.3.2 - 2024-07-05
• 1.3.1 - 2024-07-05
• 1.2.2 - 2024-05-02
• 1.2.1 - 2024-04-18
• 1.2.0 - 2024-03-29
• 1.1.7 - 2024-03-07
• 1.1.6 - 2024-01-26
• 1.1.5 - 2023-12-28
• 1.1.4 - 2023-11-17
• 1.1.3 - 2023-10-06
• 1.1.2 - 2023-09-22
• 1.1.1 - 2023-09-22
• 1.1.0 - 2023-09-06
• 1.0.2 - 2023-08-04
• 1.0.1 - 2023-08-03
• 1.0.0 - 2023-08-02
• 1.0.0-0 - 2023-08-02
• 0.3.8 - 2023-07-03
• 0.3.7 - 2023-06-12

from @nuxtjs/supabase GitHub release notes

---

Important

• Warning: This PR contains a major version upgrade, and may be a breaking change.
• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Summary by Sourcery

Enhancements:

• Bump @nuxtjs/supabase devDependency from ^0.3.x to ^1.5.1 in the user-management example

[sourcery-ai]

Reviewer's Guide

This PR updates the user-management example’s package.json to bump the @nuxtjs/supabase dependency from an outdated 0.3.x version to 1.5.1, ensuring the example benefits from the latest module enhancements and security patches.

Sequence Diagram for Server-Side Auth Flow in @nuxtjs/supabase v1.5.x

sequenceDiagram
    participant Browser
    participant NuxtServer as "Nuxt Server"
    participant Supabase

    Browser->>NuxtServer: Request page (with auth cookie)
    NuxtServer->>NuxtServer: Reads session from cookie via @supabase/ssr
    NuxtServer->>Supabase: Validate session
    Supabase-->>NuxtServer: Session is valid
    NuxtServer-->>Browser: Return server-rendered page with user data

Loading

File-Level Changes

Change	Details	Files
Upgrade @nuxtjs/supabase dependency version	Bump version specifier from ^0.3.6 to ^1.5.1	examples/user-management/nuxt3-user-management/package.json

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.