fix(nuxt): dev dependency security fixes - bump nuxt to 3.21.11 (#23235)

The update requires a small change in the code to remove the type errors
(it's not breaking).

Nuxt moved Nitro-specific types out of `@nuxt/schema` and into module
augmentations provided by `@nuxt/nitro-server`:
- nuxt/nuxt#34039

The hooks remain supported and documented, but TypeScript only applies
these augmentations when the package containing them is included in the
TypeScript program. That's why an empty type-only import is needed now.

Fixes GHSA-hxcr-hm88-mpq6 / CVE-2026-71314 (high) —
https://github.com/getsentry/sentry-javascript/security/dependabot/2377

Author: s1gr1d

packages/nuxt/package.json

@@ -65,10 +65,10 @@
     "local-pkg": "^1.1.2"
   },
   "devDependencies": {
-    "@nuxt/nitro-server": "^3.21.6",
+    "@nuxt/nitro-server": "^3.21.11",
     "nitro": "^3.0.260311-beta",
     "nuxi": "^3.25.1",
-    "nuxt": "3.17.7",
+    "nuxt": "3.21.11",
     "vite": "^6.4.3"
   },
   "scripts": {

packages/nuxt/src/module.ts

@@ -7,6 +7,9 @@ import {
   createResolver,
   defineNuxtModule,
 } from '@nuxt/kit';
+// Needed to make TS evaluate the augmentation of Nitro types (https://github.com/nuxt/nuxt/pull/34039)
+import type {} from '@nuxt/nitro-server';
+
 import { consoleSandbox } from '@sentry/core';
 import * as path from 'path';
 import type { SentryNuxtModuleOptions } from './common/types';

packages/nuxt/src/runtime/plugins/sentry-cloudflare.server.ts

@@ -102,7 +102,6 @@ export const sentryCloudflareNitroPlugin =
 
     nitroApp.hooks.hook('beforeResponse', updateRouteBeforeResponse);
 
-    // @ts-expect-error - 'render:html' is a valid hook name in the Nuxt context
     nitroApp.hooks.hook('render:html', (html: NuxtRenderHTMLContext, { event }: { event: H3Event }) => {
       let storedTraceData: ReturnType<typeof getTraceData> | undefined = undefined;
 

packages/nuxt/src/runtime/plugins/sentry.client.ts

@@ -67,8 +67,11 @@ export default defineNuxtPlugin({
 
     nuxtApp.hook('app:error', error => {
       if (isNuxtError(error)) {
+        // oxlint-disable-next-line typescript/no-deprecated
+        const statusCode = error?.status || error?.statusCode;
+
         // Do not report if status code is 3xx or 4xx
-        if (error?.statusCode && error.statusCode >= 300 && error.statusCode < 500) {
+        if (statusCode && statusCode >= 300 && statusCode < 500) {
           return;
         }
       }

packages/nuxt/src/runtime/plugins/sentry.server.ts

@@ -8,7 +8,6 @@ import { addSentryTracingMetaTags } from '../utils';
 export default (nitroApp => {
   nitroApp.hooks.hook('error', sentryCaptureErrorHook);
 
-  // @ts-expect-error - 'render:html' is a valid hook name in the Nuxt context
   nitroApp.hooks.hook('render:html', (html: NuxtRenderHTMLContext, { event }: { event: H3Event }) => {
     // h3 v1 (Nuxt 4): event.node.res.getHeaders(); h3 v2 (Nuxt 5): event.node is undefined
     const nodeResHeadersH3v1 = event.node?.res?.getHeaders() || {};

packages/nuxt/tsconfig.test.json

@@ -5,6 +5,6 @@
 
   "compilerOptions": {
     // should include all types from `./tsconfig.json` plus types for all test frameworks used
-    "types": ["node"]
+    "types": ["node", "@nuxt/nitro-server"]
   }
 }