deps: upgrade to nuxt-nightly (5x) and vite ^8.1

[antfubot]

Summary

Upgrades nuxt to npm:nuxt-nightly@5x and vite to ^8.1.5, removing the
prior ~8.0.16 pin. That pin existed only because @vitejs/devtools@0.4.2
broke under Vite 8.1's reworked WebSocket-upgrade handling; against the
current @vitejs/devtools@0.4.9 the SSR e2e suite no longer reproduces that
crash.

Nitro v3 compatibility

Nuxt 5 nightly's Nitro layer (@nuxt/nitro-server-nightly) builds on the
next-gen Nitro v3 engine (package nitro, not nitropack), which is a
bigger jump than a version bump — several DevTools internals depended on
Nitro v2-only APIs:

• nitro.storage is gone. Nitro v3 no longer exposes a live unstorage
  instance on the Nitro object (storage mounts are now a build-time virtual
  module consumed from inside the built server). The DevTools storage
  browser (server-rpc/storage.ts) now builds its own unstorage instance
  from nitro.options.storage/devStorage, mirroring what nitropack
  itself used to do internally. Without this, SSR prerendering crashed with
  500s on every route.
• server-routes/server-tasks used to watch Nitro's internal src
  storage mount (also gone) to detect new route/task files; they now use
  Nitro's dev:reload hook, which exists on both engines.
• data-inspector, module-main, and runtime/nitro/inline are updated
  for the Nitro v2/v3 union types Nuxt 5's hooks now carry (nitro:init,
  nitro:build:before, nitro:config can all receive either engine).

Other fixes along the way

• unplugin-vue-markdown's Vite plugin needs prepend: true when
  registered via addVitePlugin now — Nuxt's non-isomorphic plugin
  wrapping hard-codes enforce: 'post' otherwise, discarding the plugin's
  own enforce: 'pre' and breaking .md SFC compilation in the DevTools
  client itself.
• The Components tab's built-in-vs-library grouping only recognized the
  literal nuxt package name; nuxt-nightly (and the older nuxt-edge
  alias) are now recognized too, since aliased installs physically live
  under a different node_modules name.
• Pinned vue-sfc-transformer to ^0.1.17, matching what
  @nuxt/module-builder's bundled mkdist itself depends on —
  resolutionMode: highest otherwise hoists it to module-builder's own
  newer want, and mkdist's .vue transform silently breaks under that
  mismatch (it was writing compiled output into
  packages/devtools/src/runtime/** instead of dist/, clobbering
  auth/index.html in the process).

Known remaining issue (not blocking)

floating-vue's globally-registered <VDropdown> fails to render its
scoped-slot content under this stack — verified via a live e2e repro, not
present on main (stable Nuxt 4). This is an upstream, already-open
floating-vue bug unrelated to how it's used here (Akryum/floating-vue#924,
#1085). Effect: component/composable/route names inside their dropdown
trigger don't render in the DevTools UI (the underlying list/count data is
correct). Filed as a follow-up rather than fixed here, since root-causing it
further is a floating-vue/Vue-core investigation, not a DevTools change.

Verification

• pnpm build, pnpm typecheck, pnpm lint, pnpm test (lint + unit) all
  pass.
• pnpm test:e2e:dev (empty playground) passes except for the
  floating-vue issue above.

This upgrade was done with the help of an AI agent.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vite@​8.1.5
	nitro@​3.0.260610-beta

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm env-runner is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/nitro@3.0.260610-beta → npm/env-runner@0.1.16 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/env-runner@0.1.16. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm seroval is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/seroval@1.5.6 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/seroval@1.5.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: be0602c8-d1f6-4004-a4e0-5e4cdc38252f

📥 Commits

Reviewing files that changed from the base of the PR and between d7677c4 and d0fea29.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (3)

• packages/devtools-kit/package.json
• packages/devtools/package.json
• pnpm-workspace.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• pnpm-workspace.yaml

---

📝 Walkthrough

Walkthrough

The devtools updates add Nuxt package-name recognition for nightly and edge installs, prepend the client markdown Vite plugin, and adjust an error type assertion. Server API and task modules receive explicit h3 and Nitro registrations. Nitro compatibility types now cover Nitro v2 and v3, with updated lifecycle refresh handling, configuration injection, storage reconstruction, and task normalization. Workspace and package metadata advance Nuxt, Nitro, Vite, and related pins.

Estimated code review effort: 4 (Complex) | ~45 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 14.29% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: upgrading Nuxt nightly and Vite.
Description check	✅ Passed	The description matches the changeset, covering the Nuxt 5/Nitro v3 upgrade and the related DevTools fixes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}