Summary & Key Takeaways ​

• Nuxt v4.6.4 is a security release addressing eight advisories in Nuxt and three in Nitro.
• Error details in production are now stripped, only showing createError messages.
• Dev server host checks are stricter, requiring devServer.allowedHosts for custom hostnames.
• workspaceDir detection is more precise, limiting scope to explicit roots or git repos.
• Nitropack's cache, swr, and isr rules now only cache GET/HEAD requests and avoid responses with cookies or Cache-Control: private/no-store.
• Route rules now correctly match paths containing encoded slashes.

Our Commentary ​

A security release is always a good thing, but the behavior changes here are quite substantial. Stripping error details in production is a smart move for security, but I can see it catching some developers off guard. The stricter dev server host checks are also a welcome security hardening. We're seeing a trend towards more secure defaults, which is great, but it means we need to pay closer attention to release notes.