
Security News
Socket Releases Free Certified Patches for Nuxt Security Vulnerabilities
Socket releases free Certified Patches for high-severity Nuxt vulnerabilities, including server-side remote code execution through server island props.
Errors worth reading.
nostics helps you replace ad hoc error strings with stable diagnostic codes, actionable fixes, source locations, and docs links.
[NUXT_B2011] Plugin `./runtime/analytics.server.ts` is server-only but was registered with mode `client`.
├▶ fix: Rename the file or register it with mode `server`.
├▶ sources: modules/analytics.ts:18:5
╰▶ see: https://nuxt.com/e/b2011
pnpm add nostics
import { createConsoleReporter, defineDiagnostics } from 'nostics'
export const diagnostics = defineDiagnostics({
docsBase: code => `https://nuxt.com/e/${code.replace('NUXT_', '').toLowerCase()}`,
reporters: [createConsoleReporter()],
codes: {
NUXT_B2011: {
why: (p: { src: string, mode: 'client' | 'server' }) => {
const expected = p.mode === 'client' ? 'server' : 'client'
return `Plugin "${p.src}" is ${expected}-only but was registered with mode "${p.mode}".`
},
fix: (p: { mode: 'client' | 'server' }) => {
const expected = p.mode === 'client' ? 'server' : 'client'
return `Rename the file or register it with mode "${expected}".`
},
},
NUXT_B5001: {
why: (p: { value: string, configPath: string }) =>
`Invalid compatibilityDate "${p.value}" in ${p.configPath}.`,
fix: (p: { example: string }) => `Use an ISO date like "${p.example}", or "latest".`,
},
},
})
Use the generated handles where the problem happens:
const plugin = resolvePlugin()
const source = locatePluginCall(plugin)
const config = loadNuxtConfig()
diagnostics.NUXT_B2011({
src: plugin.src,
mode: plugin.mode,
sources: [source],
})
throw diagnostics.NUXT_B5001({
configPath: config.filepath,
value: config.compatibilityDate,
example: '2024-04-03',
})
Calling a handle reports the diagnostic and returns a Diagnostic. Throwing the return value raises it. The params are inferred from your why and fix functions.
Install the plugin to give Claude skills for your diagnostic catalog:
claude plugin add https://github.com/vercel-labs/nostics
Claude will automatically pick up the nostics API reference and an add-diagnostic skill that finds the right catalog, chooses the next free code, and wires the call site.
Prefer just the skills, without the plugin? Install them with npx skills into any supported agent (Claude Code, Codex, Cursor, opencode, and more):
npx skills add vercel-labs/nostics
Diagnostic instances that extend Error.The structured shape also makes diagnostics easier for tools and coding agents to read, without making that the main workflow.
Build-time plugins live in the separate @nostics/unplugin package:
pnpm add -D @nostics/unplugin
For library builds, use the strip plugin:
import { nosticsStrip } from '@nostics/unplugin/strip-transform'
export default defineConfig({
plugins: [nosticsStrip.vite()],
})
For browser diagnostics during Vite dev, use createDevReporter() in the browser and nosticsCollector in the consuming app:
import { nosticsCollector } from '@nostics/unplugin/dev-server-collector'
export default defineConfig({
plugins: [nosticsCollector.vite()],
})
See the docs site for the guide, production build notes, dev collector setup, and API reference.
FAQs
Structured diagnostic code library
The npm package nostics receives a total of 1,292,625 weekly downloads. As such, nostics popularity was classified as popular.
We found that nostics demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket releases free Certified Patches for high-severity Nuxt vulnerabilities, including server-side remote code execution through server island props.

Security News
An open letter signed by 50 companies, from NVIDIA and Microsoft to Mistral and Hugging Face, urges Washington not to restrict open weight AI.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.