npm / unhead
unhead
What changed in unhead 2 to 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-23.
4 security19 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initunhead 320 changes
Security 1
unhead: Streaming SSR
streamKeyinjected into inline script without identifier validation
Fixes and other changes 19
The ESLint fixer now trims leftover space when removing a mid-object property.
Non-string textContent is now stringified in hashTag.
False values now render negative robots directives.
Script consumers are now disposed with their effect scope.
Numeric template parameters, including 0, are now kept.
A warning is now issued for template tokens when the plugin is absent.
twitter:card is now inferred from the resolved image.
Vapor head entries are now disposed on scope teardown.
The canonical link can set the graph URL.
The devtools runtime plugin is registered only once.
Streaming preserves body tags and requests script nonces.
Initial head tags are kept in the streamed shell.
Schema.org reads the description and og:image values from useSeoMeta.
HTTP-prefixed relative canonical URLs are resolved.
The devtools payload is rendered after validation.
The bundler now injects the resolved path for the devtools runtime plugin.
Vite and stream support manifest-mode transformIndexHtml().
Relative warmup URLs passed to useScript are handled.
Warnings are reduced for normal Nuxt output.
unhead 23 changes
Security 3
Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()
Unhead has XSS bypass in
useHeadSafevia attribute name injection and case-sensitive protocol checkUnhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity