Upgrading nuxt-security 1 to 2
Breaking1.4.3 → 2.7.0Breaking1Security3Platform1New18Changed16Fixed41Other43
BreakingUpgrade verdict
1 breaking change and a platform requirement change and 3 security fixes.
In plain terms
- A content security policy directive is no longer emitted, so configs relying on it must change.
- This update makes the package work again on Node 18, the oldest Node version that Nuxt 3 apps support.
- Support xss 1.0.16.
- Addresses security advisory GHSA-6cv5-qqmv-j28h.
Must act 5 items need code or config changes
Requires Node.js >=24.0.0 from 2.6.0 (none stated before).
Adds lru-cache ^11.2.6, radix3 ^1.1.2.
Drops cheerio.
Installs 77 packages in all (was 128).
What you must change
Breaking1
Removes the navigate-to CSP directive.
navigate-toSecurity3
Support xss 1.0.16.
Addresses security advisory GHSA-6cv5-qqmv-j28h.
Addresses security advisory GHSA-7hcp-x3c6-53f3.
Platform1
Re-introduces support for Node 18, the minimum requirement for all Nuxt 3 applications.
API changes
Generated by DepDelta from published .d.ts files. Not mixed with prose notes.
- changed:
property H3EventContext.security: { routeRules?: Record<string, NuxtSecurityRouteRules>; nonce?: string; cheerios?: Record<Section, CheerioAPI[]> } → property H3EventContext.security?: { route?: string; rules?: NuxtSecurityRouteRules; nonce?: string; hashes?: { script: Set<string>; style: Set<string> } }
- added:
property NitroRouteConfig.csurf?: ModuleOptions$1 | boolean
- added:
interface NitroRouteConfig - added:
interface NitroRuntimeHooks - added:
property NitroRouteConfig.csurf?: ModuleOptions$1 | boolean - added:
property NitroRouteConfig.security?: NuxtSecurityRouteRules - added:
property NitroRuntimeHooks.'nuxt-security:headers': (config: { route: string; headers: NuxtSecurityRouteRules['headers'] }) => void - added:
property NitroRuntimeHooks.'nuxt-security:ready': () => void - added:
property NitroRuntimeHooks.'nuxt-security:routeRules': (routeRules: Record<string, NuxtSecurityRouteRules>) => void
- added:
interface NuxtHooks - added:
property NuxtHooks.'nuxt-security:prerenderedHeaders': (prerenderedHeaders: Record<string, Record<string, string>>) => HookResult
- added:
const defaultSecurityConfig: (serverlUrl: string, strict: boolean) => ModuleOptions
- removed:
declare module 'h3' - removed:
declare module 'nitropack' - removed:
declare module 'nuxt/schema' - removed:
interface ModuleOptions - removed:
interface SecurityHeaders - removed:
property ModuleOptions.allowedMethodsRestricter: AllowedHTTPMethods | false - removed:
property ModuleOptions.basicAuth: BasicAuth | false - removed:
property ModuleOptions.corsHandler: CorsOptions | false - removed:
property ModuleOptions.csrf: ModuleOptions$1 | boolean - removed:
property ModuleOptions.enabled: boolean - removed:
property ModuleOptions.headers: SecurityHeaders | false - removed:
property ModuleOptions.hidePoweredBy: boolean - removed:
property ModuleOptions.nonce: boolean - removed:
property ModuleOptions.rateLimiter: RateLimiter | false - removed:
property ModuleOptions.removeLoggers: Options | false - removed:
property ModuleOptions.requestSizeLimiter: RequestSizeLimiter | false - removed:
property ModuleOptions.sri: boolean - removed:
property ModuleOptions.ssg: Ssg | false - removed:
property ModuleOptions.xssValidator: XssValidator | false - removed:
property SecurityHeaders.contentSecurityPolicy?: ContentSecurityPolicyValue | false - removed:
property SecurityHeaders.crossOriginEmbedderPolicy?: CrossOriginEmbedderPolicyValue | false - removed:
property SecurityHeaders.crossOriginOpenerPolicy?: CrossOriginOpenerPolicyValue | false - removed:
property SecurityHeaders.crossOriginResourcePolicy?: CrossOriginResourcePolicyValue | false - removed:
property SecurityHeaders.originAgentCluster?: '?1' | false - removed:
property SecurityHeaders.permissionsPolicy?: PermissionsPolicyValue | false - removed:
property SecurityHeaders.referrerPolicy?: ReferrerPolicyValue | false - removed:
property SecurityHeaders.strictTransportSecurity?: StrictTransportSecurityValue | false - removed:
property SecurityHeaders.xContentTypeOptions?: XContentTypeOptionsValue | false - removed:
property SecurityHeaders.xDNSPrefetchControl?: XDnsPrefetchControlValue | false - removed:
property SecurityHeaders.xDownloadOptions?: XDownloadOptionsValue | false - removed:
property SecurityHeaders.xFrameOptions?: XFrameOptionsValue | false - removed:
property SecurityHeaders.xPermittedCrossDomainPolicies?: XPermittedCrossDomainPoliciesValue | false - removed:
property SecurityHeaders.xXSSProtection?: string | false - removed:
type AllowedHTTPMethods = { methods: HTTPMethod[] | '*'; throwError?: boolean } - removed:
type BasicAuth = { exclude?: string[]; include?: string[]; name: string; pass: string; enabled?: boolean; message: string } - removed:
type CSPSandboxValue = 'allow-downloads' | 'allow-downloads-without-user-activation' | 'allow-forms' | 'allow-modals' | 'allow-orientation-lock' | 'allow-pointer-lock' | 'allow-popup… - removed:
type CSPSourceValue = "'self'" | "'unsafe-eval'" | "'wasm-unsafe-eval'" | "'unsafe-hashes'" | "'unsafe-inline'" | "'none'" | "'strict-dynamic'" | "'report-sample'" | "'nonce=<base64… - removed:
type ContentSecurityPolicyValue = { 'child-src'?: CSPSourceValue[] | string | false; 'connect-src'?: CSPSourceValue[] | string | false; 'default-src'?: CSPSourceValue[] | string | false; 'font-… - removed:
type CorsOptions = { origin?: '*' | 'null' | string | (string | RegExp)[] | ((origin: string) => boolean); methods?: '*' | HTTPMethod[]; allowHeaders?: '*' | string[]; exposeHead… - removed:
type CrossOriginEmbedderPolicyValue = 'unsafe-none' | 'require-corp' | 'credentialless' - removed:
type CrossOriginOpenerPolicyValue = 'unsafe-none' | 'same-origin-allow-popups' | 'same-origin' - removed:
type CrossOriginResourcePolicyValue = 'same-site' | 'same-origin' | 'cross-origin' - removed:
type HTTPMethod = 'GET' | 'POST' | 'DELETE' | 'PATCH' | 'PUT' | 'TRACE' | 'OPTIONS' | 'CONNECT' | 'HEAD' - removed:
type HeaderName = 'Content-Security-Policy' | 'Cross-Origin-Embedder-Policy' | 'Cross-Origin-Opener-Policy' | 'Cross-Origin-Resource-Policy' | 'Origin-Agent-Cluster' | 'Referrer… - removed:
type NuxtSecurityRouteRules = Partial<Omit<ModuleOptions, 'csrf' | 'basicAuth' | 'rateLimiter'> & { rateLimiter: Omit<RateLimiter, 'driver'> | false }> - removed:
type OptionKey = 'contentSecurityPolicy' | 'crossOriginEmbedderPolicy' | 'crossOriginOpenerPolicy' | 'crossOriginResourcePolicy' | 'originAgentCluster' | 'referrerPolicy' | 'st… - removed:
type PermissionsPolicyValue = { 'camera'?: string[] | string | false; 'display-capture'?: string[] | string | false; 'fullscreen'?: string[] | string | false; 'geolocation'?: string[] | str… - removed:
type RateLimiter = { tokensPerInterval: number; interval: string | number; driver?: { name: string; options?: Record<string, any> }; headers?: boolean; throwError?: boolean } - removed:
type ReferrerPolicyValue = 'no-referrer' | 'no-referrer-when-downgrade' | 'origin' | 'origin-when-cross-origin' | 'same-origin' | 'strict-origin' | 'strict-origin-when-cross-origin' | 'u… - removed:
type RequestSizeLimiter = { maxRequestSizeInBytes: number; maxUploadFileRequestInBytes: number; throwError?: boolean } - removed:
type Ssg = { meta?: boolean; hashScripts?: boolean; hashStyles?: boolean } - removed:
type StrictTransportSecurityValue = { maxAge: number; includeSubdomains?: boolean; preload?: boolean } - removed:
type XContentTypeOptionsValue = 'nosniff' - removed:
type XDnsPrefetchControlValue = 'on' | 'off' - removed:
type XDownloadOptionsValue = 'noopen' - removed:
type XFrameOptionsValue = 'DENY' | 'SAMEORIGIN' - removed:
type XPermittedCrossDomainPoliciesValue = 'none' | 'master-only' | 'by-content-type' | 'by-ftp-filename' | 'all' - removed:
type XssValidator = { methods?: Array<HTTPMethod>; whiteList?: Record<string, any>; escapeHtml?: boolean; stripIgnoreTag?: boolean; stripIgnoreTagBody?: boolean; css?: Record<stri… - changed:
const default: _nuxt_schema.NuxtModule<ModuleOptions> → const default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false> - added:
export { A as AllowedHTTPMethods } from './shared/nuxt-security.[hash]' - added:
export { B as BasicAuth } from './shared/nuxt-security.[hash]' - added:
export { C as ContentSecurityPolicyValue } from './shared/nuxt-security.[hash]' - added:
export { C as CorsOptions } from './shared/nuxt-security.[hash]' - added:
export { H as HTTPMethod } from './shared/nuxt-security.[hash]' - added:
export { H as HeaderName } from './shared/nuxt-security.[hash]' - added:
export { ModuleOptions } - added:
export { N as NuxtSecurityRouteRules } from './shared/nuxt-security.[hash]' - added:
export { O as OptionKey } from './shared/nuxt-security.[hash]' - added:
export { P as PermissionsPolicyValue } from './shared/nuxt-security.[hash]' - added:
export { R as ReferrerPolicyValue } from './shared/nuxt-security.[hash]' - added:
export { R as RequestSizeLimiter } from './shared/nuxt-security.[hash]' - added:
export { S as SecurityHeaders } from './shared/nuxt-security.[hash]' - added:
export { S as Ssg } from './shared/nuxt-security.[hash]' - added:
export { X as XContentTypeOptionsValue } from './shared/nuxt-security.[hash]' - added:
export { X as XssValidator } from './shared/nuxt-security.[hash]' - added:
export { a as Section } from './shared/nuxt-security.[hash]' - added:
export { a as StrictTransportSecurityValue } from './shared/nuxt-security.[hash]' - added:
export { b as CrossOriginResourcePolicyValue } from './shared/nuxt-security.[hash]' - added:
export { b as RateLimiter } from './shared/nuxt-security.[hash]' - added:
export { c as CrossOriginOpenerPolicyValue } from './shared/nuxt-security.[hash]' - added:
export { d as CrossOriginEmbedderPolicyValue } from './shared/nuxt-security.[hash]' - added:
export { e as XDnsPrefetchControlValue } from './shared/nuxt-security.[hash]' - added:
export { f as XDownloadOptionsValue } from './shared/nuxt-security.[hash]' - added:
export { g as XFrameOptionsValue } from './shared/nuxt-security.[hash]' - added:
export { h as XPermittedCrossDomainPoliciesValue } from './shared/nuxt-security.[hash]' - added:
export { i as CSPSourceValue } from './shared/nuxt-security.[hash]' - added:
export { j as CSPSandboxValue } from './shared/nuxt-security.[hash]'
- changed:
function useNonce(): any → function useNonce(): string | undefined
- added:
function getAppSecurityOptions(): Record<string, Partial<Omit<import('~/src/types/module').ModuleOptions, 'strict' | 'basicAuth' | 'rateLimiter' | 'ssg' | 'requestSizeLimiter' | 'removeLoggers'> & { rateLimiter: Omit<import('../../../types/middlewares.js').RateLimiter, 'driver'> | false } & { ssg: Omit<import('~/src/types/module').Ssg, 'exportToPresets'> | false } & { requestSizeLimiter: import('… - added:
function resolveSecurityRoute(event: H3Event): string - added:
function resolveSecurityRules(event: H3Event): NuxtSecurityRouteRules
- changed:
const _default: any → const _default: import('nitropack').NitroAppPlugin
- removed:
const _default: any - removed:
default _default
- removed:
const _default: any - removed:
default _default
- added:
const _default: import('nitropack').NitroAppPlugin - added:
default _default
- added:
const _default: import('nitropack').NitroAppPlugin - added:
default _default
- removed:
const _default: any - removed:
default _default
- added:
const _default: import('nitropack').NitroAppPlugin - added:
default _default
- removed:
const _default: any - removed:
default _default
- removed:
const _default: any - removed:
default _default
- added:
const _default: import('nitropack').NitroAppPlugin - added:
default _default
- removed:
const _default: any - removed:
default _default
- added:
const _default: import('nitropack').NitroAppPlugin - added:
default _default
- removed:
const _default: any - removed:
default _default
- added:
const _default: import('nitropack').NitroAppPlugin - added:
default _default
- removed:
const _default: any - removed:
default _default
- added:
const _default: import('nitropack').NitroAppPlugin - added:
default _default
- added:
const _default: import('nitropack').NitroAppPlugin - added:
default _default
- removed:
const _default: any - removed:
default _default
- removed:
const defuReplaceArray: <Source extends { [x: string]: any; [x: number]: any; [x: symbol]: any }, Defaults extends ({ [x: string]: any; [x: number]: any; [x: symbol]: any } | (number… - removed:
function resolveSecurityRoute(event: H3Event): string | undefined - removed:
function resolveSecurityRules(event: H3Event): Partial<Omit<import('../../../types').ModuleOptions, 'csrf' | 'basicAuth' | 'rateLimiter'> & { rateLimiter: false | Omit<import('../../../types/middlewares').RateLimiter, 'driver'> }>
- changed:
const _default: any → const _default: import('h3').EventHandler<import('h3').EventHandlerRequest, { statusCode: number; statusMessage: string } | undefined>
- changed:
const _default: any → const _default: import('h3').EventHandler<import('h3').EventHandlerRequest, void>
- changed:
const _default: any → const _default: import('h3').EventHandler<import('h3').EventHandlerRequest, true | undefined>
- changed:
const _default: any → const _default: import('h3').EventHandler<import('h3').EventHandlerRequest, Promise<{ statusCode: number; statusMessage: string } | undefined>>
- changed:
const _default: any → const _default: import('h3').EventHandler<import('h3').EventHandlerRequest, { statusCode: number; statusMessage: string } | undefined>
- changed:
const _default: any → const _default: import('h3').EventHandler<import('h3').EventHandlerRequest, Promise<{ statusCode: number; statusMessage: string } | undefined>>
- removed:
function generateHash(content: Buffer | string, hashAlgorithm: string): string - removed:
function hashBundledAssets(nitro: Nitro): Promise<Record<string, string>>
- removed:
const KEYS_TO_NAMES: Record<OptionKey, HeaderName> - removed:
function getKeyFromName(headerName: string): OptionKey | undefined - removed:
function getNameFromKey(key: OptionKey): HeaderName - removed:
function headerObjectFromString(optionKey: OptionKey, headerValue: string): string | false | ContentSecurityPolicyValue | StrictTransportSecurityValue | PermissionsPolicyValue - removed:
function headerStringFromObject(optionKey: OptionKey, optionValue: Exclude<SecurityHeaders[OptionKey], undefined>): string
- added:
declare module 'h3' - added:
declare module 'nitropack' - added:
declare module 'nitropack/types' - added:
declare module 'nuxt/schema' - added:
interface M - added:
interface S - added:
property M.allowedMethodsRestricter: AllowedHTTPMethods | false - added:
property M.basicAuth: BasicAuth | false - added:
property M.contentSecurityPolicyReportOnly: boolean - added:
property M.corsHandler: CorsOptions | false - added:
property M.csrf: ModuleOptions$1 | boolean - added:
property M.enabled: boolean - added:
property M.headers: SecurityHeaders | false - added:
property M.hidePoweredBy: boolean - added:
property M.nonce: boolean - added:
property M.rateLimiter: RateLimiter | false - added:
property M.removeLoggers: Options | boolean - added:
property M.requestSizeLimiter: RequestSizeLimiter | false - added:
property M.sri: boolean - added:
property M.ssg: Ssg | false - added:
property M.strict: boolean - added:
property M.xssValidator: XssValidator | false - added:
property S.contentSecurityPolicy?: ContentSecurityPolicyValue | false - added:
property S.crossOriginEmbedderPolicy?: CrossOriginEmbedderPolicyValue | false - added:
property S.crossOriginOpenerPolicy?: CrossOriginOpenerPolicyValue | false - added:
property S.crossOriginResourcePolicy?: CrossOriginResourcePolicyValue | false - added:
property S.originAgentCluster?: '?1' | false - added:
property S.permissionsPolicy?: PermissionsPolicyValue | false - added:
property S.referrerPolicy?: ReferrerPolicyValue | false - added:
property S.strictTransportSecurity?: StrictTransportSecurityValue | false - added:
property S.xContentTypeOptions?: XContentTypeOptionsValue | false - added:
property S.xDNSPrefetchControl?: XDnsPrefetchControlValue | false - added:
property S.xDownloadOptions?: XDownloadOptionsValue | false - added:
property S.xFrameOptions?: XFrameOptionsValue | false - added:
property S.xPermittedCrossDomainPolicies?: XPermittedCrossDomainPoliciesValue | false - added:
property S.xXSSProtection?: string | false - added:
type A = { methods: HTTPMethod[] | '*'; throwError?: boolean } - added:
type B = { exclude?: string[]; include?: string[]; name: string; pass: string; enabled?: boolean; message: string } - added:
type C = { 'child-src'?: CSPSourceValue[] | string | false; 'connect-src'?: CSPSourceValue[] | string | false; 'default-src'?: CSPSourceValue[] | string | false; 'font-… - added:
type C = { origin?: '*' | string | string[]; useRegExp?: boolean; methods?: '*' | HTTPMethod[]; allowHeaders?: '*' | string[]; exposeHeaders?: '*' | string[]; credentia… - added:
type H = 'Content-Security-Policy' | 'Content-Security-Policy-Report-Only' | 'Cross-Origin-Embedder-Policy' | 'Cross-Origin-Opener-Policy' | 'Cross-Origin-Resource-Poli… - added:
type H = 'GET' | 'POST' | 'DELETE' | 'PATCH' | 'PUT' | 'TRACE' | 'OPTIONS' | 'CONNECT' | 'HEAD' - added:
type N = Partial<Omit<ModuleOptions, 'strict' | 'basicAuth' | 'rateLimiter' | 'ssg' | 'requestSizeLimiter' | 'removeLoggers'> & { rateLimiter: Omit<RateLimiter, 'driver… - added:
type O = 'contentSecurityPolicy' | 'crossOriginEmbedderPolicy' | 'crossOriginOpenerPolicy' | 'crossOriginResourcePolicy' | 'originAgentCluster' | 'referrerPolicy' | 'st… - added:
type P = { 'camera'?: string[] | string | false; 'display-capture'?: string[] | string | false; 'fullscreen'?: string[] | string | false; 'geolocation'?: string[] | str… - added:
type R = 'no-referrer' | 'no-referrer-when-downgrade' | 'origin' | 'origin-when-cross-origin' | 'same-origin' | 'strict-origin' | 'strict-origin-when-cross-origin' | 'u… - added:
type R = { maxRequestSizeInBytes?: number; maxUploadFileRequestInBytes?: number; throwError?: boolean } - added:
type S = { meta?: boolean; hashScripts?: boolean; hashStyles?: boolean; nitroHeaders?: boolean; exportToPresets?: boolean } - added:
type X = 'nosniff' - added:
type X = { methods?: Array<HTTPMethod>; whiteList?: Record<string, any>; escapeHtml?: boolean; stripIgnoreTag?: boolean; stripIgnoreTagBody?: boolean; css?: Record<stri… - added:
type a = 'body' | 'bodyAppend' | 'bodyPrepend' | 'head' - added:
type a = { maxAge: number; includeSubdomains?: boolean; preload?: boolean } - added:
type b = 'same-site' | 'same-origin' | 'cross-origin' - added:
type b = { tokensPerInterval?: number; interval?: string | number; driver?: { [driverName in keyof BuiltinDriverOptions]: { name: driverName; options?: BuiltinDriverOpt… - added:
type c = 'unsafe-none' | 'same-origin-allow-popups' | 'same-origin' - added:
type d = 'unsafe-none' | 'require-corp' | 'credentialless' - added:
type e = 'on' | 'off' - added:
type f = 'noopen' - added:
type g = 'DENY' | 'SAMEORIGIN' - added:
type h = 'none' | 'master-only' | 'by-content-type' | 'by-ftp-filename' | 'all' - added:
type i = "'self'" | "'unsafe-eval'" | "'wasm-unsafe-eval'" | "'unsafe-hashes'" | "'unsafe-inline'" | "'none'" | "'strict-dynamic'" | "'report-sample'" | "'nonce=<base64… - added:
type j = 'allow-downloads' | 'allow-downloads-without-user-activation' | 'allow-forms' | 'allow-modals' | 'allow-orientation-lock' | 'allow-pointer-lock' | 'allow-popup…
- added:
export { AllowedHTTPMethods } from './shared/nuxt-security.[hash]' - added:
export { BasicAuth } from './shared/nuxt-security.[hash]' - added:
export { CSPSandboxValue } from './shared/nuxt-security.[hash]' - added:
export { CSPSourceValue } from './shared/nuxt-security.[hash]' - added:
export { ContentSecurityPolicyValue } from './shared/nuxt-security.[hash]' - added:
export { CorsOptions } from './shared/nuxt-security.[hash]' - added:
export { CrossOriginEmbedderPolicyValue } from './shared/nuxt-security.[hash]' - added:
export { CrossOriginOpenerPolicyValue } from './shared/nuxt-security.[hash]' - added:
export { CrossOriginResourcePolicyValue } from './shared/nuxt-security.[hash]' - added:
export { HTTPMethod } from './shared/nuxt-security.[hash]' - added:
export { HeaderName } from './shared/nuxt-security.[hash]' - added:
export { ModuleOptions } from './module' - added:
export { NuxtSecurityRouteRules } from './shared/nuxt-security.[hash]' - added:
export { OptionKey } from './shared/nuxt-security.[hash]' - added:
export { PermissionsPolicyValue } from './shared/nuxt-security.[hash]' - added:
export { RateLimiter } from './shared/nuxt-security.[hash]' - added:
export { ReferrerPolicyValue } from './shared/nuxt-security.[hash]' - added:
export { RequestSizeLimiter } from './shared/nuxt-security.[hash]' - added:
export { Section } from './shared/nuxt-security.[hash]' - added:
export { SecurityHeaders } from './shared/nuxt-security.[hash]' - added:
export { Ssg } from './shared/nuxt-security.[hash]' - added:
export { StrictTransportSecurityValue } from './shared/nuxt-security.[hash]' - added:
export { XContentTypeOptionsValue } from './shared/nuxt-security.[hash]' - added:
export { XDnsPrefetchControlValue } from './shared/nuxt-security.[hash]' - added:
export { XDownloadOptionsValue } from './shared/nuxt-security.[hash]' - added:
export { XFrameOptionsValue } from './shared/nuxt-security.[hash]' - added:
export { XPermittedCrossDomainPoliciesValue } from './shared/nuxt-security.[hash]' - added:
export { XssValidator } from './shared/nuxt-security.[hash]' - added:
export { default } from './module'
- added:
function generateHash(content: Buffer | string, hashAlgorithm: 'SHA-256' | 'SHA-384' | 'SHA-512'): Promise<string> - added:
function generateRandomNonce(): string
- added:
function backwardsCompatibleSecurity(securityHeaders?: SecurityHeaders | false): SecurityHeaders | undefined - added:
function getHeadersApplicableToAllResources(headers: SecurityHeaders): Record<HeaderName, string> | undefined - added:
function getKeyFromName(headerName: string): OptionKey | undefined - added:
function getNameFromKey(key: OptionKey): HeaderName - added:
function headerObjectFromString(optionKey: OptionKey, headerValue: string): string | false | ContentSecurityPolicyValue | StrictTransportSecurityValue | PermissionsPolicyValue - added:
function headerStringFromObject(optionKey: OptionKey, optionValue: Exclude<SecurityHeaders[OptionKey], undefined>): string - added:
function standardToSecurity(standardHeaders?: Record<string, any>): SecurityHeaders | undefined
- added:
const defuReplaceArray: <Source extends { [x: string]: any; [x: number]: any; [x: symbol]: any }, Defaults extends Array<{ [x: string]: any; [x: number]: any; [x: symbol]: any } | (nu…