perf: address some regressions

[danielroe]

🔗 Linked issue

📚 Description

opening to run CI

[pkg-pr-new]

• nuxt-cli-playground

  npm i https://pkg.pr.new/create-nuxt@1589
  

  npm i https://pkg.pr.new/nuxi@1589
  

  npm i https://pkg.pr.new/@nuxt/cli@1589
  

commit: 91111b8

[github-actions]

CLI benchmark

@nuxt/cli v4.0.0-alpha.1 (baseline) vs v4.0.0-alpha.1 (this PR)

Metric	baseline v4.0.0-alpha.1	head v4.0.0-alpha.1	Delta
nuxt --version wall time (median)	87 ms	65 ms	-25.0%
nuxt --help wall time (median)	143 ms	137 ms	-4.8%
nuxt dev --help wall time (median)	102 ms	101 ms	-0.7%
nuxt --version modules loaded	36	35	-2.8%
nuxt --version built-ins loaded	77	27	-64.9%
nuxt --help modules loaded	144	134	-6.9%
nuxt --help built-ins loaded	87	87	0.0%
nuxt dev --help modules loaded	63	63	0.0%
nuxt dev --help built-ins loaded	87	87	0.0%
Installed node_modules	2.43 MB	2.43 MB	+0.0%
Published tarball (packed)	239.3 kB	239.6 kB	+0.1%

Full report

@nuxt/cli v4.0.0-alpha.1 (baseline) vs v4.0.0-alpha.1 (head)

Setting	Value
Baseline	ref:891cde8b04390816e35a750d1981d56bb3460258 (v4.0.0-alpha.1)
Head	local packages/nuxt-cli at 32a3dcb (v4.0.0-alpha.1)
Node	v24.21.0
OS	Linux 6.17.0 (kernel 6.17.0-1022-azure)
CPU	AMD EPYC 7763 64-Core Processor x 4
Memory	15.6 GB
Load average at start	0.57, 0.16, 0.05
Run started	2026-10-03T15:41:30.071Z

Cold CLI startup

Median of 15 interleaved runs per command, one warmup discarded.

Command	baseline v4.0.0-alpha.1 median	head v4.0.0-alpha.1 median	Delta	baseline v4.0.0-alpha.1 min / p95	head v4.0.0-alpha.1 min / p95
nuxt --version	87 ms	65 ms	-25.0%	84 ms / 92 ms	62 ms / 69 ms
nuxt --version (first output byte)	81 ms	61 ms	-25.3%	79 ms / 86 ms	58 ms / 64 ms
nuxt --help	143 ms	137 ms	-4.8%	141 ms / 153 ms	133 ms / 143 ms
nuxt --help (first output byte)	138 ms	132 ms	-4.8%	135 ms / 147 ms	128 ms / 138 ms
nuxt dev --help	102 ms	101 ms	-0.7%	99 ms / 111 ms	98 ms / 107 ms
nuxt dev --help (first output byte)	97 ms	97 ms	-0.1%	94 ms / 105 ms	94 ms / 102 ms
nuxt <unknown-command> (no-op)	154 ms	149 ms	-3.4%	147 ms / 159 ms	142 ms / 157 ms
nuxt <unknown-command> (no-op) (first output byte)	148 ms	143 ms	-3.8%	141 ms / 153 ms	136 ms / 151 ms

Module load cost

Counted with a module.registerHooks load hook, compile cache disabled. Counts every JS module actually evaluated on that code path (native addons excluded). Built-ins loaded after bootstrap are counted separately, including the internal modules they load.

Command	baseline v4.0.0-alpha.1 modules	head v4.0.0-alpha.1 modules	Delta	baseline v4.0.0-alpha.1 source bytes	head v4.0.0-alpha.1 source bytes	Delta	baseline v4.0.0-alpha.1 built-ins	head v4.0.0-alpha.1 built-ins	Delta
nuxt --version	36	35	-2.8%	297.8 kB	297.8 kB	+0.0%	77	27	-64.9%
nuxt --help	144	134	-6.9%	956.6 kB	839.9 kB	-12.2%	87	87	0.0%
nuxt dev --help	63	63	0.0%	452.9 kB	453.0 kB	+0.0%	87	87	0.0%

Install footprint and published tarball

Each version installed on its own into an empty project with nothing but @nuxt/cli as a dependency, so the tree is exactly the CLI and its transitive dependencies. npm cache is warm and the registry is only consulted for metadata, so install wall time is indicative, not a network benchmark.

Metric	baseline v4.0.0-alpha.1	head v4.0.0-alpha.1	Delta
Direct dependencies of @nuxt/cli	23	23	0.0%
Packages in the installed tree (unique name@version)	39	39	0.0%
Unique package names	39	39	0.0%
Package directories on disk (cross-check)	32	32	0.0%
Installed node_modules on disk	2.43 MB	2.43 MB	+0.0%
Installed files	432	434	+0.5%
Install wall time (warm npm cache, median of 3)	1.26 s	1.26 s	-0.1%
Published tarball (packed)	239.3 kB	239.6 kB	+0.1%
Published tarball (unpacked)	774.2 kB	775.2 kB	+0.1%
Files in tarball	97	99	+2.1%

Interleaved runs on a shared runner: trust the deltas, not the absolute timings. The dev, restart and build suites run locally via pnpm bench:cli.

[codspeed]

Merging this PR will not alter performance

✅ 2 untouched benchmarks

---

_{Comparing perf/regressions (91111b8) with main (891cde8)}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2b344da4-76eb-4308-a2b0-9edbba4cbdd4

📥 Commits

Reviewing files that changed from the base of the PR and between 891cde8 and 91111b8.

📒 Files selected for processing (15)

• bench/README.md
• bench/lib/module-hook.mjs
• bench/run.ts
• bench/suites/modules.ts
• packages/nuxt-cli/src/commands/docs.ts
• packages/nuxt-cli/src/commands/info.ts
• packages/nuxt-cli/src/commands/module/add.ts
• packages/nuxt-cli/src/commands/upgrade.ts
• packages/nuxt-cli/src/dev/tui/index.ts
• packages/nuxt-cli/src/utils/network.ts
• packages/nuxt-cli/src/utils/registry.ts
• packages/nuxt-cli/src/utils/release-notes.ts
• packages/nuxt-cli/src/utils/update-check.ts
• packages/nuxt-cli/src/utils/versions.ts
• packages/nuxt-cli/test/unit/utils/release-notes.spec.ts

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The benchmark now counts built-in modules loaded after startup and includes those counts in its output. Several CLI utilities load dependencies dynamically at their use sites. The docs command passes complete documentation URLs to its navigation function. Release URL generation moves to a dedicated utility.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 91111

The changed CLI and benchmark paths have no identified merge-blocking issue; this PR is ready for normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 91111

The inspected changes preserve existing browser-launch authority and release-link behavior while adding benchmark measurements. No introduced security issue was established. Coverage of cached documentation integrity and other deferred-load consumers remains incomplete.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — The benchmark continues to execute target binaries through the same Node subprocess invocation, working directory, and environment options. Adding built-in counts does not expand that execution authority or add an attacker-controlled command input.

Trust Boundaries and Controls

• observed — The inspected documentation flow retains the existing browser sink and open flag. CLI queries select documentation results rather than becoming direct browser-command inputs. The URL-construction refactor preserves prior strings, including reliance on cached index contents; cache provenance and integrity were not fully established.

Resilience and Maintainability Implications

• observed — The added measurement snapshots child-process module-load state at initialization and computes the additional count synchronously on exit. Each invocation has its own snapshot; the change introduces no shared reservation, credential, or persistent control state. Missing statistics still cause the suite to fail rather than silently produce a successful result.

🚥 Pre-merge checks | ✅ 3 | ❌ 1 | ❓ 1

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 45.45% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 11 functions across 14 files. (1 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.
Description check	❓ Inconclusive	The description only says “opening to run CI.” It does not describe any change in the pull request.	Add a brief description of the startup-path performance changes, such as the lazy imports and built-in module counting.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title identifies performance regressions as the focus. This broadly matches the startup-path performance changes in the pull request.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 45.45% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 11 functions across 14 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}