Update dependency vuetify to v3 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
vuetify (source)	2.6.4 → 3.0.0

GitHub Vulnerability Alerts

CVE-2022-25873

The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component.

CVE-2025-8083

The Preset configuration feature of Vuetify is vulnerable to Prototype Pollution due to the internal 'mergeDeep' utility function used to merge options with defaults. Using a specially-crafted, malicious preset can result in polluting all JavaScript objects with arbitrary properties, which can further negatively affect all aspects of the application's behavior. This can lead to a wide range of security issues, including resource exhaustion/denial of service or unauthorized access to data.

If the application utilizes Server-Side Rendering (SSR), this vulnerability could affect the whole server process.

This issue affects Vuetify versions greater than or equal to 2.2.0-beta.2 and less than 3.0.0-alpha.10.

Note:
Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see here https://v2.vuetifyjs.com/en/about/eol/ .

CVE-2025-8082

Improper neutralization of the title date in the 'VDatePicker' component in Vuetify, allows unsanitized HTML to be inserted into the page. This can lead to a Cross-Site Scripting (XSS) https://owasp.org/www-community/attacks/xss  attack. The vulnerability occurs because the 'title-date-format' property of the 'VDatePicker' can accept a user created function and assign its output to the 'innerHTML' property of the title element without sanitization.

This issue affects Vuetify versions greater than or equal to 2.0.0 and less than 3.0.0.

Note:
Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see here https://v2.vuetifyjs.com/en/about/eol/ .

---

Release Notes

vuetifyjs/vuetify (vuetify)

v3.0.0

Compare Source

v3.0.0 (Titan)

Welcome to the v3.0.0 release of Vuetify!

Supporting Vuetify

Vuetify is an open source MIT project that has been made possible due to the generous contributions by sponsors and backers. If you are interested in supporting this project, please consider:

• Becoming a sponsor on Github
  • John Leider
  • Kael Watts-Deuchar
• Becoming a sponsor on Patreon
• Make a one-time payment with Paypal
• Supporting the Core Team on Open Collective (supports the core team)
• Becoming a subscriber on Tidelift
• Direct support from Vuetify

❗️ Important Links

• Vuetify Store
• Documentation
• Report a Bug
• Community Discord
• Twitter

💯 Release notes

🚀 Features

• theme: rename code/kbd variables to match conventions (18537d3)
• VList: add keyboard navigation (#​15998) (48ef134), closes #​15428

🔧 Bug Fixes

• don't destroy components when transition value changes (e6b0d7a), closes #​15995
• types: add shims to UMD types (fce23d1)
• types: remove UMD package export (e23e92c)
• types: expose LocaleMessages interface (3a2dbd3)
• validation: add validate-on prop (#​15979) (c669540), closes #​15976
• VDialog: explicit prop definitions (#​15971) (be3ceca), closes #​15967
• VIcon: add collapse alias for mdi-svg (#​15963) (fa841a3)
• VTabs: respect height prop (6c5b180), closes #​15972

v2.7.2

Compare Source

🔧 Bug Fixes

• update types (#​16951) (7e3d35d)
• check both $slots and $scopedSlots, normalise slot case (7d67046), closes #​8676 #​15293
• locale: Update French translations (#​18215) (ceeafb6)
• VAutocomplete: highlight correct item in list on click (bc48f00), closes #​17201
• VSelect: don't blur input on menu mousedown (0a77965), closes #​15839

v2.7.1

Compare Source

🔧 Bug Fixes

• VSelect: don't update scroll position if menu is closed (c53b2f8), closes #​17085
• VTabs: remove quotes from text-transform (#​17771) (153d17b), closes #​17799

v2.7.0

Compare Source

🚀 Features

• styles: add xxl border-radius option (#​14546) (018525e)
• VDataTable: backport filterMode prop from v3 (#​17747) (05c10a3), closes #​11600
• VDataTable: add item-style prop (#​15332) (13c5765), closes #​15049
• VDataTable: forward arbitrary row events (#​15617) (243efcc), closes #​13332
• VDataTable: expose row default props to item slots (#​15711) (034ca21)
• VExpansionPanel: add open prop to content and header slots (7738eee), closes #​15782
• VForm: allow individual inputs to be enabled in disabled form (42ec8c5), closes #​17391
• VInput: add locale keys for append/prepend buttons (#​15612) (980ef7f), closes #​12582
• VMenu: add contentProps prop (#​15865) (48de295)
• VPagination: add props for coloring navigation buttons (#​15691) (a85b85f)
• VSlideGroup: add show-arrows="never" (#​14587) (354a999), closes #​14586
• VTab: add tabValue prop (#​16383) (d4421cf), closes #​10540
• VTabs: add tab-text-transform SASS variable (#​14545) (8253c7e)
• VTimePicker: add activePicker prop (#​14632) (09f1102), closes #​14629

🔧 Bug Fixes

• VItem: support disabled effect (#​14941) (415322d), closes #​14923
• VMenu: ignore key presses when disable-keys is true (#​16464) (922e05a), closes #​12998
• VSkeletonLoader: apply aria-label for screenreaders (#​17073) (a0d8d34), closes #​10999

v2.6.16

Compare Source

🔧 Bug Fixes

• icons: FA5 warning icon alias more consistent with MDI (#​15607) (3c525fe)
• VDataTable: add class to root element when show-select (#​14987) (ee72ee5)
• VDialog: check if scrolling element parentNode exists (e148110), closes #​15977
• VIcon: center button icon in system bar (#​15918) (bc7a264), closes #​14975
• VMenu: prefer existing menuProps.attach (50ea98d), closes #​7547
• VSelect: update lastItem when selection changes with hideSelected (b121493), closes #​17085
• VTextarea: correctly apply reverse prop styles (#​15858) (1e4b2f7), closes #​15432

v2.6.15

Compare Source

🔧 Bug Fixes

• remove charset statement from vuetify.css (3b5fbe9), closes #​16989
• VColorPicker: correct swatches-padding variable name (bb152d4), closes #​14887 #​14878
• VDataIterator: check shiftKey on any keypress (8ad6f7b), closes #​16128
• VLabel: inherit attrs (116bcab), closes #​16938
• VSelect: only lookup keypresses for printable characters (e4208c8), closes #​7260

v2.6.14

Compare Source

🔧 Bug Fixes

• locale: update arabic translations (#​16290) (9169a06), closes #​16185

v2.6.13

Compare Source

🔧 Bug Fixes

• ripple: check parent before calling removeChild (#​14573) (63c2267), closes #​13457
• VAutocomplete: remove unused allowOverflow prop (f16c2c5), closes #​16008
• VDataTable: native event as argument to click:row (#​15864) (17dd133), closes #​10302

v2.6.12

Compare Source

🔧 Bug Fixes

• VCalendar: display name on all-day events in event slot (30b7281), closes #​15915
• VCombobox: emit paste event (7417807), closes #​11186
• VFileInput: label click opens dialog twice (#​15902) (7c9f717), closes #​15888
• VStepper: increate error label selector specificity (785de11), closes #​15886

v2.6.11

Compare Source

🔧 Bug Fixes

• click-outside: remove unused vnode reference (4d3359a)

v2.6.10

Compare Source

🔧 Bug Fixes

• VCalendar: prevent XSS from eventName function (ade1434), closes #​15757
• VDialog: don't try to focus tabindex="-1" or hidden inputs (89e3850), closes #​15745
• VMenu: disable activatorFixed when attach is enabled (#​15709) (464529a), closes #​14922
• VTextField: only show clear icon on hover or when focused (7a51ad0)
• VTextField: prevent tabbing to clear button (f8ee680), closes #​11202
• web-types: add support for VDataTable pattern slots (#​15694) (ac45c98)

🔬 Code Refactoring

• VSelect: render highlight with vnodes instead of innerHTML (4468e3c)

BREAKING CHANGES

• VCalendar: eventName function can no longer render arbitrary HTML, convert to VNodes instead.
  eventSummary can no longer be used with v-html, replace with <component :is="{ render: eventSummary }" />

v2.6.9

Compare Source

🔧 Bug Fixes

• VCalendar: add aria roles to monthly calendar (#​14640) (2cd34b4), closes #​14604
• VCalendar: forward all bound events to internal elements (#​15592) (299330c)
• VCarousel: add keys to delimiter buttons (#​15459) (8d3895b)
• VPagination: ignore invalid length values (f3f8d15), closes #​15499
• VRadio: change icon color when disabled (0cc43e2)
• VSwitch: only affect control opacity when disabled (1e0a4ad)

v2.6.8

Compare Source

🔧 Bug Fixes

• VDataTable: display header text instead of value in group headers (100053f), closes #​11516
• VItemGroup: use valueComparator when updating value (#​15395) (8bedb7c), closes #​15394
• VSimpleCheckbox: directly specify ripple directive definition (00a9668), closes #​12224

v2.6.7

Compare Source

🔧 Bug Fixes

• styles: resolve css validation errors (621f273), closes #​15320
• VDialog: focus on internal content when shown (#​14584) (ffbaae1), closes #​14581
• VInput: allow text selection in disabled inputs (#​14465) (760490d), closes #​14238
• VList: don't trigger keyboard events on disabled items (#​15339) (817df79), closes #​15322
• VOtpInput: support paste and autofill on mobile (8c67ed8), closes #​14801
• VRadio: use correct disabled color for icons (3115798)
• VSelect: allow keyboard selection of items with value 0 (969aba4), closes #​15166
• VTabs: use ResizeObserver if available (ff519c6), closes #​4733 #​10455 #​12783 #​14195 #​15316
• VTimeline: disable arrow shadow on clickable cards (27ba2c9), closes #​14193

v2.6.6

Compare Source

🔧 Bug Fixes

• locale: update catalan translations (#​15012) (2eab4f2)
• mdi-svg: update contextual icons (5918484), closes #​14327
• VOverflowBtn: make persistentPlaceholder label visible (#​15055) (002afbe), closes #​15052
• VSelect: set min-height on correct element (d41a327), closes #​15047

🔬 Code Refactoring

• VDatePicker: single split call (#​15082) (dc48652)

v2.6.5

Compare Source

🔧 Bug Fixes

• locale: add missing Finnish translations (#​14824) (f0e5889)
• locale: improve spanish translations (#​14965) (a427b96)
• selection controls: emit focus/blur events (75404fb), closes #​14862
• VCalendar: fix transparent header on category calendar (#​14725) (33002fa), closes #​14723
• VImg: accept scopedSlots (96888d5), closes #​14686
• VTreeview: independent selection inheriting parent state (#​14956) (2034df6), closes #​14955

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm ERR! code ERESOLVE
npm ERR! ERESOLVE could not resolve
npm ERR! 
npm ERR! While resolving: sass-loader@10.2.1
npm ERR! Found: node-sass@7.0.0
npm ERR! node_modules/node-sass
npm ERR!   dev node-sass@"7.0.0" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peerOptional node-sass@"^4.0.0 || ^5.0.0 || ^6.0.0" from sass-loader@10.2.1
npm ERR! node_modules/sass-loader
npm ERR!   dev sass-loader@"10.2.1" from the root project
npm ERR!   sass-loader@"^10.2.0" from @nuxtjs/vuetify@1.12.3
npm ERR!   node_modules/@nuxtjs/vuetify
npm ERR!     dev @nuxtjs/vuetify@"1.12.3" from the root project
npm ERR! 
npm ERR! Conflicting peer dependency: node-sass@6.0.1
npm ERR! node_modules/node-sass
npm ERR!   peerOptional node-sass@"^4.0.0 || ^5.0.0 || ^6.0.0" from sass-loader@10.2.1
npm ERR!   node_modules/sass-loader
npm ERR!     dev sass-loader@"10.2.1" from the root project
npm ERR!     sass-loader@"^10.2.0" from @nuxtjs/vuetify@1.12.3
npm ERR!     node_modules/@nuxtjs/vuetify
npm ERR!       dev @nuxtjs/vuetify@"1.12.3" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /tmp/renovate-cache/others/npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /tmp/renovate-cache/others/npm/_logs/2022-09-25T18_23_53_420Z-debug-0.log

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR! 
npm ERR! While resolving: scroll-icon-generator@0.1.0
npm ERR! Found: vue@2.6.14
npm ERR! node_modules/vue
npm ERR!   vue@"2.6.14" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer vue@"^3.2.0" from vuetify@3.0.0
npm ERR! node_modules/vuetify
npm ERR!   vuetify@"3.0.0" from the root project
npm ERR!   peer vuetify@"^3.0.0-beta.4" from vite-plugin-vuetify@1.0.2
npm ERR!   node_modules/vite-plugin-vuetify
npm ERR!     peerOptional vite-plugin-vuetify@"^1.0.0-alpha.12" from vuetify@3.0.0
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /runner/cache/others/npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /runner/cache/others/npm/_logs/2026-02-18T17_39_53_002Z-debug-0.log