Update dependency vuetify to v3 [SECURITY] #82

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Open

renovate wants to merge 1 commit into main from renovate/npm-vuetify-vulnerability

Contributor

renovate bot commented Dec 13, 2025 •

edited

Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
vuetify (source)	`^2.4.0` → `^3.0.0`

GitHub Vulnerability Alerts

CVE-2025-8082

Improper neutralization of the title date in the 'VDatePicker' component in Vuetify, allows unsanitized HTML to be inserted into the page. This can lead to a Cross-Site Scripting (XSS) https://owasp.org/www-community/attacks/xss attack. The vulnerability occurs because the 'title-date-format' property of the 'VDatePicker' can accept a user created function and assign its output to the 'innerHTML' property of the title element without sanitization.

This issue affects Vuetify versions greater than or equal to 2.0.0 and less than 3.0.0.

Note:
Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see here https://v2.vuetifyjs.com/en/about/eol/ .

Release Notes

vuetifyjs/vuetify (vuetify)

`v3.0.0`

v3.0.0 (Titan)

Welcome to the v3.0.0 release of Vuetify!

Supporting Vuetify

Vuetify is an open source MIT project that has been made possible due to the generous contributions by sponsors and backers. If you are interested in supporting this project, please consider:

Becoming a sponsor on Github
- John Leider
- Kael Watts-Deuchar
Becoming a sponsor on Patreon
Make a one-time payment with Paypal
Supporting the Core Team on Open Collective (supports the core team)
Becoming a subscriber on Tidelift
Direct support from Vuetify

❗️ Important Links

💯 Release notes

🚀 Features

theme: rename code/kbd variables to match conventions (18537d3)
VList: add keyboard navigation (#15998) (48ef134), closes #15428

🔧 Bug Fixes

don't destroy components when transition value changes (e6b0d7a), closes #15995
types: add shims to UMD types (fce23d1)
types: remove UMD package export (e23e92c)
types: expose LocaleMessages interface (3a2dbd3)
validation: add validate-on prop (#15979) (c669540), closes #15976
VDialog: explicit prop definitions (#15971) (be3ceca), closes #15967
VIcon: add collapse alias for mdi-svg (#15963) (fa841a3)
VTabs: respect height prop (6c5b180), closes #15972

`v2.7.2`

🔧 Bug Fixes

update types (#16951) (7e3d35d)
check both $slots and $scopedSlots, normalise slot case (7d67046), closes #8676 #15293
locale: Update French translations (#18215) (ceeafb6)
VAutocomplete: highlight correct item in list on click (bc48f00), closes #17201
VSelect: don't blur input on menu mousedown (0a77965), closes #15839

`v2.7.1`

🔧 Bug Fixes

VSelect: don't update scroll position if menu is closed (c53b2f8), closes #17085
VTabs: remove quotes from text-transform (#17771) (153d17b), closes #17799

`v2.7.0`

🚀 Features

styles: add xxl border-radius option (#14546) (018525e)
VDataTable: backport filterMode prop from v3 (#17747) (05c10a3), closes #11600
VDataTable: add item-style prop (#15332) (13c5765), closes #15049
VDataTable: forward arbitrary row events (#15617) (243efcc), closes #13332
VDataTable: expose row default props to item slots (#15711) (034ca21)
VExpansionPanel: add open prop to content and header slots (7738eee), closes #15782
VForm: allow individual inputs to be enabled in disabled form (42ec8c5), closes #17391
VInput: add locale keys for append/prepend buttons (#15612) (980ef7f), closes #12582
VMenu: add contentProps prop (#15865) (48de295)
VPagination: add props for coloring navigation buttons (#15691) (a85b85f)
VSlideGroup: add show-arrows="never" (#14587) (354a999), closes #14586
VTab: add tabValue prop (#16383) (d4421cf), closes #10540
VTabs: add tab-text-transform SASS variable (#14545) (8253c7e)
VTimePicker: add activePicker prop (#14632) (09f1102), closes #14629

🔧 Bug Fixes

VItem: support disabled effect (#14941) (415322d), closes #14923
VMenu: ignore key presses when disable-keys is true (#16464) (922e05a), closes #12998
VSkeletonLoader: apply aria-label for screenreaders (#17073) (a0d8d34), closes #10999

`v2.6.16`

🔧 Bug Fixes

icons: FA5 warning icon alias more consistent with MDI (#15607) (3c525fe)
VDataTable: add class to root element when show-select (#14987) (ee72ee5)
VDialog: check if scrolling element parentNode exists (e148110), closes #15977
VIcon: center button icon in system bar (#15918) (bc7a264), closes #14975
VMenu: prefer existing menuProps.attach (50ea98d), closes #7547
VSelect: update lastItem when selection changes with hideSelected (b121493), closes #17085
VTextarea: correctly apply reverse prop styles (#15858) (1e4b2f7), closes #15432

`v2.6.15`

🔧 Bug Fixes

remove charset statement from vuetify.css (3b5fbe9), closes #16989
VColorPicker: correct swatches-padding variable name (bb152d4), closes #14887 #14878
VDataIterator: check shiftKey on any keypress (8ad6f7b), closes #16128
VLabel: inherit attrs (116bcab), closes #16938
VSelect: only lookup keypresses for printable characters (e4208c8), closes #7260

`v2.6.14`

🔧 Bug Fixes

locale: update arabic translations (#16290) (9169a06), closes #16185

`v2.6.13`

🔧 Bug Fixes

ripple: check parent before calling removeChild (#14573) (63c2267), closes #13457
VAutocomplete: remove unused allowOverflow prop (f16c2c5), closes #16008
VDataTable: native event as argument to click:row (#15864) (17dd133), closes #10302

`v2.6.12`

🔧 Bug Fixes

VCalendar: display name on all-day events in event slot (30b7281), closes #15915
VCombobox: emit paste event (7417807), closes #11186
VFileInput: label click opens dialog twice (#15902) (7c9f717), closes #15888
VStepper: increate error label selector specificity (785de11), closes #15886

`v2.6.11`

🔧 Bug Fixes

click-outside: remove unused vnode reference (4d3359a)

`v2.6.10`

🔧 Bug Fixes

VCalendar: prevent XSS from eventName function (ade1434), closes #15757
VDialog: don't try to focus tabindex="-1" or hidden inputs (89e3850), closes #15745
VMenu: disable activatorFixed when attach is enabled (#15709) (464529a), closes #14922
VTextField: only show clear icon on hover or when focused (7a51ad0)
VTextField: prevent tabbing to clear button (f8ee680), closes #11202
web-types: add support for VDataTable pattern slots (#15694) (ac45c98)

🔬 Code Refactoring

VSelect: render highlight with vnodes instead of innerHTML (4468e3c)

BREAKING CHANGES

VCalendar: eventName function can no longer render arbitrary HTML, convert to VNodes instead.
eventSummary can no longer be used with v-html, replace with <component :is="{ render: eventSummary }" />

`v2.6.9`

🔧 Bug Fixes

VCalendar: add aria roles to monthly calendar (#14640) (2cd34b4), closes #14604
VCalendar: forward all bound events to internal elements (#15592) (299330c)
VCarousel: add keys to delimiter buttons (#15459) (8d3895b)
VPagination: ignore invalid length values (f3f8d15), closes #15499
VRadio: change icon color when disabled (0cc43e2)
VSwitch: only affect control opacity when disabled (1e0a4ad)

`v2.6.8`

🔧 Bug Fixes

VDataTable: display header text instead of value in group headers (100053f), closes #11516
VItemGroup: use valueComparator when updating value (#15395) (8bedb7c), closes #15394
VSimpleCheckbox: directly specify ripple directive definition (00a9668), closes #12224

`v2.6.7`

🔧 Bug Fixes

styles: resolve css validation errors (621f273), closes #15320
VDialog: focus on internal content when shown (#14584) (ffbaae1), closes #14581
VInput: allow text selection in disabled inputs (#14465) (760490d), closes #14238
VList: don't trigger keyboard events on disabled items (#15339) (817df79), closes #15322
VOtpInput: support paste and autofill on mobile (8c67ed8), closes #14801
VRadio: use correct disabled color for icons (3115798)
VSelect: allow keyboard selection of items with value 0 (969aba4), closes #15166
VTabs: use ResizeObserver if available (ff519c6), closes #4733 #10455 #12783 #14195 #15316
VTimeline: disable arrow shadow on clickable cards (27ba2c9), closes #14193

`v2.6.6`

🔧 Bug Fixes

locale: update catalan translations (#15012) (2eab4f2)
mdi-svg: update contextual icons (5918484), closes #14327
VOverflowBtn: make persistentPlaceholder label visible (#15055) (002afbe), closes #15052
VSelect: set min-height on correct element (d41a327), closes #15047

🔬 Code Refactoring

VDatePicker: single split call (#15082) (dc48652)

`v2.6.5`

🔧 Bug Fixes

locale: add missing Finnish translations (#14824) (f0e5889)
locale: improve spanish translations (#14965) (a427b96)
selection controls: emit focus/blur events (75404fb), closes #14862
VCalendar: fix transparent header on category calendar (#14725) (33002fa), closes #14723
VImg: accept scopedSlots (96888d5), closes #14686
VTreeview: independent selection inheriting parent state (#14956) (2034df6), closes #14955

`v2.6.4`

🔧 Bug Fixes

VDialog/VMenu: remove duplicate toggleable mixin (860be6b), closes #14719
VPagination: get available width before initial mount (472bbb4), closes #14590
VSelect: update menu position on selection change (5974a84), closes #14688

`v2.6.3`

🔧 Bug Fixes

VCalendar: use theme background color for categories (#14558) (185408b), closes #14433
VData: don't reset sortBy/sortDesc to [] on clear (9cf48e4), closes #14423
VDialog: change the role from "document" to "dialog" (#14602) (158e0b5), closes #14231
VMenu: null check content in mouseleave handler (e13eee1), closes #14619
VMenu: wrong alignment in RTL mode (#14556) (446963f), closes #12195
VNavigationDrawer: don't update miniVariant without expandOnHover (bb2b11e), closes #14555
VTab: disabled tab can be reached by keyboard (#14606) (d110f58), closes #14601

`v2.6.2`

🔧 Bug Fixes

application: allow use of multiple drawers (#14450) (85a1186), closes #13665
types: add missing VOtpInput export in lib.d.ts (#14497) (00f3f0a), closes #14496
VBottomNavigation: only calculate isActive state when using hideOnScroll (f58afb4), closes #11640
VCombobox: don't reset search when cleared (#14531) (79cd41d), closes #14507
VMenu: don't add button role with openOnHover (24ccd88), closes #14377
VNavigationDrawer: always bind mouseover events (#14523) (03e683f), closes #13309
VOtpInput: update internalValue on paste (bab2fa2), closes #14536
VOtpInput: update the otp when value changes (#14460) (c58f02a), closes #14437
VSelect: Do not keep null items when filtering duplicates (#14464) (8fd3510), closes #14421
VSlideGroup: account for inverted RTL scrolling (092fceb), closes #14529
VSlideGroup: skip width update if destroyed (1bb1455), closes #14470
VStepper: editable step tab navigation (#14036) (256fa93), closes #14022
VTabs: correctly set active state with exact prop (#14500) (74ec950), closes #14431 #14459
VTextarea: apply correct input styles with solo-inverted prop (ea96084), closes #11848
VTooltip: allow disabling openOnClick/openOnFocus (28a64c4), closes #14444

`v2.6.1`

🔧 Bug Fixes

locale: update it translations (#14398) (33385d5)
VBanner: remove background when using the outlined prop (2af9a41), closes #12081
VCalendar: add nativeEvent to all re-emitted events (#14307) (bb78e4e), closes #9485
VCalendar: continue touchMove event between days (#14392) (10c78d2), closes #13174
VCard: remove default click handler (6d1c0f6), closes #14447
VDataTable: use hasOwnProperty to check dynamic slot presence (ca4cbda), closes #14425
VDialog: allow width to be set to auto (ef8b3cc), closes #6919 #14419
VItemGroup: allow null values (#14436) (a0dd90d), closes #9073
VItemGroup: allow object values and custom comparator (#14328) (324b818), closes #10571
VRipple: use $ripple-animation-visible-opacity variable (#14365) (3f8f577), closes #11505
VStepper: expand stepper label to full width (#14362) (e6e5fd2), closes #12584
VTabs: allow set VTab inactive if optional property is set (#14399) (958d4e6), closes #14397

`v2.6.0`

v2.6.0 (Horizon)

Welcome to the v2.6.0 release of Vuetify!

❗️ Important Links

📄 Docs
🚨 Issues
🏬 Store
🎮 Play
💬 Discord
🐦 Twitter
👽 Reddit

🤚 FAQ

Where is the upgrade guide?
- There are no upgrade steps to go from v2.5 to v2.6

💪 Support Vuetify Development

Vuetify is an open source MIT project that has been made possible due to the generous contributions by our sponsors and backers. If you are interested in supporting this project, please consider:

💯 Release notes

🔧 Bug Fixes

VAutocomplete: remove selected item when input is cleared (#13854) (57d3469), closes #5917
VDialog: default to auto width (6ac8007), closes #6919

🚀 Features

framework: add tag attribute to createSimpleFunctional (682936b), closes #10026 #5469
locale: add danish locale (#13733) (0ec9d53)
styles: add $spacers-steps sass variable (#14367) (60d3e54), closes #12341
VCalendar: pass native event to v-calendar click:* events (#13760) (4429e6e), closes #13142
VCalendar: support horizontal scroll (#13164) (f55ee97), closes #13070
VDataTable: allow item.* slots to return a <td> or <th> element (a4b8856), closes #8474 #12791
VDatePicker: add date range first & last classes (#12855) (988558b), closes #12851 #12851 #12851 #12851
VInput: add hide-spin-buttons prop (#13682) (bc2d6cb), closes #6157
VOtpInput: create new component (#12761) (e3aeae7), closes #11425
VSlideGroup: add overscroll friction (3796587)
VSnackbar: only add app padding if app prop is true (28e9e9d), closes #11758
VTooltip: add $tooltip-opacity sass variable (bfdd32c), closes #11184
VTreeview: add disabled prop (de0820c), closes #5918
VTreeview: add disablePerNode prop (#14297) (f37438b), closes #14282

v2.6.0.beta.0 - v2.6.0

Includes bugfixes from 2.5.11 to 2.5.14

🚀 Features

styles: add $spacers-steps sass variable (#14367) (60d3e54), closes #12341
VTreeview: add disablePerNode prop (#14297) (f37438b), closes #14282

`v2.5.14`

🔧 Bug Fixes

directives: null check handlers on unbind (0eec92f), closes #14390
VSelect: don't select dividers or headers on arrow press (13f08b6), closes #14372
VTextField: set label dimensions on mount (6e3d83f), closes #14391

`v2.5.13`

🔧 Bug Fixes

directives: remove listeners if bound multiple times to one element (64c254f), closes #13701 #14386
transitions: don't remove display style afterLeave (99f77d9), closes #14312
VCalendar: resolve drag drop issue on firefox (#14385) (2d63881), closes #14243
VDialog: allow scrolling <select multiple> in safari (0ca7d0d), closes #9470
VDialog: support horizontal scrolling (bc82074), closes #3765
VOverlay: passthrough native events (6e2f6cd), closes #11326
VRadioGroup: passthrough custom attributes (75e0ecc), closes #10704
VRangeSlider: allow both thumbs to be set to the same value (2aedfc5), closes #13738
VTabs: don't try to reactivate inactive tabs (c41b5bf), closes #14387

`v2.5.12`

🔧 Bug Fixes

detachable: remove content element in beforeDestroy (0a0d743), closes #14380

`v2.5.11`

🔧 Bug Fixes

breakpoints: prevent overlap on HiDPI displays (#14358) (e3f28a4), closes #14353
detachable: wait for transition to finish before removing activator (4c12e40), closes #7422
locale: fix aria-label for FR locale (#14296) (933212c)
VCalendar: implicitly narrow TouchEvent (#14280) (15e28f6), closes #14276
VCombobox: keep highlighted item on filteredItems change (#14196) (da5493b), closes #14194
VDialog: don't re-focus autofocused children (262057a), closes #14345
VDialog: prevent pointer events during transition (562294b), closes #14224
VListItem: allow default color to change when inactive (#14207) (3df308f), closes #9285
VTabs: prevent selection of disabled tabs (#14229) (13545ab), closes #13728

`v2.5.10`

🔧 Bug Fixes

click-outside: check for ShadowRoot support (30dd6bc), closes #13845
goTo: check targetLocation when reach bottom (#13903) (c5e181e)
menuable: apply custom absolute position when attached (83f262a), closes #6877
menuable: remove unused fixed prop (52ac86e), closes #10946
Ripple: don't use Symbol to prevent ripples on parent elements (4c28ef1), closes [#13383](https://redirect.github

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.


          Update dependency vuetify to v3 [SECURITY]

7bcb9e4

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet