Update dependency vuetify to v3 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
vuetify (source)	2.6.9 → 3.0.0

GitHub Vulnerability Alerts

CVE-2022-25873

The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component.

CVE-2025-8083

The Preset configuration feature of Vuetify is vulnerable to Prototype Pollution due to the internal 'mergeDeep' utility function used to merge options with defaults. Using a specially-crafted, malicious preset can result in polluting all JavaScript objects with arbitrary properties, which can further negatively affect all aspects of the application's behavior. This can lead to a wide range of security issues, including resource exhaustion/denial of service or unauthorized access to data.

If the application utilizes Server-Side Rendering (SSR), this vulnerability could affect the whole server process.

This issue affects Vuetify versions greater than or equal to 2.2.0-beta.2 and less than 3.0.0-alpha.10.

Note:
Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see here https://v2.vuetifyjs.com/en/about/eol/ .

CVE-2025-8082

Improper neutralization of the title date in the 'VDatePicker' component in Vuetify, allows unsanitized HTML to be inserted into the page. This can lead to a Cross-Site Scripting (XSS) https://owasp.org/www-community/attacks/xss  attack. The vulnerability occurs because the 'title-date-format' property of the 'VDatePicker' can accept a user created function and assign its output to the 'innerHTML' property of the title element without sanitization.

This issue affects Vuetify versions greater than or equal to 2.0.0 and less than 3.0.0.

Note:
Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see here https://v2.vuetifyjs.com/en/about/eol/ .

---

Release Notes

vuetifyjs/vuetify (vuetify)

v3.0.0

Compare Source

v3.0.0 (Titan)

Welcome to the v3.0.0 release of Vuetify!

Supporting Vuetify

Vuetify is an open source MIT project that has been made possible due to the generous contributions by sponsors and backers. If you are interested in supporting this project, please consider:

• Becoming a sponsor on Github
  • John Leider
  • Kael Watts-Deuchar
• Becoming a sponsor on Patreon
• Make a one-time payment with Paypal
• Supporting the Core Team on Open Collective (supports the core team)
• Becoming a subscriber on Tidelift
• Direct support from Vuetify

❗️ Important Links

• Vuetify Store
• Documentation
• Report a Bug
• Community Discord
• Twitter

💯 Release notes

🚀 Features

• theme: rename code/kbd variables to match conventions (18537d3)
• VList: add keyboard navigation (#​15998) (48ef134), closes #​15428

🔧 Bug Fixes

• don't destroy components when transition value changes (e6b0d7a), closes #​15995
• types: add shims to UMD types (fce23d1)
• types: remove UMD package export (e23e92c)
• types: expose LocaleMessages interface (3a2dbd3)
• validation: add validate-on prop (#​15979) (c669540), closes #​15976
• VDialog: explicit prop definitions (#​15971) (be3ceca), closes #​15967
• VIcon: add collapse alias for mdi-svg (#​15963) (fa841a3)
• VTabs: respect height prop (6c5b180), closes #​15972

v2.7.2

Compare Source

🔧 Bug Fixes

• update types (#​16951) (7e3d35d)
• check both $slots and $scopedSlots, normalise slot case (7d67046), closes #​8676 #​15293
• locale: Update French translations (#​18215) (ceeafb6)
• VAutocomplete: highlight correct item in list on click (bc48f00), closes #​17201
• VSelect: don't blur input on menu mousedown (0a77965), closes #​15839

v2.7.1

Compare Source

🔧 Bug Fixes

• VSelect: don't update scroll position if menu is closed (c53b2f8), closes #​17085
• VTabs: remove quotes from text-transform (#​17771) (153d17b), closes #​17799

v2.7.0

Compare Source

🚀 Features

• styles: add xxl border-radius option (#​14546) (018525e)
• VDataTable: backport filterMode prop from v3 (#​17747) (05c10a3), closes #​11600
• VDataTable: add item-style prop (#​15332) (13c5765), closes #​15049
• VDataTable: forward arbitrary row events (#​15617) (243efcc), closes #​13332
• VDataTable: expose row default props to item slots (#​15711) (034ca21)
• VExpansionPanel: add open prop to content and header slots (7738eee), closes #​15782
• VForm: allow individual inputs to be enabled in disabled form (42ec8c5), closes #​17391
• VInput: add locale keys for append/prepend buttons (#​15612) (980ef7f), closes #​12582
• VMenu: add contentProps prop (#​15865) (48de295)
• VPagination: add props for coloring navigation buttons (#​15691) (a85b85f)
• VSlideGroup: add show-arrows="never" (#​14587) (354a999), closes #​14586
• VTab: add tabValue prop (#​16383) (d4421cf), closes #​10540
• VTabs: add tab-text-transform SASS variable (#​14545) (8253c7e)
• VTimePicker: add activePicker prop (#​14632) (09f1102), closes #​14629

🔧 Bug Fixes

• VItem: support disabled effect (#​14941) (415322d), closes #​14923
• VMenu: ignore key presses when disable-keys is true (#​16464) (922e05a), closes #​12998
• VSkeletonLoader: apply aria-label for screenreaders (#​17073) (a0d8d34), closes #​10999

v2.6.16

Compare Source

🔧 Bug Fixes

• icons: FA5 warning icon alias more consistent with MDI (#​15607) (3c525fe)
• VDataTable: add class to root element when show-select (#​14987) (ee72ee5)
• VDialog: check if scrolling element parentNode exists (e148110), closes #​15977
• VIcon: center button icon in system bar (#​15918) (bc7a264), closes #​14975
• VMenu: prefer existing menuProps.attach (50ea98d), closes #​7547
• VSelect: update lastItem when selection changes with hideSelected (b121493), closes #​17085
• VTextarea: correctly apply reverse prop styles (#​15858) (1e4b2f7), closes #​15432

v2.6.15

Compare Source

🔧 Bug Fixes

• remove charset statement from vuetify.css (3b5fbe9), closes #​16989
• VColorPicker: correct swatches-padding variable name (bb152d4), closes #​14887 #​14878
• VDataIterator: check shiftKey on any keypress (8ad6f7b), closes #​16128
• VLabel: inherit attrs (116bcab), closes #​16938
• VSelect: only lookup keypresses for printable characters (e4208c8), closes #​7260

v2.6.14

Compare Source

🔧 Bug Fixes

• locale: update arabic translations (#​16290) (9169a06), closes #​16185

v2.6.13

Compare Source

🔧 Bug Fixes

• ripple: check parent before calling removeChild (#​14573) (63c2267), closes #​13457
• VAutocomplete: remove unused allowOverflow prop (f16c2c5), closes #​16008
• VDataTable: native event as argument to click:row (#​15864) (17dd133), closes #​10302

v2.6.12

Compare Source

🔧 Bug Fixes

• VCalendar: display name on all-day events in event slot (30b7281), closes #​15915
• VCombobox: emit paste event (7417807), closes #​11186
• VFileInput: label click opens dialog twice (#​15902) (7c9f717), closes #​15888
• VStepper: increate error label selector specificity (785de11), closes #​15886

v2.6.11

Compare Source

🔧 Bug Fixes

• click-outside: remove unused vnode reference (4d3359a)

v2.6.10

Compare Source

🔧 Bug Fixes

• VCalendar: prevent XSS from eventName function (ade1434), closes #​15757
• VDialog: don't try to focus tabindex="-1" or hidden inputs (89e3850), closes #​15745
• VMenu: disable activatorFixed when attach is enabled (#​15709) (464529a), closes #​14922
• VTextField: only show clear icon on hover or when focused (7a51ad0)
• VTextField: prevent tabbing to clear button (f8ee680), closes #​11202
• web-types: add support for VDataTable pattern slots (#​15694) (ac45c98)

🔬 Code Refactoring

• VSelect: render highlight with vnodes instead of innerHTML (4468e3c)

BREAKING CHANGES

• VCalendar: eventName function can no longer render arbitrary HTML, convert to VNodes instead.
  eventSummary can no longer be used with v-html, replace with <component :is="{ render: eventSummary }" />

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.