fix(deps): update dependency vuetify to v3 [security]#309

Closed

renovate[bot] wants to merge 1 commit intomainfrom

renovate/npm-vuetify-vulnerability

Contributor

renovate bot commented Feb 20, 2026

This PR contains the following updates:

Package	Change	Age	Confidence
vuetify (source)	`^2.4.0` → `^3.0.0`

GitHub Vulnerability Alerts

CVE-2022-25873

The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component.

CVE-2025-8083

The Preset configuration feature of Vuetify is vulnerable to Prototype Pollution due to the internal 'mergeDeep' utility function used to merge options with defaults. Using a specially-crafted, malicious preset can result in polluting all JavaScript objects with arbitrary properties, which can further negatively affect all aspects of the application's behavior. This can lead to a wide range of security issues, including resource exhaustion/denial of service or unauthorized access to data.

If the application utilizes Server-Side Rendering (SSR), this vulnerability could affect the whole server process.

This issue affects Vuetify versions greater than or equal to 2.2.0-beta.2 and less than 3.0.0-alpha.10.

Note:
Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see here https://v2.vuetifyjs.com/en/about/eol/ .

CVE-2025-8082

Improper neutralization of the title date in the 'VDatePicker' component in Vuetify, allows unsanitized HTML to be inserted into the page. This can lead to a Cross-Site Scripting (XSS) https://owasp.org/www-community/attacks/xss attack. The vulnerability occurs because the 'title-date-format' property of the 'VDatePicker' can accept a user created function and assign its output to the 'innerHTML' property of the title element without sanitization.

This issue affects Vuetify versions greater than or equal to 2.0.0 and less than 3.0.0.

Note:
Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see here https://v2.vuetifyjs.com/en/about/eol/ .

Release Notes

vuetifyjs/vuetify (vuetify)

`v3.0.0`

v3.0.0 (Titan)

Welcome to the v3.0.0 release of Vuetify!

Supporting Vuetify

Vuetify is an open source MIT project that has been made possible due to the generous contributions by sponsors and backers. If you are interested in supporting this project, please consider:

Becoming a sponsor on Github
- John Leider
- Kael Watts-Deuchar
Becoming a sponsor on Patreon
Make a one-time payment with Paypal
Supporting the Core Team on Open Collective (supports the core team)
Becoming a subscriber on Tidelift
Direct support from Vuetify

❗️ Important Links

💯 Release notes

🚀 Features

theme: rename code/kbd variables to match conventions (18537d3)
VList: add keyboard navigation (#15998) (48ef134), closes #15428

🔧 Bug Fixes

don't destroy components when transition value changes (e6b0d7a), closes #15995
types: add shims to UMD types (fce23d1)
types: remove UMD package export (e23e92c)
types: expose LocaleMessages interface (3a2dbd3)
validation: add validate-on prop (#15979) (c669540), closes #15976
VDialog: explicit prop definitions (#15971) (be3ceca), closes #15967
VIcon: add collapse alias for mdi-svg (#15963) (fa841a3)
VTabs: respect height prop (6c5b180), closes #15972

`v2.7.2`

🔧 Bug Fixes

update types (#16951) (7e3d35d)
check both $slots and $scopedSlots, normalise slot case (7d67046), closes #8676 #15293
locale: Update French translations (#18215) (ceeafb6)
VAutocomplete: highlight correct item in list on click (bc48f00), closes #17201
VSelect: don't blur input on menu mousedown (0a77965), closes #15839

`v2.7.1`

🔧 Bug Fixes

VSelect: don't update scroll position if menu is closed (c53b2f8), closes #17085
VTabs: remove quotes from text-transform (#17771) (153d17b), closes #17799

`v2.7.0`

🚀 Features

styles: add xxl border-radius option (#14546) (018525e)
VDataTable: backport filterMode prop from v3 (#17747) (05c10a3), closes #11600
VDataTable: add item-style prop (#15332) (13c5765), closes #15049
VDataTable: forward arbitrary row events (#15617) (243efcc), closes #13332
VDataTable: expose row default props to item slots (#15711) (034ca21)
VExpansionPanel: add open prop to content and header slots (7738eee), closes #15782
VForm: allow individual inputs to be enabled in disabled form (42ec8c5), closes #17391
VInput: add locale keys for append/prepend buttons (#15612) (980ef7f), closes #12582
VMenu: add contentProps prop (#15865) (48de295)
VPagination: add props for coloring navigation buttons (#15691) (a85b85f)
VSlideGroup: add show-arrows="never" (#14587) (354a999), closes #14586
VTab: add tabValue prop (#16383) (d4421cf), closes #10540
VTabs: add tab-text-transform SASS variable (#14545) (8253c7e)
VTimePicker: add activePicker prop (#14632) (09f1102), closes #14629

🔧 Bug Fixes

VItem: support disabled effect (#14941) (415322d), closes #14923
VMenu: ignore key presses when disable-keys is true (#16464) (922e05a), closes #12998
VSkeletonLoader: apply aria-label for screenreaders (#17073) (a0d8d34), closes #10999

`v2.6.16`

🔧 Bug Fixes

icons: FA5 warning icon alias more consistent with MDI (#15607) (3c525fe)
VDataTable: add class to root element when show-select (#14987) (ee72ee5)
VDialog: check if scrolling element parentNode exists (e148110), closes #15977
VIcon: center button icon in system bar (#15918) (bc7a264), closes #14975
VMenu: prefer existing menuProps.attach (50ea98d), closes #7547
VSelect: update lastItem when selection changes with hideSelected (b121493), closes #17085
VTextarea: correctly apply reverse prop styles (#15858) (1e4b2f7), closes #15432

`v2.6.15`

🔧 Bug Fixes

remove charset statement from vuetify.css (3b5fbe9), closes #16989
VColorPicker: correct swatches-padding variable name (bb152d4), closes #14887 #14878
VDataIterator: check shiftKey on any keypress (8ad6f7b), closes #16128
VLabel: inherit attrs (116bcab), closes #16938
VSelect: only lookup keypresses for printable characters (e4208c8), closes #7260

`v2.6.14`

🔧 Bug Fixes

locale: update arabic translations (#16290) (9169a06), closes #16185

`v2.6.13`

🔧 Bug Fixes

ripple: check parent before calling removeChild (#14573) (63c2267), closes #13457
VAutocomplete: remove unused allowOverflow prop (f16c2c5), closes #16008
VDataTable: native event as argument to click:row (#15864) (17dd133), closes #10302

`v2.6.12`

🔧 Bug Fixes

VCalendar: display name on all-day events in event slot (30b7281), closes #15915
VCombobox: emit paste event (7417807), closes #11186
VFileInput: label click opens dialog twice (#15902) (7c9f717), closes #15888
VStepper: increate error label selector specificity (785de11), closes #15886

`v2.6.11`

🔧 Bug Fixes

click-outside: remove unused vnode reference (4d3359a)

`v2.6.10`

🔧 Bug Fixes

VCalendar: prevent XSS from eventName function (ade1434), closes #15757
VDialog: don't try to focus tabindex="-1" or hidden inputs (89e3850), closes #15745
VMenu: disable activatorFixed when attach is enabled (#15709) (464529a), closes #14922
VTextField: only show clear icon on hover or when focused (7a51ad0)
VTextField: prevent tabbing to clear button (f8ee680), closes #11202
web-types: add support for VDataTable pattern slots (#15694) (ac45c98)

🔬 Code Refactoring

VSelect: render highlight with vnodes instead of innerHTML (4468e3c)

BREAKING CHANGES

VCalendar: eventName function can no longer render arbitrary HTML, convert to VNodes instead.
eventSummary can no longer be used with v-html, replace with <component :is="{ render: eventSummary }" />

`v2.6.9`

🔧 Bug Fixes

VCalendar: add aria roles to monthly calendar (#14640) (2cd34b4), closes #14604
VCalendar: forward all bound events to internal elements (#15592) (299330c)
VCarousel: add keys to delimiter buttons (#15459) (8d3895b)
VPagination: ignore invalid length values (f3f8d15), closes #15499
VRadio: change icon color when disabled (0cc43e2)
VSwitch: only affect control opacity when disabled (1e0a4ad)

`v2.6.8`

🔧 Bug Fixes

VDataTable: display header text instead of value in group headers (100053f), closes #11516
VItemGroup: use valueComparator when updating value (#15395) (8bedb7c), closes #15394
VSimpleCheckbox: directly specify ripple directive definition (00a9668), closes #12224

`v2.6.7`

🔧 Bug Fixes

styles: resolve css validation errors (621f273), closes #15320
VDialog: focus on internal content when shown (#14584) (ffbaae1), closes #14581
VInput: allow text selection in disabled inputs (#14465) (760490d), closes #14238
VList: don't trigger keyboard events on disabled items (#15339) (817df79), closes #15322
VOtpInput: support paste and autofill on mobile (8c67ed8), closes #14801
VRadio: use correct disabled color for icons (3115798)
VSelect: allow keyboard selection of items with value 0 (969aba4), closes #15166
VTabs: use ResizeObserver if available (ff519c6), closes #4733 #10455 #12783 #14195 #15316
VTimeline: disable arrow shadow on clickable cards (27ba2c9), closes #14193

`v2.6.6`

🔧 Bug Fixes

locale: update catalan translations (#15012) (2eab4f2)
mdi-svg: update contextual icons (5918484), closes #14327
VOverflowBtn: make persistentPlaceholder label visible (#15055) (002afbe), closes #15052
VSelect: set min-height on correct element (d41a327), closes #15047

🔬 Code Refactoring

VDatePicker: single split call (#15082) (dc48652)

Configuration

📅 Schedule: Branch creation - "" in timezone America/Vancouver, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.


          fix(deps): update dependency vuetify to v3 [security]

f8c8bdd

renovate bot requested review from Jxio, ochiu and seeker25 as code owners

February 20, 2026 15:53

Contributor Author

renovate bot commented Feb 20, 2026

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR! 
npm ERR! While resolving: pay-ui@1.3.34
npm ERR! Found: vue@2.7.16
npm ERR! node_modules/vue
npm ERR!   peer vue@"^2.6.11" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer vue@"^3.5.0" from vuetify@3.12.0
npm ERR! node_modules/vuetify
npm ERR!   vuetify@"^3.0.0" from the root project
npm ERR!   peer vuetify@">=3" from vite-plugin-vuetify@2.1.3
npm ERR!   node_modules/vite-plugin-vuetify
npm ERR!     peerOptional vite-plugin-vuetify@">=2.1.0" from vuetify@3.12.0
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /runner/cache/others/npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /runner/cache/others/npm/_logs/2026-02-20T15_53_29_394Z-debug-0.log

seeker25 closed this

Contributor Author

renovate bot commented Feb 20, 2026

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 3.x releases. But if you manually upgrade to 3.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

renovate bot deleted the renovate/npm-vuetify-vulnerability branch

February 20, 2026 15:57

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet