Update dependency vuetify to v3 [SECURITY]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
vuetify (source)	2.4.6 → 3.0.0

---

Vuetify Cross-site Scripting vulnerability

CVE-2022-25873 / GHSA-q4q5-c5cv-2p68

More information

Details

The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component.

Severity

• CVSS Score: 5.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-25873
• https://github.com/vuetifyjs/vuetify/issues/15757
• https://github.com/vuetifyjs/vuetify/commit/ade1434927f55a0eccf3d54f900f24c5fa85a176
• https://codepen.io/5v3n-08/pen/MWGKEjY
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBVUETIFYJS-3024407
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3024406
• https://security.snyk.io/vuln/SNYK-JS-VUETIFY-3019858
• https://github.com/advisories/GHSA-q4q5-c5cv-2p68

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Vuetify has a Prototype Pollution vulnerability

CVE-2025-8083 / GHSA-3jp5-5f8r-q2wg

More information

Details

The Preset configuration feature of Vuetify is vulnerable to Prototype Pollution due to the internal 'mergeDeep' utility function used to merge options with defaults. Using a specially-crafted, malicious preset can result in polluting all JavaScript objects with arbitrary properties, which can further negatively affect all aspects of the application's behavior. This can lead to a wide range of security issues, including resource exhaustion/denial of service or unauthorized access to data.

If the application utilizes Server-Side Rendering (SSR), this vulnerability could affect the whole server process.

This issue affects Vuetify versions greater than or equal to 2.2.0-beta.2 and less than 3.0.0-alpha.10.

Note:
Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see here https://v2.vuetifyjs.com/en/about/eol/ .

Severity

• CVSS Score: 8.6 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-8083
• https://codepen.io/herodevs/pen/RNWoaQM/f1f4ccc7e6a307c2a8c36d948ba14755
• https://www.herodevs.com/vulnerability-directory/cve-2025-8083
• https://github.com/advisories/GHSA-3jp5-5f8r-q2wg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Vuetify has a Cross-site Scripting (XSS) vulnerability in the VDatePicker component

CVE-2025-8082 / GHSA-9w3x-85mw-4fwm

More information

Details

Improper neutralization of the title date in the 'VDatePicker' component in Vuetify, allows unsanitized HTML to be inserted into the page. This can lead to a Cross-Site Scripting (XSS) https://owasp.org/www-community/attacks/xss  attack. The vulnerability occurs because the 'title-date-format' property of the 'VDatePicker' can accept a user created function and assign its output to the 'innerHTML' property of the title element without sanitization.

This issue affects Vuetify versions greater than or equal to 2.0.0 and less than 3.0.0.

Note:
Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see here https://v2.vuetifyjs.com/en/about/eol/ .

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-8082
• https://codepen.io/herodevs/pen/dPYGPyR/775285c0fd5a08038d4c85398815d644
• https://www.herodevs.com/vulnerability-directory/cve-2025-8082
• https://github.com/advisories/GHSA-9w3x-85mw-4fwm

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vuetifyjs/vuetify (vuetify)

v3.0.0

Compare Source

v3.0.0 (Titan)

Welcome to the v3.0.0 release of Vuetify!

Supporting Vuetify

Vuetify is an open source MIT project that has been made possible due to the generous contributions by sponsors and backers. If you are interested in supporting this project, please consider:

• Becoming a sponsor on Github
  • John Leider
  • Kael Watts-Deuchar
• Becoming a sponsor on Patreon
• Make a one-time payment with Paypal
• Supporting the Core Team on Open Collective (supports the core team)
• Becoming a subscriber on Tidelift
• Direct support from Vuetify

❗️ Important Links

• Vuetify Store
• Documentation
• Report a Bug
• Community Discord
• Twitter

💯 Release notes

🚀 Features

• theme: rename code/kbd variables to match conventions (18537d3)
• VList: add keyboard navigation (#​15998) (48ef134), closes #​15428

🔧 Bug Fixes

• don't destroy components when transition value changes (e6b0d7a), closes #​15995
• types: add shims to UMD types (fce23d1)
• types: remove UMD package export (e23e92c)
• types: expose LocaleMessages interface (3a2dbd3)
• validation: add validate-on prop (#​15979) (c669540), closes #​15976
• VDialog: explicit prop definitions (#​15971) (be3ceca), closes #​15967
• VIcon: add collapse alias for mdi-svg (#​15963) (fa841a3)
• VTabs: respect height prop (6c5b180), closes #​15972

v2.7.2

Compare Source

🔧 Bug Fixes

• update types (#​16951) (7e3d35d)
• check both $slots and $scopedSlots, normalise slot case (7d67046), closes #​8676 #​15293
• locale: Update French translations (#​18215) (ceeafb6)
• VAutocomplete: highlight correct item in list on click (bc48f00), closes #​17201
• VSelect: don't blur input on menu mousedown (0a77965), closes #​15839

v2.7.1

Compare Source

🔧 Bug Fixes

• VSelect: don't update scroll position if menu is closed (c53b2f8), closes #​17085
• VTabs: remove quotes from text-transform (#​17771) (153d17b), closes #​17799

v2.7.0

Compare Source

🚀 Features

• styles: add xxl border-radius option (#​14546) (018525e)
• VDataTable: backport filterMode prop from v3 (#​17747) (05c10a3), closes #​11600
• VDataTable: add item-style prop (#​15332) (13c5765), closes #​15049
• VDataTable: forward arbitrary row events (#​15617) (243efcc), closes #​13332
• VDataTable: expose row default props to item slots (#​15711) (034ca21)
• VExpansionPanel: add open prop to content and header slots (7738eee), closes #​15782
• VForm: allow individual inputs to be enabled in disabled form (42ec8c5), closes #​17391
• VInput: add locale keys for append/prepend buttons (#​15612) (980ef7f), closes #​12582
• VMenu: add contentProps prop (#​15865) (48de295)
• VPagination: add props for coloring navigation buttons (#​15691) (a85b85f)
• VSlideGroup: add show-arrows="never" (#​14587) (354a999), closes #​14586
• VTab: add tabValue prop (#​16383) (d4421cf), closes #​10540
• VTabs: add tab-text-transform SASS variable (#​14545) (8253c7e)
• VTimePicker: add activePicker prop (#​14632) (09f1102), closes #​14629

🔧 Bug Fixes

• VItem: support disabled effect (#​14941) (415322d), closes #​14923
• VMenu: ignore key presses when disable-keys is true (#​16464) (922e05a), closes #​12998
• VSkeletonLoader: apply aria-label for screenreaders (#​17073) (a0d8d34), closes #​10999

v2.6.16

Compare Source

🔧 Bug Fixes

• icons: FA5 warning icon alias more consistent with MDI (#​15607) (3c525fe)
• VDataTable: add class to root element when show-select (#​14987) (ee72ee5)
• VDialog: check if scrolling element parentNode exists (e148110), closes #​15977
• VIcon: center button icon in system bar (#​15918) (bc7a264), closes #​14975
• VMenu: prefer existing menuProps.attach (50ea98d), closes #​7547
• VSelect: update lastItem when selection changes with hideSelected (b121493), closes #​17085
• VTextarea: correctly apply reverse prop styles (#​15858) (1e4b2f7), closes #​15432

v2.6.15

Compare Source

🔧 Bug Fixes

• remove charset statement from vuetify.css (3b5fbe9), closes #​16989
• VColorPicker: correct swatches-padding variable name (bb152d4), closes #​14887 #​14878
• VDataIterator: check shiftKey on any keypress (8ad6f7b), closes #​16128
• VLabel: inherit attrs (116bcab), closes #​16938
• VSelect: only lookup keypresses for printable characters (e4208c8), closes #​7260

v2.6.14

Compare Source

🔧 Bug Fixes

• locale: update arabic translations (#​16290) (9169a06), closes #​16185

v2.6.13

Compare Source

🔧 Bug Fixes

• ripple: check parent before calling removeChild (#​14573) (63c2267), closes #​13457
• VAutocomplete: remove unused allowOverflow prop (f16c2c5), closes #​16008
• VDataTable: native event as argument to click:row (#​15864) (17dd133), closes #​10302

v2.6.12

Compare Source

🔧 Bug Fixes

• VCalendar: display name on all-day events in event slot (30b7281), closes #​15915
• VCombobox: emit paste event (7417807), closes #​11186
• VFileInput: label click opens dialog twice (#​15902) (7c9f717), closes #​15888
• VStepper: increate error label selector specificity (785de11), closes #​15886

v2.6.11

Compare Source

🔧 Bug Fixes

• click-outside: remove unused vnode reference (4d3359a)

v2.6.10

Compare Source

🔧 Bug Fixes

• VCalendar: prevent XSS from eventName function (ade1434), closes #​15757
• VDialog: don't try to focus tabindex="-1" or hidden inputs (89e3850), closes #​15745
• VMenu: disable activatorFixed when attach is enabled (#​15709) (464529a), closes #​14922
• VTextField: only show clear icon on hover or when focused (7a51ad0)
• VTextField: prevent tabbing to clear button (f8ee680), closes #​11202
• web-types: add support for VDataTable pattern slots (#​15694) (ac45c98)

🔬 Code Refactoring

• VSelect: render highlight with vnodes instead of innerHTML (4468e3c)

BREAKING CHANGES

• VCalendar: eventName function can no longer render arbitrary HTML, convert to VNodes instead.
  eventSummary can no longer be used with v-html, replace with <component :is="{ render: eventSummary }" />

v2.6.9

Compare Source

🔧 Bug Fixes

• VCalendar: add aria roles to monthly calendar (#​14640) (2cd34b4), closes #​14604
• VCalendar: forward all bound events to internal elements (#​15592) (299330c)
• VCarousel: add keys to delimiter buttons (#​15459) (8d3895b)
• VPagination: ignore invalid length values (f3f8d15), closes #​15499
• VRadio: change icon color when disabled (0cc43e2)
• VSwitch: only affect control opacity when disabled (1e0a4ad)

v2.6.8

Compare Source

🔧 Bug Fixes

• VDataTable: display header text instead of value in group headers (100053f), closes #​11516
• VItemGroup: use valueComparator when updating value (#​15395) (8bedb7c), closes #​15394
• VSimpleCheckbox: directly specify ripple directive definition (00a9668), closes #​12224

v2.6.7

Compare Source

🔧 Bug Fixes

• styles: resolve css validation errors (621f273), closes #​15320
• VDialog: focus on internal content when shown (#​14584) (ffbaae1), closes #​14581
• VInput: allow text selection in disabled inputs (#​14465) (760490d), closes #​14238
• VList: don't trigger keyboard events on disabled items (#​15339) (817df79), closes #​15322
• VOtpInput: support paste and autofill on mobile (8c67ed8), closes #​14801
• VRadio: use correct disabled color for icons (3115798)
• VSelect: allow keyboard selection of items with value 0 (969aba4), closes #​15166
• VTabs: use ResizeObserver if available (ff519c6), closes #​4733 #​10455 #​12783 #​14195 #​15316
• VTimeline: disable arrow shadow on clickable cards (27ba2c9), closes #​14193

v2.6.6

Compare Source

🔧 Bug Fixes

• locale: update catalan translations (#​15012) (2eab4f2)
• mdi-svg: update contextual icons (5918484), closes #​14327
• VOverflowBtn: make persistentPlaceholder label visible (#​15055) (002afbe), closes #​15052
• VSelect: set min-height on correct element (d41a327), closes #​15047

🔬 Code Refactoring

• VDatePicker: single split call (#​15082) (dc48652)

v2.6.5

Compare Source

🔧 Bug Fixes

• locale: add missing Finnish translations (#​14824) (f0e5889)
• locale: improve spanish translations (#​14965) (a427b96)
• selection controls: emit focus/blur events (75404fb), closes #​14862
• VCalendar: fix transparent header on category calendar (#​14725) (33002fa), closes #​14723
• VImg: accept scopedSlots (96888d5), closes #​14686
• VTreeview: independent selection inheriting parent state (#​14956) (2034df6), closes #​14955

v2.6.4

Compare Source

🔧 Bug Fixes

• VDialog/VMenu: remove duplicate toggleable mixin (860be6b), closes #​14719
• VPagination: get available width before initial mount (472bbb4), closes #​14590
• VSelect: update menu position on selection change (5974a84), closes #​14688

v2.6.3

Compare Source

🔧 Bug Fixes

• VCalendar: use theme background color for categories (#​14558) (185408b), closes #​14433
• VData: don't reset sortBy/sortDesc to [] on clear (9cf48e4), closes #​14423
• VDialog: change the role from "document" to "dialog" (#​14602) (158e0b5), closes #​14231
• VMenu: null check content in mouseleave handler (e13eee1), closes #​14619
• VMenu: wrong alignment in RTL mode (#​14556) (446963f), closes #​12195
• VNavigationDrawer: don't update miniVariant without expandOnHover (bb2b11e), closes #​14555
• VTab: disabled tab can be reached by keyboard (#​14606) (d110f58), closes #​14601

v2.6.2

Compare Source

🔧 Bug Fixes

• application: allow use of multiple drawers (#​14450) (85a1186), closes #​13665
• types: add missing VOtpInput export in lib.d.ts (#​14497) (00f3f0a), closes #​14496
• VBottomNavigation: only calculate isActive state when using hideOnScroll (f58afb4), closes #​11640
• VCombobox: don't reset search when cleared (#​14531) (79cd41d), closes #​14507
• VMenu: don't add button role with openOnHover (24ccd88), closes #​14377
• VNavigationDrawer: always bind mouseover events (#​14523) (03e683f), closes #​13309
• VOtpInput: update internalValue on paste (bab2fa2), closes #​14536
• VOtpInput: update the otp when value changes (#​14460) (c58f02a), closes #​14437
• VSelect: Do not keep null items when filtering duplicates (#​14464) (8fd3510), closes #​14421
• VSlideGroup: account for inverted RTL scrolling (092fceb), closes #​14529
• VSlideGroup: skip width update if destroyed (1bb1455), closes #​14470
• VStepper: editable step tab navigation (#​14036) (256fa93), closes #​14022
• VTabs: correctly set active state with exact prop (#​14500) (74ec950), closes #​14431 #​14459
• VTextarea: apply correct input styles with solo-inverted prop (ea96084), closes #​11848
• VTooltip: allow disabling openOnClick/openOnFocus (28a64c4), closes #​14444

v2.6.1

Compare Source

🔧 Bug Fixes

• locale: update it translations (#​14398) (33385d5)
• VBanner: remove background when using the outlined prop (2af9a41), closes #​12081
• VCalendar: add nativeEvent to all re-emitted events (#​14307) (bb78e4e), closes #​9485
• VCalendar: continue touchMove event between days (#​14392) (10c78d2), closes #​13174
• VCard: remove default click handler (6d1c0f6), closes #​14447
• VDataTable: use hasOwnProperty to check dynamic slot presence (ca4cbda), closes #​14425
• VDialog: allow width to be set to auto (ef8b3cc), closes #​6919 #​14419
• VItemGroup: allow null values (#​14436) (a0dd90d), closes #​9073
• VItemGroup: allow object values and custom comparator (#​14328) (324b818), closes #​10571
• VRipple: use $ripple-animation-visible-opacity variable (#​14365) (3f8f577), closes #​11505
• VStepper: expand stepper label to full width (#​14362) (e6e5fd2), closes #​12584
• VTabs: allow set VTab inactive if optional property is set (#​14399) (958d4e6), closes #​14397

v2.6.0

Compare Source

v2.6.0 (Horizon)

Welcome to the v2.6.0 release of Vuetify!

❗️ Important Links

• 📄 Docs
• 🚨 Issues
• 🏬 Store
• 🎮 Play
• 💬 Discord
• 🐦 Twitter
• 👽 Reddit

🤚 FAQ

• Where is the upgrade guide?
  • There are no upgrade steps to go from v2.5 to v2.6

💪 Support Vuetify Development

Vuetify is an open source MIT project that has been made possible due to the generous contributions by our sponsors and backers. If you are interested in supporting this project, please consider:

• Sponsoring John and Kael on Github
• Requesting Enterprise Support
• Supporting the team on Open Collective
• Becoming a sponsor on Patreon
• Becoming a subscriber on Tidelift
• Making a one-time donation with Paypal

💯 Release notes

🔧 Bug Fixes

• VAutocomplete: remove selected item when input is cleared (#​13854) (57d3469), closes #​5917
• VDialog: default to auto width (6ac8007), closes #​6919

🚀 Features

• framework: add tag attribute to createSimpleFunctional (682936b), closes #​10026 #​5469
• locale: add danish locale (#​13733) (0ec9d53)
• styles: add $spacers-steps sass variable (#​14367) (60d3e54), closes #​12341
• VCalendar: pass native event to v-calendar click:* events (#​13760) (4429e6e), closes #​13142
• VCalendar: support horizontal scroll (#​13164) (f55ee97), closes #​13070
• VDataTable: allow item.* slots to return a <td> or <th> element (a4b8856), closes #​8474 #​12791
• VDatePicker: add date range first & last classes (#​12855) (988558b), closes #​12851 #​12851 #​12851 #​12851
• VInput: add hide-spin-buttons prop (#​13682) (bc2d6cb), closes #​6157
• VOtpInput: create new component (#​12761) (e3aeae7), closes #​11425
• VSlideGroup: add overscroll friction (3796587)
• VSnackbar: only add app padding if app prop is true (28e9e9d), closes #​11758
• VTooltip: add $tooltip-opacity sass variable (bfdd32c), closes #​11184
• VTreeview: add disabled prop (de0820c), closes #​5918
• VTreeview: add disablePerNode prop (#​14297) (f37438b), closes #​14282

v2.6.0.beta.0 - v2.6.0

Includes bugfixes from 2.5.11 to 2.5.14

🚀 Features

• styles: add $spacers-steps sass variable (#​14367) (60d3e54), closes #​12341
• VTreeview: add disablePerNode prop (#​14297) (f37438b), closes #​14282

v2.5.14

Compare Source

🔧 Bug Fixes

• directives: null check handlers on unbind (0eec92f), closes #​14390
• VSelect: don't select dividers or headers on arrow press (13f08b6), closes #​14372
• VTextField: set label dimensions on mount (6e3d83f), closes #​14391

v2.5.13

Compare Source

🔧 Bug Fixes

• directives: remove listeners if bound multiple times to one element (64c254f), closes #​13701 #​14386
• transitions: don't remove display style afterLeave (99f77d9), closes #​14312
• VCalendar: resolve drag drop issue on firefox (#​14385) (2d63881), closes #​14243
• VDialog: allow scrolling <select multiple> in safari (0ca7d0d), closes #​9470
• VDialog: support horizontal scrolling (bc82074), closes #​3765
• VOverlay: passthrough native events (6e2f6cd), closes #​11326
• VRadioGroup: passthrough custom attributes (75e0ecc), closes #​10704
• VRangeSlider: allow both thumbs to be set to the same value (2aedfc5), closes [#​13738](https://redirect

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR! 
npm ERR! While resolving: schoolallocation@1.0.1
npm ERR! Found: vue@2.6.12
npm ERR! node_modules/vue
npm ERR!   vue@"2.6.12" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer vue@"^3.2.0" from vuetify@3.0.0
npm ERR! node_modules/vuetify
npm ERR!   vuetify@"3.0.0" from the root project
npm ERR!   peer vuetify@"^3.0.0-beta.4" from vite-plugin-vuetify@1.0.2
npm ERR!   node_modules/vite-plugin-vuetify
npm ERR!     peerOptional vite-plugin-vuetify@"^1.0.0-alpha.12" from vuetify@3.0.0
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /runner/cache/others/npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /runner/cache/others/npm/_logs/2026-09-03T13_33_00_600Z-debug-0.log