fix(deps): update dependency vuetify to v3 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
vuetify (source)	^2.6.10 -> ^3.0.0

GitHub Vulnerability Alerts

CVE-2025-8082

Improper neutralization of the title date in the 'VDatePicker' component in Vuetify, allows unsanitized HTML to be inserted into the page. This can lead to a Cross-Site Scripting (XSS) https://owasp.org/www-community/attacks/xss  attack. The vulnerability occurs because the 'title-date-format' property of the 'VDatePicker' can accept a user created function and assign its output to the 'innerHTML' property of the title element without sanitization.

This issue affects Vuetify versions greater than or equal to 2.0.0 and less than 3.0.0.

Note:
Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see here https://v2.vuetifyjs.com/en/about/eol/ .

CVE-2025-8083

The Preset configuration feature of Vuetify is vulnerable to Prototype Pollution due to the internal 'mergeDeep' utility function used to merge options with defaults. Using a specially-crafted, malicious preset can result in polluting all JavaScript objects with arbitrary properties, which can further negatively affect all aspects of the application's behavior. This can lead to a wide range of security issues, including resource exhaustion/denial of service or unauthorized access to data.

If the application utilizes Server-Side Rendering (SSR), this vulnerability could affect the whole server process.

This issue affects Vuetify versions greater than or equal to 2.2.0-beta.2 and less than 3.0.0-alpha.10.

Note:
Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see here https://v2.vuetifyjs.com/en/about/eol/ .

---

Release Notes

vuetifyjs/vuetify (vuetify)

v3.0.0

Compare Source

v3.0.0 (Titan)

Welcome to the v3.0.0 release of Vuetify!

Supporting Vuetify

Vuetify is an open source MIT project that has been made possible due to the generous contributions by sponsors and backers. If you are interested in supporting this project, please consider:

• Becoming a sponsor on Github
  • John Leider
  • Kael Watts-Deuchar
• Becoming a sponsor on Patreon
• Make a one-time payment with Paypal
• Supporting the Core Team on Open Collective (supports the core team)
• Becoming a subscriber on Tidelift
• Direct support from Vuetify

❗️ Important Links

• Vuetify Store
• Documentation
• Report a Bug
• Community Discord
• Twitter

💯 Release notes

🚀 Features

• theme: rename code/kbd variables to match conventions (18537d3)
• VList: add keyboard navigation (#​15998) (48ef134), closes #​15428

🔧 Bug Fixes

• don't destroy components when transition value changes (e6b0d7a), closes #​15995
• types: add shims to UMD types (fce23d1)
• types: remove UMD package export (e23e92c)
• types: expose LocaleMessages interface (3a2dbd3)
• validation: add validate-on prop (#​15979) (c669540), closes #​15976
• VDialog: explicit prop definitions (#​15971) (be3ceca), closes #​15967
• VIcon: add collapse alias for mdi-svg (#​15963) (fa841a3)
• VTabs: respect height prop (6c5b180), closes #​15972

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: web/package-lock.json

npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR! 
npm ERR! While resolving: web@0.1.0
npm ERR! Found: vue@2.7.16
npm ERR! node_modules/vue
npm ERR!   vue@"^2.6.14" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer vue@"^3.5.0" from vuetify@3.11.3
npm ERR! node_modules/vuetify
npm ERR!   vuetify@"^3.0.0" from the root project
npm ERR!   peer vuetify@"^3.0.0" from vite-plugin-vuetify@2.1.2
npm ERR!   node_modules/vite-plugin-vuetify
npm ERR!     peerOptional vite-plugin-vuetify@">=2.1.0" from vuetify@3.11.3
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /runner/cache/others/npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /runner/cache/others/npm/_logs/2025-12-12T22_42_35_059Z-debug-0.log