chore(deps): bump vuetify from 2.7.2 to 3.0.0 in /web

[dependabot]

Bumps vuetify from 2.7.2 to 3.0.0.

Commits

• 3122b69 chore(release): publish v3.0.0
• fce23d1 fix(types): add shims to UMD types
• e23e92c fix(types): remove UMD package export
• 3a2dbd3 fix(types): expose LocaleMessages interface
• 48ef134 feat(VList): add keyboard navigation (#15998)
• 18537d3 feat(theme): rename code/kbd variables to match conventions
• 6c5b180 fix(VTabs): respect height prop
• e6b0d7a fix: don't destroy components when transition value changes
• fa841a3 fix(VIcon): add collapse alias for mdi-svg (#15963)
• be3ceca fix(VDialog): explicit prop definitions (#15971)
• Additional commits viewable in compare view

[cursor]

Stale comment

Security review — no findings

PR: chore(deps): bump vuetify from 2.7.2 to 3.0.0 in /web (#3987)

Scope: web/package.json, web/package-lock.json only (dependency bump).

Outcome: No medium, high, or critical vulnerabilities introduced or exposed by this change.

What was reviewed

• Supply chain: vuetify@3.0.0 resolves from registry.npmjs.org with an integrity hash matching the published package (sha512-0olLmKWb+…). No typosquatting or unexpected package substitutions observed.
• Known Vuetify CVEs: OSV/npm audit flag CVE-2025-8083 (prototype pollution, high) and CVE-2025-8082 (VDatePicker XSS, moderate) on Vuetify 2.x. Version 3.0.0 is outside the affected ranges; npm audit no longer reports a direct vuetify advisory after this bump.
• Exploitability in this app: The codebase does not use v-date-picker / title-date-format. Vuetify is initialized from a static preset in web/src/plugins/vuetify.js (not attacker-controlled input), so the 2.x prototype-pollution path is not reachable via external input.
• Runtime impact: Vuetify 3 requires Vue 3 (peer vue@^3.2.0); this project is on Vue 2. npm install / npm ci fail with a peer-dependency conflict, so this PR cannot produce a deployable frontend build without a full Vue/Vuetify migration. That is a compatibility blocker, not a new exploitable security issue from the version bump alone.

Prior automation threads

No previous automation review threads were found on this PR.

---

Slack summary: PR #3987 (Vuetify 2.7.2 → 3.0.0) — clean security review, no actionable findings. The bump would remediate known Vuetify 2.x CVEs but is incompatible with the current Vue 2 stack and fails dependency install; recommend closing or rebasing after a planned Vue 3 migration rather than merging as-is.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Security review — no findings

PR: chore(deps): bump vuetify from 2.7.2 to 3.0.0 in /web (#3987)

Scope: web/package.json, web/package-lock.json only (dependency bump).

Outcome: No medium, high, or critical vulnerabilities introduced or exposed by this change.

What was reviewed

• Supply chain: vuetify@3.0.0 resolves from registry.npmjs.org with integrity sha512-0olLmKWb+…, matching the published tarball. No typosquatting or unexpected package substitution.
• Known Vuetify 2.x CVEs: CVE-2025-8083 (prototype pollution, high), CVE-2025-8082 (VDatePicker XSS, moderate), and CVE-2025-1461 (VCalendar XSS, moderate) affect Vuetify 2.x only. Version 3.0.0 is outside all affected ranges; npm audit reports no direct vuetify advisory after this bump.
• Exploitability in this app: The codebase does not use v-date-picker, v-calendar, or attacker-controlled Vuetify presets. Vuetify is initialized from a static config in web/src/plugins/vuetify.js (not external input), so the 2.x prototype-pollution and date-picker XSS paths are not reachable via attacker-controlled input.
• Runtime impact: Vuetify 3 requires Vue 3 (peer vue@^3.2.0); this project is on Vue 2. npm install fails with a peer-dependency conflict, so this PR cannot produce a deployable frontend build without a full Vue/Vuetify migration. That is a compatibility blocker, not a new exploitable security issue from the version bump alone.

Prior automation threads

No unresolved inline review threads were found. Previous top-level automation assessment validated; no findings remain applicable.

---

Slack summary: PR #3987 (Vuetify 2.7.2 → 3.0.0) — clean security review, no actionable findings. The bump would remediate known Vuetify 2.x CVEs but is incompatible with the current Vue 2 stack and fails dependency install; recommend closing or rebasing after a planned Vue 3 migration rather than merging as-is.

  

_{Sent by Cursor Automation: Find vulnerabilities}