🚨 [security] Update vue-router 4.6.4 → 5.1.0 (major)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ vue-router (4.6.4 → 5.1.0) · Repo

Release Notes

5.1.0

   🚀 Features

• Typed definePage params.path  -  by @posva in #2716 (d65de)
• Strict type for definePage param default  -  by @posva (0ae10)
• Support raw param parsers  -  by @posva (eadec)
• Force array type raw param parsers  -  by @posva (7a68b)
• Allow overriding the global Router type  -  by @posva (1cd93)
• Emit runtime warning for invalid format in query params  -  by @posva (8259a)
• Override useRouter() return with experimental types config  -  by @posva (39a34)
• Allow string as a param parser for convenience  -  by @posva (be37b)

   🐞 Bug Fixes

• Fix auto import fixes and make experimental esm only  -  by @posva (db3a6)
• Deterministic param parser types order  -  by @posva (bf0fc)
• Avoid importing unused param parsers  -  by @posva (41c00)
• Filter invalid query params without failing to match  -  by @posva (db717)
• Detect not set format  -  by @posva (aa89e)
• Allow undefined values for params in query  -  by @posva (4726e)
• experimental: Repeatable params in subsegments  -  by @posva (84664)
• types: Add vite as optional peer dependency  -  by @ForgottenR, @posva and shihuijie in #2712 (facbf)

    View changes on GitHub

5.0.7

   🚀 Features

• Upgrade to babel 8  -  by @posva (8d3e6)
• Make defineParamParser() more intuitive  -  by @posva (8715b)
• Upgrade @vue/devtools-api  -  by @posva (87c3a)
• matcher: Hint at params: {} workaround in discarded params warning  -  by @posva and shanliuling in #2689 (c2b13)
• param-parsers: Add include/exclude options  -  by @posva (91cde)

   🐞 Bug Fixes

• matcher:
  • Finalize param token before processing escaped colon  -  by @babu-ch and @posva in #2654 (20521)
• query:
  • Use Object.create(null) to prevent prototype pollution  -  by @wdskuki, wdsmini and @posva in #2661 (be88c)
• resolve:
  • Omit empty optional params from resolved params  -  by @babu-ch and @posva in #2434 (1ef09)
• types:
  • Wire RouteNamedMap via generated routes.d.ts  -  by @posva in #2700 (aef99)
• unplugin:
  • Avoid generating empty routes  -  by @FrontEndDog and @posva in #2642 (10a8b)
  • Apply definePage path-param parser overrides  -  by @posva in #2699 (c8074)
• volar:
  • Drop runtime @vue/language-core import  -  by @danielroe in #2710 (8af50)

    View changes on GitHub

5.0.6

   🐞 Bug Fixes

• Missing closing quote in generated import  -  by @zjy040525 and @posva in #2688 (32f78)

    View changes on GitHub

5.0.5

   🚀 Features

• Enable standard schema param parsers  -  by @posva (ea8e3)
• Normalize param parsers once  -  by @posva (48087)

   🐞 Bug Fixes

• Track definePage imports per-file to fix named view race condition  -  by @posva (11191)
• Avoid double decoding hash on string location  -  by @posva (1578c)

    View changes on GitHub

5.0.4

   🐞 Bug Fixes

• Avoid iterator helpers for Node 20 compat  -  by @cwandev in #2635 (47130)
• Escape backslahes in string literals  -  by @posva (71fdb)
• Avoid false duplicate route warning for named views  -  by @posva (72012)
• Allow pushing to auto routes  -  by @posva (47f03)
• loaders: Restore context in sequential awaits  -  by @posva (fce5d)

    View changes on GitHub

5.0.3

   🚨 Breaking Changes

• experimental:
  • Make miss() throw internally and return never  -  by @posva (077e1)
  • Add reroute() and deprecate NavigationResult  -  by @posva (308db)
  • Remove selectNavigationResult  -  by @posva (9e88a)

   🚀 Features

• Support _parent in nested folders  -  by @posva (0a37f)
• Warn on _parent conflict  -  by @posva (182fe)
• Set _parent as non matchable by default  -  by @posva (8f91c)
• Warn on conflicting components for routes  -  by @posva (34ace)
• Use type module  -  by @posva (dc9ff)
• Add deprecation warning for next() callback in navigation guards  -  by @posva (797f5)
• Extract alias from definePage  -  by @posva (835df)
• Display aliases in logs  -  by @posva (7aa60)
• Deprecate new NavigationResult(to) in favor of reroute(to)  -  by @posva (382e3)
• experimental:
  • Handle aliasOf in resolvers  -  by @posva (8fe45)
  • Generate aliases from override in resolver  -  by @posva (a00ac)
  • Warn against non absolute aliases  -  by @posva (476c6)

   🐞 Bug Fixes

• Avoid non matchable routes in auto-routes  -  by @posva (48649)
• Handle quotes in d.ts  -  by @posva (d7764)
• Avoid route entry in map for _parent  -  by @posva (1dfcc)
• Handle nested groups  -  by @posva (4a4be)
• Stable route ordering for group folders with same path  -  by @posva (1db94)
• Correct route ordering for group nodes with inflated scores  -  by @posva (515f4)
• Cleanup old route overrides  -  by @posva (b28a7)
• Remove name from _parent.vue files  -  by @posva (6e8f1)
• ci:
  • Format sponsor files before change detection  -  by @posva (f68d6)
  • Use manual git commit in update-sponsors  -  by @posva (8ee99)
• experimental:
  • Resolve TS errors in resolver/router type hierarchy  -  by @posva (a86f1)
• types:
  • Relax RouteMapGeneric constraint for interface-based RouteNamedMap  -  by @YevheniiKotyrlo in #2624 (cdf7b)
• volar:
  • Use ts.getTokenPosOfNode instead of node.getStart  -  by @KazariEX in #2630 (0b050)

   🏎 Performance

• Avoid merging empty object in record  -  by @posva (4213e)

    View changes on GitHub

5.0.2

   🐞 Bug Fixes

• Remove devtools from iife build  -  by @posva (58c03)
• Loose version check vue-router  -  by @posva (90e4b)
• volar: Empty options  -  by @posva (02275)

    View changes on GitHub

5.0.0

Vue Router 5 is a boring release, it merges unplugin-vue-router into the core package with no breaking changes. The only exception is that the iife build no longer includes @vue/devtools-api because it has been upgraded to v8 and does not expose an IIFE build itself. You can track that change in this issue. See the migration guide for instructions on how to upgrade from unplugin-vue-router to Vue Router 5.

   🚀 Features

• experimental: Query params are optional by default  -  by @posva (78913)
• Add volar plugins  -  by @posva (530ac)
• Add data loaders as experimental  -  by @posva (ab895)
• Add route json schema  -  by @posva (20675)
• Upgrade devtools-api to v7  -  by @posva (17b84)
• Upgrade devtools to v8  -  by @posva (b8aa2)
• Runtime error on missing param parsers  -  by @posva (3444b)
• volar: Allow rootDir option  -  by @posva (df65a)

   🐞 Bug Fixes

• Avoid breaking older browsers support  -  by @posva (c7ba4)
• Trigger navigation guards when keep-alive component is reactivated for different route  -  by @babu-ch and @posva in #2604 (c7735)
• Add automatic types for param parsers  -  by @posva (0fb5d)
• Param parsers when dts is not at root  -  by @posva (16b39)
• Expose resolveOptions for unplugin  -  by @posva (35543)
• Escape tildes in paths  -  by @posva (aac2e)
• volar: Upgrade config read  -  by @posva (e3024)

    View changes on GitHub

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ acorn (indirect, 8.15.0 → 8.16.0) · Repo

Commits

See the full diff on Github. The new version differs by 22 commits:

• Mark version 8.16.0
• Mark acorn-walk 8.3.5
• Properly check for presence of node.attributes in walkers
• Bump test262
• Bump Unicode 17, regenerate script values
• Properly throw an error, not a raw string
• More explicit error when walking a tree and a node type isn't registered.
• Rename eslint config file to suppress warning
• Update to ESLint 9
• Add Unicode v17 support
• Use consistent semicolon-less style in readmes
• Docs: Announce both ESM and CommonJS imports are supported, change all examples to ESM imports
• Clean up identifier char handling in keyword lookahead functions
• Increase accuracy of isAsyncFunction when followed by a backslash
• Fix await using double lookahead edge case
• Mark acorn-loose 8.5.2
• Bump dependency on acorn in acorn-loose
• Add support for sourceType: commonjs option
• Reject return statement in static block, even if allowReturnOutsideFunction is used
• Reject using declarations directly in for loop or switch scopes.
• Improve lookahead test for using syntax
• Mark acorn-loose 8.5.1

↗️ picomatch (indirect, 4.0.3 → 4.0.4) · Repo · Changelog

Security Advisories 🚨

🚨 Picomatch has a ReDoS vulnerability via extglob quantifiers

Impact

picomatch is vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as +() and *(), especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input.

Examples of problematic patterns include +(a|aa), +(*|?), +(+(a)), *(+(a)), and +(+(+(a))). In local reproduction, these patterns caused multi-second event-loop blocking with relatively short inputs. For example, +(a|aa) compiled to ^(?:(?=.)(?:a|aa)+)$ and took about 2 seconds to reject a 41-character non-matching input, while nested patterns such as +(+(a)) and *(+(a)) took around 29 seconds to reject a 33-character input on a modern M1 MacBook.

Applications are impacted when they allow untrusted users to supply glob patterns that are passed to picomatch for compilation or matching. In those cases, an attacker can cause excessive CPU consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way.

Patches

This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2.

Users should upgrade to one of these versions or later, depending on their supported release line.

Workarounds

If upgrading is not immediately possible, avoid passing untrusted glob patterns to picomatch.

Possible mitigations include:

• disable extglob support for untrusted patterns by using noextglob: true
• reject or sanitize patterns containing nested extglobs or extglob quantifiers such as +() and *()
• enforce strict allowlists for accepted pattern syntax
• run matching in an isolated worker or separate process with time and resource limits
• apply application-level request throttling and input validation for any endpoint that accepts glob patterns

Resources

• Picomatch repository: https://github.com/micromatch/picomatch
• lib/parse.js and lib/constants.js are involved in generating the vulnerable regex forms
• Comparable ReDoS precedent: CVE-2024-4067 (micromatch)
• Comparable generated-regex precedent: CVE-2024-45296 (path-to-regexp)

🚨 Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

Impact

picomatch is vulnerable to a method injection vulnerability (CWE-1321) affecting the POSIX_REGEX_SOURCE object. Because the object inherits from Object.prototype, specially crafted POSIX bracket expressions (e.g., [[:constructor:]]) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression.

This leads to incorrect glob matching behavior (integrity impact), where patterns may match unintended filenames. The issue does not enable remote code execution, but it can cause security-relevant logic errors in applications that rely on glob matching for filtering, validation, or access control.

All users of affected picomatch versions that process untrusted or user-controlled glob patterns are potentially impacted.

Patches

This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2.

Users should upgrade to one of these versions or later, depending on their supported release line.

Workarounds

If upgrading is not immediately possible, avoid passing untrusted glob patterns to picomatch.

Possible mitigations include:

• Sanitizing or rejecting untrusted glob patterns, especially those containing POSIX character classes like [[:...:]].

• Avoiding the use of POSIX bracket expressions if user input is involved.

• Manually patching the library by modifying POSIX_REGEX_SOURCE to use a null prototype:

  const POSIX_REGEX_SOURCE = {
    __proto__: null,
    alnum: 'a-zA-Z0-9',
    alpha: 'a-zA-Z',
    // ... rest unchanged
  };

Resources

• fix for similar issue: #144
• picomatch repository https://github.com/micromatch/picomatch

Release Notes

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

• Fix for CVE-2026-33671
• Fix for CVE-2026-33672

Full Changelog: 4.0.3...4.0.4

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 18 commits:

• Publish 4.0.4
• Merge commit from fork
• Merge commit from fork
• Run benchmark again against latest minimatch version (#161)
• docs: clarify what brace expansion syntax is and isn't supported (#134)
• fix typo in globstars.js test name (#138)
• docs: fix `makeRe` example (#143)
• chore: undocument removed options (#146)
• Remove unused time-require (#160)
• chore(deps): pin dependencies (#158)
• Update github workflow and add renovate config (#157)
• Merge pull request #155 from micromatch/prettier
• Add node 24 and 25
• Revert "chore: use prettier, update eslint, add node 24 and 25 to ci"
• update actions
• run less workflows in prs
• chore: Remove codeql and active in repo settings
• chore: use prettier, update eslint, add node 24 and 25 to ci

↗️ tinyglobby (indirect, 0.2.15 → 0.2.17) · Repo · Changelog

Release Notes

0.2.17

Changed

• Enabled staged publishing for stronger supply-chain security

Fixed

• Defaults when undefined is passed to any of the options by @chloeelim
• Drive-relative paths on Windows by @Andrej730
• FileSystemAdapter is now exported again

Consider sponsoring if you'd like to support the development of this project and the goal of reaching a lighter and faster ecosystem

0.2.16

Fixed

• Upgraded picomatch to 4.0.4, mitigating any potential exposure to CVE-2026-33671 and CVE-2026-33672

Changed

• Overhauled and optimized most internals by @Torathion
• Ignore patterns are no longer compiled twice by @webpro

Consider sponsoring if you'd like to support the development of this project and the goal of reaching a lighter and faster ecosystem

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 42 commits:

• release 0.2.17
• enable staged publishes
• Update all non-major dependencies (#204)
• improve benchmark infra
• disable cache in publish workflow
• set `minimumReleaseAge` in renovate
• remove `.vscode` folder
• fix alt text in readme (#203)
• run ci on node 26
• Update all non-major dependencies (#195)
• disable source maps on preview builds
• reuse cwd in benchmark
• bump pnpm to v11
• re-export `FileSystemAdapter`
• Update pnpm/action-setup action to v6 (#200)
• change readme badge to weekly downloads
• handle drive-relative paths on windows (#197)
• stop manually restoring mocks
• preserve truthy defaults when glob options are passed as undefined (#199)
• release 0.2.16
• bump deps once more
• do not import the whole `fs` module
• fix root being too broad
• chore(deps): update all non-major dependencies (#191)
• chore(deps): update pnpm/action-setup action to v5 (#192)
• upgrade picomatch (and everything else)
• chore(deps): update dependency picomatch to v4.0.4 [security] (#193)
• enable pnpm `trustPolicy`
• chore(deps): update all non-major dependencies (#181)
• chore(deps): update dependency tinybench to v6 (#183)
• chore(deps): update actions/checkout action to v6 (#180)
• avoid compiling ignore patterns twice (#190)
• chore(deps): update all non-major dependencies (#175)
• chore(deps): update dependency glob to v13 (#177)
• update readme mention of `globby` to 16.0.0
• process patterns and misc optimizations (#179)
• overhaul crawler options building and handling (#174)
• chore(deps): update dependency glob to v11.1.0 [security] (#176)
• chore(deps): update actions/setup-node action to v6 (#172)
• chore(deps): update all non-major dependencies (#165)
• refactor `GlobOptions` to center option processing (#170)
• outsource types to separate file (#169)

🆕 @​jridgewell/remapping (added, 2.3.5)

🆕 @​types/jsesc (added, 2.5.1)

🆕 @​vue-macros/common (added, 3.1.2)

🆕 @​vue/devtools-kit (added, 8.1.2)

🆕 @​vue/devtools-shared (added, 8.1.2)

🆕 ast-kit (added, 2.2.0)

🆕 ast-walker-scope (added, 0.9.0)

🆕 birpc (added, 2.9.0)

🆕 confbox (added, 0.2.4)

🆕 confbox (added, 0.1.8)

🆕 exsolve (added, 1.0.8)

🆕 hookable (added, 5.5.3)

🆕 local-pkg (added, 1.2.1)

🆕 magic-string-ast (added, 1.0.3)

🆕 mlly (added, 1.8.2)

🆕 pkg-types (added, 1.3.1)

🆕 pkg-types (added, 2.3.1)

🆕 muggle-string (added, 0.4.1)

🆕 pathe (added, 2.0.3)

🆕 perfect-debounce (added, 2.1.0)

🆕 quansync (added, 0.2.11)

🆕 scule (added, 1.3.0)

🆕 ufo (added, 1.6.4)

🆕 unplugin (added, 3.0.0)

🆕 unplugin-utils (added, 0.3.1)

🆕 @​babel/generator (added, 8.0.0-rc.6)

🆕 @​babel/helper-string-parser (added, 7.29.7)

🆕 @​babel/helper-string-parser (added, 8.0.0-rc.6)

🆕 @​babel/helper-validator-identifier (added, 7.29.7)

🆕 @​babel/helper-validator-identifier (added, 8.0.0-rc.6)

🆕 @​babel/parser (added, 7.29.7)

🆕 @​babel/parser (added, 8.0.0-rc.6)

🆕 @​babel/types (added, 7.29.7)

🆕 @​babel/types (added, 8.0.0-rc.6)

🆕 @​vue/devtools-api (added, 8.1.2)

🆕 chokidar (added, 5.0.0)

🆕 readdirp (added, 5.0.0)

🆕 webpack-virtual-modules (added, 0.6.2)

🆕 yaml (added, 2.9.0)

🗑️ @​babel/helper-string-parser (removed)

🗑️ @​babel/helper-validator-identifier (removed)

🗑️ prettier (removed)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)