[Snyk] Upgrade vue-i18n from 9.10.2 to 11.1.3 #68

nerdy-tech-com-gitub · 2025-05-15T04:11:27Z

Snyk has created this PR to upgrade vue-i18n from 9.10.2 to 11.1.3.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

The recommended version is 41 versions ahead of your current version.
The recommended version was released a month ago.

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Regular Expression Denial of Service (ReDoS) SNYK-JS-CROSSSPAWN-8303230	140	Proof of Concept
Incorrect Authorization SNYK-JS-VITE-9653016	140	Proof of Concept
Prototype Pollution SNYK-JS-VUEI18N-8442254	140	Proof of Concept
Prototype Pollution SNYK-JS-VUEI18N-9376708	140	Proof of Concept
Prototype Pollution SNYK-JS-INTLIFYSHARED-8442251	140	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-BABELHELPERS-9397697	140	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-BABELRUNTIME-10044504	140	Proof of Concept
Access Control Bypass SNYK-JS-VITE-9576207	140	Proof of Concept
Information Exposure SNYK-JS-VITE-9685035	140	Proof of Concept
Directory Traversal SNYK-JS-VITE-9919777	140	Proof of Concept
Cross-site Scripting (XSS) SNYK-JS-VUEI18N-8442260	140	Proof of Concept
Cross-site Scripting (XSS) SNYK-JS-INTLIFYCOREBASE-8442262	140	Proof of Concept
Improper Input Validation SNYK-JS-NANOID-8492085	140	No Known Exploit
Cross-site Scripting (XSS) SNYK-JS-ROLLUP-8073097	140	Proof of Concept
Origin Validation Error SNYK-JS-VITE-8648411	140	Proof of Concept
Incorrect Authorization SNYK-JS-VITE-9512410	140	Mature

Release notes

Package name: vue-i18n

11.1.3 - 2025-04-05
11.1.2 - 2025-03-07

What's Changed

🔒 Security Fixes
- fix: prototype pollution in handleFlatJson, about details see GHSA-p2ph-7g93-hw3m
Full Changelog: v11.1.1...v11.1.2
11.1.1 - 2025-02-09

Full Changelog: v11.1.0...v11.1.1
11.1.0 - 2025-01-31

What's Changed

🌟 Features
- feat: configurable ComponentCustomProperties['$i18n'] type by @ BobbieGoede in #2094
📝️ Documentations
- fix: vue-i18n v8 EOL by @ kazupon in #2060
Full Changelog: v11.0.1...v11.1.0
11.0.1 - 2024-12-26

What's Changed

⚡ Improvement Features
- fix: v-t custom directive warning when it will run by @ kazupon in #2057
Full Changelog: v11.0.0...v11.0.1
11.0.0 - 2024-12-24

We are excited to announce the release of Vue I18n v11.
We had many contributors.

Thanks for your contributing ❤️

Summary

Deprecate Legacy API mode

The Legacy API mode was the API mode compatible with v8 for Vue 2. When v9 was released, the Legacy API was provided to smooth the migration from v8 to v9.

Legacy API mode will be deprecated in v11, as previous vue-i18n releases have already provided the following to support migration to Composition API mode
- Migration from Legacy API mode to Composition API mode, see the docs
- Composition API usage, see the docs
For compatibility, Legacy API mode still works in v11, but will be removed entirely in v12, so Legacy API mode will not work after that version.

Deprecate Custom Directive v-t

The advantage of v-t was that it could optimize performance using the vue compiler transform and the pre-translation of vue-i18n-extension.

This feature was supported from Vue 2.
About details see the blog article

In Vue 3, due to the Composition API, the pre-translation of vue-i18n-extension is now limited only for global scope.

In addition, Vue 3 Virtual DOM optimization has been introduced, and the optimization provided by vue-i18n-extension is no longer very effective. We need to require settings for SSR, the benefits of using v-t have disappeared. And DX of templates using v-t is not good. Custom directives do not work with key completion in editors (e.g. vscode).

For compatibility, v-t mode still works in v11, but will be removed entirely in v12, so v-t will not work after that version.

Drop tc and $tc for Legacy API mode

These APIs had already deprecated in warning about being dropped in v11. docs says

Vue I18n maintenance Status

Vue I18n v8 is no longer supported after 2025. Vue I18n v9 and Vue I18n v10 is in maintenance mode after 2025 July.

With the release of Vue I18n v11, that version will become mainstream.

The maintenance detail status of Vue I18n v9 and Vue I18n v10 is as follows:

You can check the maintenance status on the docs

❗ Braeking Changes
- feat!: deprecate Legacy API mode by @ kazupon in #2016
- breaking: drop $tc and tc by @ kazupon in #2017
- feat!: deprecate v-t custom directive by @ kazupon in #2045
⚡ Improvement Features
- fix: tm function should accept DefineLocaleMessage key type by @ BobbieGoede in #2014
🔒 Security Fixes
- fix: security vulnerability fix porting by @ kazupon in #2034
📝️ Documentations
- Change config prop for quasar flags by @ chrissyast in #2003
- docs: Pluralization Page by @ Sammuel09 in #1998
- docs: fix composition section by @ Sammuel09 in #2008
- fix(docs): correct output in composition api example by @ pejeio in #2012
- docs: not use deprecated api by @ kazupon in #2013
- docs: fix wrong plural example by @ kazupon in #2033
- docx(pluralization.md): Correct spelling from 'gloal' to 'global' by @ PuppyOne in #2038
- Fix typo by @ shaedrich in #2040
- Fix another typo by @ shaedrich in #2041
- docs: add maintenance status by @ kazupon in #2044
👋 New Contributors
- @ chrissyast made their first contribution in #2003
- @ Sammuel09 made their first contribution in #1998
- @ pejeio made their first contribution in #2012
- @ PuppyOne made their first contribution in #2038
- @ shaedrich made their first contribution in #2040
Full Changelog: v10.0.4...v11.0.0
11.0.0-rc.1 - 2024-12-19
11.0.0-beta.2 - 2024-11-28
11.0.0-beta.1 - 2024-11-17
11.0.0-beta.0 - 2024-11-14
10.0.7 - 2025-04-05
10.0.6 - 2025-03-07

What's Changed

🔒 Security Fixes
- fix: prototype pollution in handleFlatJson, about details see GHSA-p2ph-7g93-hw3m
Full Changelog: v10.0.5...v10.0.6
10.0.5 - 2024-11-28
10.0.4 - 2024-10-06
10.0.3 - 2024-09-22
10.0.2 - 2024-09-21
10.0.1 - 2024-09-12
10.0.0 - 2024-09-10
10.0.0-rc.1 - 2024-09-05
10.0.0-beta.6 - 2024-08-29
10.0.0-beta.5 - 2024-07-19
10.0.0-beta.4 - 2024-07-16
10.0.0-beta.3 - 2024-07-14
10.0.0-beta.2 - 2024-07-05
10.0.0-beta.1 - 2024-05-23
10.0.0-alpha.5 - 2024-05-15
10.0.0-alpha.4 - 2024-05-09
10.0.0-alpha.3 - 2024-04-27
10.0.0-alpha.2 - 2024-04-22
10.0.0-alpha.1 - 2024-04-21
9.14.4 - 2025-04-06
9.14.3 - 2025-03-07

What's Changed

🔒 Security Fixes
- fix: prototype pollution in handleFlatJson, about details see GHSA-p2ph-7g93-hw3m
Full Changelog: v9.14.2...v9.14.3
9.14.2 - 2024-11-28
9.14.1 - 2024-09-26
9.14.0 - 2024-08-16
9.13.1 - 2024-04-20
9.13.0 - 2024-04-17
9.12.1 - 2024-04-14
9.12.0 - 2024-04-12
9.11.1 - 2024-04-10
9.11.0 - 2024-04-04
9.10.2 - 2024-03-15

from vue-i18n GitHub release notes

Important

Warning: This PR contains a major version upgrade, and may be a breaking change.
Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.
Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Summary by Sourcery

Enhancements:

Bump vue-i18n from v9.10.2 to v11.1.3 to incorporate upstream security fixes and maintain compatibility with the latest Vue ecosystem

Snyk has created this PR to upgrade vue-i18n from 9.10.2 to 11.1.3. See this package in npm: vue-i18n See this project in Snyk: https://app.snyk.io/org/nerds-github/project/a6d95be2-6fa7-418d-8fd1-0cd3974eee23?utm_source=github&utm_medium=referral&page=upgrade-pr

sourcery-ai · 2025-05-15T04:11:32Z

Reviewer's Guide

This PR upgrades the vue-i18n dependency from version ^9.10.2 to ^11.1.3 in the frontend, updating package.json (and regenerating the lockfile) to pull in the latest major release that addresses multiple security vulnerabilities and includes breaking changes.

Class Diagram: API Changes in vue-i18n (v9.10.2 to v11.1.3)

classDiagram
  class VueI18n_API {
    <<vue-i18n Library>>
    + version : "9.10.2 -> 11.1.3"

    -- Deprecated Features (in v11, for removal in v12) --
    # LegacyAPIMode_Support "Support for v8-compatible API (options and instance methods)"
    # v_t_directive "Custom template directive for translations (e.g., <p v-t="'hello'"></p>)"

    -- Removed Features (in v11) --
    - tc() "Global translation choice function (Legacy API)"
    - $tc() "Instance translation choice method (Legacy API)"

    -- Notable New/Enhanced Features --
    + configurable_dollar_i18n_type "Type for ComponentCustomProperties['$i18n'] is configurable (v11.1.0)"
    + tm_function_key_type_improvement "tm() function now better accepts DefineLocaleMessage key types (v11.0.0)"

    -- Core Composition API (Primary & Recommended API) --
    + useI18n()
    + t()
    + rt()
    + d()
    + n()
    + tm()
  }
  note for VueI18n_API "This diagram highlights significant API changes in vue-i18n from v9.10.2 to v11.1.3, focusing on deprecations, removals, and notable enhancements as per release notes. Developers should review their usage of deprecated/removed features."

File-Level Changes

Change	Details	Files
Upgrade vue-i18n to a new major version	Updated the vue-i18n version specifier in package.json from ^9.10.2 to ^11.1.3 Regenerated the lockfile to reflect the new dependency tree	`frontend/package.json` `frontend/package-lock.json`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Snyk] Upgrade vue-i18n from 9.10.2 to 11.1.3 #68

[Snyk] Upgrade vue-i18n from 9.10.2 to 11.1.3 #68

Uh oh!

nerdy-tech-com-gitub commented May 15, 2025 •

edited by sourcery-ai bot

Loading

What's Changed

🔒 Security Fixes

What's Changed

🌟 Features

📝️ Documentations

What's Changed

⚡ Improvement Features

Summary

Deprecate Legacy API mode

Deprecate Custom Directive `v-t`

Drop `tc` and `$tc` for Legacy API mode

Vue I18n maintenance Status

❗ Braeking Changes

⚡ Improvement Features

🔒 Security Fixes

📝️ Documentations

👋 New Contributors

What's Changed

🔒 Security Fixes

What's Changed

🔒 Security Fixes

Uh oh!

sourcery-ai bot commented May 15, 2025 •

edited

Loading

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

Uh oh!

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

[Snyk] Upgrade vue-i18n from 9.10.2 to 11.1.3 #68

Are you sure you want to change the base?

[Snyk] Upgrade vue-i18n from 9.10.2 to 11.1.3 #68

Uh oh!

Conversation

nerdy-tech-com-gitub commented May 15, 2025 • edited by sourcery-ai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Snyk has created this PR to upgrade vue-i18n from 9.10.2 to 11.1.3.

Issues fixed by the recommended upgrade:

What's Changed

🔒 Security Fixes

What's Changed

🌟 Features

📝️ Documentations

What's Changed

⚡ Improvement Features

Summary

Deprecate Legacy API mode

Deprecate Custom Directive v-t

Drop tc and $tc for Legacy API mode

Vue I18n maintenance Status

❗ Braeking Changes

⚡ Improvement Features

🔒 Security Fixes

📝️ Documentations

👋 New Contributors

What's Changed

🔒 Security Fixes

What's Changed

🔒 Security Fixes

Summary by Sourcery

Uh oh!

sourcery-ai bot commented May 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer's Guide

Class Diagram: API Changes in vue-i18n (v9.10.2 to v11.1.3)

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

Uh oh!

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

nerdy-tech-com-gitub commented May 15, 2025 •

edited by sourcery-ai bot

Loading

Deprecate Custom Directive `v-t`

Drop `tc` and `$tc` for Legacy API mode

sourcery-ai bot commented May 15, 2025 •

edited

Loading