[dependabot]

Bumps the vue-ecosystem group with 3 updates in the /web directory: pinia, vue and vue-router.

Updates pinia from 4.0.3 to 4.1.0

Commits

• 270a217 release: pinia@4.1.0 @​pinia/testing@​2.0.2 @​pinia/nuxt@​1.0.3
• bf7ea46 feat: warn when disposing a replaced store (#3193)
• fddd7c5 test: unused
• 52fc965 feat: add getStores() (#3194)
• f48737e docs: fix links to heading anchors that use the wrong case (#3189)
• 668e881 refactor(nuxt): upgrade module for Nuxt 4.6 (#3188)
• a158186 fix(testing): notify shallow refs on initial state (#3187)
• 98587ca fix(nuxt): resolve default storesDirs against each layer (#3185)
• f4e0cb7 docs: fix dead Vue Devtools installation link (#3181)
• a4eb2c5 fix: trigger shallow refs patched via object syntax (fix #2861) (#3177)
• Additional commits viewable in compare view

Updates vue from 3.5.43 to 3.5.44

Release notes

Sourced from vue's releases.

v3.5.44

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.44 (2026-10-13)

Bug Fixes

• compat: expose _setupProxy for Vue 2.7 compiled script setup (fix #11164) (#15618) (f08059d)
• compiler-core: parenthesise v-for key in v-memo cache guard (#15724) (d084b90), closes #15723
• compiler-dom: correctly stringify 0 and false in v-html (#15571) (9f3b437)
• compiler-dom: inject transition persisted for v-show in production (#15783) (89cb272)
• compiler-sfc: error when defineModel prop options reference a destructured prop (#15604) (38012a5), closes #15602
• custom-element: skip mounting an async custom element removed while its component loads (#15777) (0f8e7b4), closes #15775
• hydration: observe children of a display: contents root in hydrateOnVisible (#15773) (7f688e8)
• KeepAlive: unmount pruned current component when its vnode was cloned on mount (#15711) (92798ac), closes #15710
• reactivity: avoid mutating native array iterators (#15703) (7f9d45d), closes #15643
• reactivity: do not track deps in watcher callbacks run inside another effect (#15782) (db00fe9), closes #5009
• reactivity: once watcher should stop when its callback throws (#15755) (ae4bd94)
• reactivity: preserve shallow collection semantics (#15793) (b600466), closes #15792
• runtime-core: detect new prop keys when comparing full props (#15634) (702fa61), closes #15632
• runtime-core: keep async placeholder for block patching and pending component updates (#15554) (05ec25f), closes #15551
• runtime-core: only flush jobs queued by the root render itself (#15757) (0bea14b), closes #6728
• runtime-core: render nothing for an invalid v-for range in production (#15742) (ad19e7d)
• runtime-dom: preserve v-show display for unchanged style strings (#15794) (c0a6d3f)
• runtime-dom: treat playsinline as a boolean attribute (#15627) (a084e44)
• server-renderer: propagate async setup errors (#15857) (6930374), closes #15716
• ssr: honor falsy vnode content overrides (#15769) (c11c5c8)
• suspense: mount resolved async component with its own namespace (#15640) (2a086a2), closes #15639
• suspense: skip rendering async components unmounted while pending (4ab865a)
• teleport: move targetStart and keep children before targetAnchor (#15818) (d3c6e02), closes #15817
• transition-group: measure nested groups against their moving outer item (#15848) (1936c87), closes #5385 #1531
• transition: handle comment-wrapped component roots (#15853) (ff35014), closes #6080 #5500

Commits

• bf5f0dd release: v3.5.44
• 6930374 fix(server-renderer): propagate async setup errors (#15857)
• 8e8c547 chore(deps): update all non-major dependencies (#15585)
• 4cb0ca8 chore(deps): update playground (#15685)
• e38478f chore(deps): update dawidd6/action-download-artifact action to v27 (#15768)
• 1caed5a chore(deps): update compiler (#15586)
• a49f451 chore(deps): update lint (#15680)
• 219b858 chore(deps): update build (#15679)
• ff35014 fix(transition): handle comment-wrapped component roots (#15853)
• d084b90 fix(compiler-core): parenthesise v-for key in v-memo cache guard (#15724)
• Additional commits viewable in compare view

Updates vue-router from 5.3.1 to 5.4.0

Release notes

Sourced from vue-router's releases.

v5.4.0

   🚨 Breaking Changes

• experimental: Normalize query values to arrays  -  by @​posva in vuejs/router#2824 (f1fbc)

   🚀 Features

• Accept a prebuilt matcher in createRouter  -  by @​danielroe in vuejs/router#2804 (9de96)
• UseScrollRestoration and onRouteRendered  -  by @​posva in vuejs/router#2805 (e3dde)
• Diagnose experimental beforeEnter migration  -  by @​posva (b695c)
• experimental:
  • Warn about legacy optional param removal  -  by @​posva in vuejs/router#2818 (c2f92)
  • Extract hash params with definePage  -  by @​posva (dbf2d)
  • Configure required and default hash params  -  by @​posva (cef5c)
  • Never decode the hash, protect-only encoding  -  by @​posva in vuejs/router#2760 (aca2c)
  • Allow custom regexp for path params in definePage  -  by @​posva in vuejs/router#2822 (3a192)
• router:
  • Restore hashes and top by default  -  by @​posva (7c385)

   🐞 Bug Fixes

• Resolve experimental guard redirects against target on history navigation  -  by @​posva (2c5fb)
• experimental:
  • Keep declared case of static prefix in MatcherPatternPathStar.build()  -  by @​contactjawad in vuejs/router#2798 (4dc6b)
  • Make hash params optional and nullable  -  by @​posva (d9a4c)
  • Exclude defaults from required hash params  -  by @​posva (346e2)
  • Align hash parameter parsing with queries  -  by @​posva (cf251)
  • Keep last hash param instead of throwing  -  by @​posva (d1e8a)
  • Disallow required with a default for query params  -  by @​posva (f60e9)
  • Make query params with a default optional on push  -  by @​posva (fb604)
  • Do not inherit params, query, or hash on redirects  -  by @​posva (02a92)
• history:
  • Invalidate obsolete scroll positions  -  by @​posva and @​liuly0322 in vuejs/router#2814 (071f1)
• unplugin:
  • Sanitize named view in definePage import  -  by @​giaBaoJS in vuejs/router#2809 (0711d)
  • Keep hex character codes in param segments regexp  -  by @​kwy404 in vuejs/router#2811 (07663)

   🏎 Performance

• unplugin: Cache merged route overrides  -  by @​posva in vuejs/router#2821 (732b7)

    View changes on GitHub

Commits

• 596d481 release: vue-router@5.4.0
• 2970e8e chore: fix back extends
• 16a62f8 chore(deps): upgrade dependencies (#2828)
• b810a7e chore: remove unused types
• a0efbde docs: adapt
• 2c5fbd6 fix: resolve experimental guard redirects against target on history navigation
• 6ef3163 refactor: allow undefined on optional param
• 8e89a60 chore: comment
• 72ceb99 refactor: absolute position
• 57dd1d6 refactor: allow guards to return relative location
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, javascript. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.