[DPEDE-1784](deps): Bump @nuxt/devtools from 2.6.2 to 2.7.0

[dependabot]

Bumps @nuxt/devtools from 2.6.2 to 2.7.0.

Release notes

Sourced from @​nuxt/devtools's releases.

v2.7.0

   🐞 Bug Fixes

• devtools: Use vite plugin for env-specific config  -  by @​danielroe in nuxt/devtools#899 (0c258)

    View changes on GitHub

v2.6.5

   🐞 Bug Fixes

• Ensure path resolve is safe  -  by @​antfu (1fabb)

    View changes on GitHub

v2.6.4

   🐞 Bug Fixes

• Using textContent instead of innerHtml for auth pagechore: update lock  -  by @​antfu (7cadb)

    View changes on GitHub

v2.6.3

No significant changes

    View changes on GitHub

Changelog

Sourced from @​nuxt/devtools's changelog.

2.7.0 (2025-10-26)

Bug Fixes

• devtools: use vite plugin for env-specific config (#899) (0c258d4)

2.6.5 (2025-09-20)

Bug Fixes

• ensure path resolve is safe (1fabb49)

2.6.4 (2025-09-19)

Bug Fixes

• using textContent instead of innerHtml for auth pagechore: update lock (7cadbbe)

2.6.3 (2025-08-22)

Commits

• e62257b chore: release v2.7.0
• d80924b chore: update deps
• 0c258d4 fix(devtools): use vite plugin for env-specific config (#899)
• 2cd1e2c chore: release v2.6.5
• 191eb3f refactor: unified all error messages
• 1fabb49 fix: ensure path resolve is safe
• 39a0677 chore: release v2.6.4
• 7cadbbe fix: using textContent instead of innerHtml for auth pagechore: update lock
• 27f80d0 chore: release v2.6.3
• See full diff in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​nuxt/devtools since your current version.

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[lumn-sonarent]

SonarQube Quality Gate

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[lumen-jenkins-prod]

The CI pipeline has run successfully in https://jenkinsprod.corp.intranet:8443/job/UX-CHI/job/Productive/job/Chi/job/PR-1818/1/. ✅

[lumen-jenkins-prod]

You can check this PRs instance in https://nginx-pr-1818-ux-chi.rke-odc-test.corp.intranet (internal)

[cl-aifel-test]

🔖 aifel-verdict — AiFEL dependency-triage verdict (schema 1.1)

AiFEL verdict — 🚨 Escalate (ci-health) — human review required

Minor @nuxt/devtools bump 2.6.2→2.7.0 fixes a medium-severity XSS advisory with no in-repo code impact, but critical CI confidence is low (64% pass rate over 28 runs) — a human should confirm CI health before merging.

TL;DR

• Merge: 🔍 review CI, then merge — the dependency itself is safe; the blocker is the repo's pre-existing low critical-CI pass rate (unrelated to this PR).
• Breaks your code? ✅ Most likely not — @nuxt/devtools is not imported anywhere in your source.
• Security? ✅ this bump fixes GHSA-xmq3-q5pm-rp26 (XSS, CVSS 6.9).
• Update: @nuxt/devtools — you have 2.6.2, this PR installs 2.7.0 (minor, spans 5 release(s)). Fixes 1 XSS advisory (CVSS 6.9), no code impact; routine minor refresh.

Signal	Value	Interpretation
Bump type	minor	2.6.2→2.7.0; minor semver means backward-compatible additive changes — no breaking changes expected by contract.
Dependency risk	low	Minor bump; changelog (v2.6.3–v2.7.0) contains only bug fixes (XSS auth-page fix, path-resolve safety, vite plugin env config). No documented breaking changes in range; package is not imported anywhere in this repo, so blast radius is zero.
Security risk	low	This bump fixes GHSA-xmq3-q5pm-rp26 (XSS, CVSS 6.9); new version 2.7.0 is outside every advisory's affected range. GHSA-rcvg-rgf7-pppv (Path Traversal, CVSS 8.8) affects <1.3.9 — the old version 2.6.2 was already well past the patch and was not affected either. No advisories affect 2.7.0.
CI health risk	high	Critical checks: pass 64% (≈18/28 runs), flaky 0%. Pass rate below the 70% medium threshold → ci_confidence: low. Failing runs are primarily Dependabot batch-update workflows (npm_and_yarn for babel/cypress/node/etc.) classified as critical/ambiguous. No informational workflows excluded. This is a pre-existing repo health issue, not introduced by this PR.
API usage in repo	false	Node scan searched all import/require forms for @nuxt/devtools across the workspace; 0 hits in 0 matched files — package is not imported in application source.
Cross-repo signal	standalone	No publishable root manifest found in the repository.
Data completeness	complete	All 5 signals obtained: classification ✅, API usage ✅, release notes ✅, CI health ✅, cascade ✅.

📋 Why this route + what AiFEL checked (click to expand)

Why this route?

escalate because: critical CI confidence is low (pass_rate 0.643, below the 0.70 medium threshold, over 28 critical runs).

Escalation category: ci-health

Confidence breakdown — score: 0.85. List the factors that produced it, not just the number:

• ✅ Minor bump (backward-compatible by semver contract)

• ✅ No in-repo usage — blast radius zero

• ✅ No advisories affect new version 2.7.0; one XSS advisory resolved by this bump

• ✅ Release notes available and complete for the range

• ✅ No cascade conflicts

• ✅ Complete data (5/5 signals)

• ⚠️ Critical CI low: pass rate 64% over 28 runs (below medium threshold of 70%) — pre-existing repo condition, not caused by this PR

• 💡 To reach a lower route: Fix the pre-existing failing critical checks on master so the pass rate rises to ≥70% (medium) — this PR would then route to spot_check. Note that the CI failures appear to be other Dependabot batch-update PRs running CI, not a fundamental breakage of your test suite.

What AiFEL checked

1. Triage — classified minor (@nuxt/devtools 2.6.2→2.7.0).
2. Symbol extraction — none found (0 import sites across 0 files; node-scan ground-truth).
3. Release-notes comparator — v2.6.3: no significant changes; v2.6.4: XSS fix (textContent vs innerHTML); v2.6.5: path-resolve safety fix; v2.7.0: vite plugin env-config fix. All bug fixes, no breaking changes.
4. CI health — 28 critical runs: pass 64%, flaky 0% → confidence low; informational excluded: none.
5. Cascade coordinator — 0 conflicts.
6. Data completeness — obtained 5/5 signals; missing: none.

Will merging break your code?

✅ Per AiFEL analysis, most likely won't impact your code. @nuxt/devtools is not imported anywhere in this repository's source, so none of the changes in this release range can affect runtime behaviour.

Security advisories

✅ This bump resolves all 1 known advisories and none affect 2.7.0 — clear on the security axis.

✅ Resolved by this bump (1): GHSA-xmq3-q5pm-rp26 — no action needed (highest was CVSS 6.9).

GHSA-xmq3-q5pm-rp26 (CVE-2025-52662, CVSS 6.9, medium) — XSS in Nuxt DevTools auth page via innerHTML; fixed in 2.6.4 by switching to textContent. Affects <2.6.4; new version 2.7.0 is not affected. Merge — this bump is the fix.

GHSA-rcvg-rgf7-pppv (CVE-2024-23657, CVSS 8.8, high) — Path traversal (../filedir) in Nuxt DevTools; fixed in 1.3.9. Affects <1.3.9; both old (2.6.2) and new (2.7.0) versions are well past the patched release — neither version is affected. No action needed.

Packages — what you have vs what this PR installs

Ecosystem	Package	You have	This PR installs	What changes for you
npm	@nuxt/devtools	2.6.2	2.7.0	Fixes GHSA-xmq3-q5pm-rp26 (XSS, CVSS 6.9); bug-fix minor refresh; no code impact

---

Machine-readable verdict

{
  "schema_version": "1.1",
  "classification": "minor",
  "risk_band": "low",
  "ci_confidence": "low",
  "decision_route": "escalate",
  "data_completeness": "complete",
  "escalate_reason": "risk",
  "missing_signals": [],
  "confidence": 0.85,
  "packages": [{"ecosystem": "npm", "name": "@nuxt/devtools", "old_version": "2.6.2", "new_version": "2.7.0"}],
  "breaking_changes": [],
  "cascade_conflicts": [],
  "summary": "Minor @nuxt/devtools bump 2.6.2→2.7.0 fixes a medium-severity XSS advisory (GHSA-xmq3-q5pm-rp26, CVSS 6.9) with zero in-repo code impact; escalated solely on pre-existing low critical-CI pass rate (64% over 28 runs).",
  "upgrade_risk_note": null,
  "cross_repo_signal": "standalone",
  "api_usage_found": false,
  "advisory_ids": [],
  "max_cvss": null,
  "feedback_capture_marker": "aifel-CenturyLink-Chi-1818",
  "agent_version": "1.1.1-aw"
}

🤖 Generated by AiFEL — AI-assisted Dependabot triage. Advisory only; a human reviewer still decides and merges.
📝 Share your AiFEL experience

[dependabot]

Superseded by #2135.