unplugin-vue-i18n has a dependency on @eslint-community/eslint-utils which triggers CVE's

[stefanlivens]

Reporting a bug?

So unplugin-vue-i18n has a direct dependency on @eslint-community/eslint-utils.
This one uses uri-js@4.4.1, a package that hasn't been touched for 6 years.

Today a CVE on this package turned up (CVE-2026-93690, CVE-2026-93690 ).

Would it be possible to move this to the devDependencies, where it belongs?

Expected behavior

@eslint-community/eslint-utils is not something I would expect in the dependencies of this package. I would expect it as a devDependency.

Reproduction

See https://www.cve.org/CVERecord?id=CVE-2026-93690

Issue Package

unplugin-vue-i18n

System Info

@intlify/unplugin-vue-i18n v11.2.5

Screenshot

No response

Additional context

No response

Validations

• Read the Contributing Guidelines.
• Read the README
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion.