refactor: drop destr in favor of native JSON.parse

Replace destr with a small JSON.parse helper for parsing the props query
in the import plugin. Keeps destr prototype-pollution guard via a reviver
that strips __proto__/constructor keys. Removes the destr dependency and
catalog entry.

Author: AndreyYolkin

packages/vuetify-nuxt-module/package.json

@@ -80,7 +80,6 @@
     "@vuetify/loader-shared": "catalog:",
     "@vuetify/unplugin-styles": "catalog:",
     "defu": "catalog:",
-    "destr": "catalog:",
     "local-pkg": "catalog:",
     "pathe": "catalog:",
     "perfect-debounce": "catalog:",
@@ -131,7 +130,6 @@
       "node:child_process",
       "node:fs",
       "consola",
-      "destr",
       "esbuild",
       "local-pkg",
       "pathe",

packages/vuetify-nuxt-module/src/vite/vuetify-import-plugin.ts

@@ -2,7 +2,6 @@ import type { Options } from '@vuetify/loader-shared'
 import type { Plugin } from 'vite'
 import { pathToFileURL } from 'node:url'
 import { generateImports } from '@vuetify/loader-shared'
-import destr from 'destr'
 import { isAbsolute } from 'pathe'
 import { parseQuery, parseURL } from 'ufo'
 import { createFilter } from 'vite'
@@ -12,10 +11,26 @@ function parseId2 (id: string) {
   return parseURL(decodeURIComponent(isAbsolute(id) ? pathToFileURL(id).href : id))
 }
 
+function reviver (key: string, value: unknown) {
+  if (key === '__proto__' || key === 'constructor') {
+    return undefined
+  }
+  return value
+}
+
+function parseProps (value: string): Record<string, any> | undefined {
+  try {
+    const parsed = JSON.parse(value, reviver)
+    return parsed && typeof parsed === 'object' ? parsed : undefined
+  } catch {
+    return undefined
+  }
+}
+
 function parseId (id: string) {
   const { search, pathname } = parseId2(id)
   const query = parseQuery(search)
-  const urlProps = query.props ? destr<Record<string, any>>(query.props as string) : undefined
+  const urlProps = query.props ? parseProps(query.props as string) : undefined
 
   return {
     query: urlProps,

pnpm-lock.yaml

@@ -46,7 +46,6 @@ catalog:
   date-fns-jalali: 2.19.0-2
   dayjs: ^1.11.19
   defu: ^6.1.4
-  destr: ^2.0.5
   eslint: ^10.0.2
   eslint-config-vuetify: 4.3.5-beta.1
   local-pkg: ^1.1.2