@vue/typescript-plugin version 2.0.18 is a minor update to the TypeScript language service plugin for Vue projects, building upon the foundation laid by version 2.0.17. Both versions serve the same purpose: enhancing the TypeScript experience within Vue development environments by providing features like template type checking, component auto-completion, and go-to-definition support for Vue single-file components. These plugins are designed to integrate seamlessly with tsserver or typescript-language-server, requiring installation in a location accessible by the server or within the node_modules of the project.
The key difference between the two lies in their dependencies. Version 2.0.18 upgrades @volar/typescript from ~2.2.2 to ~2.2.4 and includes @vue/language-core version 2.0.18 from 2.0.17 of the previous version. This indicates improvements and bug fixes within the core type-checking and language service features provided by Volar, likely leading to more accurate and reliable code completion, error detection, and overall better performance. Changes to @vue/language-core suggest improvements of internal toolings.
For developers, upgrading to version 2.0.18 translates to a potentially more polished and error-free development experience, especially regarding the quality of TypeScript support within Vue templates and components. It's a recommended update to ensure you're leveraging the latest advancements in Vue's TypeScript tooling, contributing to smoother workflows and improved code quality. The release date of 2.0.18 being May 15, 2024, compared to May 10, 2024, for 2.0.17 signifies a relatively quick turnaround, often indicating a fix for a recently discovered issue or the incorporation of new refinements.
All the vulnerabilities related to the version 2.0.18 of the package
vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)
A vulnerability has been discovered in vue-template-compiler, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript code. Vue 2 has reached End-of-Life. This vulnerability has been patched in Vue 3.
