Version 2.0.20 of the @vue/typescript-plugin, released on June 8, 2024, introduces key updates compared to the previous stable version, 2.0.19 released May 16, 2024 impacting Vue developers leveraging TypeScript for their projects. Primarily, the update involves a shift in dependencies, specifically updating @volar/typescript from version ~2.2.4 to ~2.3.0-alpha.14. This change suggests improvements or bug fixes within the TypeScript language server integration provided by Volar, likely enhancing the development experience through more accurate code completion, diagnostics, and overall language support for Vue components written in TypeScript.
Furthermore, @vue/language-core sees an update, moving from version 2.0.19 to 2.0.20. With fileCount being the same and a decreasing unpackedSize for the newest version, developers might see improvements related to performance or a streamlining of the plugin's footprint. Also that may suggest optimazed architecture in general. While both versions maintain compatibility with @vue/shared at version ^3.4.0 and @types/node at "latest," the @volar/typescript dependency highlights the most significant area of change. Developers should particularly note this update if they've encountered issues with type checking or language services in their Vue + TypeScript projects, as version 2.0.20 aims for greater stability and enhanced features in the core Vue language support. This update potentially helps create a smoother, more reliable, and efficient development workflow when working with Vue and TypeScript.
All the vulnerabilities related to the version 2.0.20 of the package
vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)
A vulnerability has been discovered in vue-template-compiler, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript code. Vue 2 has reached End-of-Life. This vulnerability has been patched in Vue 3.
