@vue/typescript-plugin version 2.0.24 introduces subtle but potentially impactful updates for Vue developers leveraging TypeScript. The most notable change lies in its dependency on @volar/typescript, upgraded from ~2.3.1 in version 2.0.22 to ~2.4.0-alpha.2. This signifies a shift towards a newer, potentially unstable (alpha) version of Volar's TypeScript integration. Developers should be mindful that alpha versions might include experimental features or introduce unforeseen issues.
The core Vue language tooling also sees an update, moving from @vue/language-core 2.0.22 to 2.0.24. While the change seems minor, it might incorporate bug fixes or performance enhancements within the Vue language service itself, relevant for code completion, diagnostics, and refactoring operations within your IDE.
While both versions share the same @vue/shared dependency and devDependencies, the dist section reveals a slight increase in unpackedSize from 48037 to 49515, suggesting added functionality or revised code within the plugin. The release date difference indicates active development and refinement.
For developers, the move to Volar's alpha channel warrants careful consideration. While potentially offering new features and improvements to the Vue + TypeScript development experience, it also introduces the risk of instability. It would be wise to check the changelogs of both @volar/typescript and @vue/language-core package to assess the precise nature and implications of the updates before upgrading; particularly regarding the Volar typescript version change, and assess the potential impacts into the development workflow.
All the vulnerabilities related to the version 2.0.24 of the package
vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)
A vulnerability has been discovered in vue-template-compiler, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript code. Vue 2 has reached End-of-Life. This vulnerability has been patched in Vue 3.
