@vue/typescript-plugin version 2.0.26 introduces several changes compared to the previous stable version 2.0.24, primarily centered around dependency updates. Most notably, the "@volar/typescript" dependency has been updated from "~2.4.0-alpha.2" to "~2.4.0-alpha.15". This update pulls in newer features and bug fixes from the Volar TypeScript language service, which powers the enhanced TypeScript support for Vue Single File Components (SFCs) and improves the overall developer experience within Vue projects using TypeScript. While the core "@vue/shared" and "@vue/language-core" dependencies remain relatively aligned in terms of their versions, the upgrade to "@volar/typescript" likely brings refinements in areas such as code completion, diagnostics, refactoring, and type checking within Vue templates and script blocks.
Developers leveraging this plugin will benefit from the continuous improvements being made to the underlying Volar language service, leading to possibly more accurate type information, better error reporting, and a more streamlined coding workflow. The small increase in "unpackedSize" suggests that the new version might incorporate additional code related to enhanced features or improved performance. Consider testing the upgrade within your development environment to ensure compatibility with your existing codebase and to leverage the latest features offered by the updated Volar integration. The updated release date also confirms that version 2.0.26 delivers the most recent set of fixes and enhancements available for Vue TypeScript development. By adopting this version, developers ensure they are using the most up-to-date tools for building robust and maintainable Vue applications with TypeScript.
All the vulnerabilities related to the version 2.0.26 of the package
vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)
A vulnerability has been discovered in vue-template-compiler, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript code. Vue 2 has reached End-of-Life. This vulnerability has been patched in Vue 3.
