Vue Template Compiler version 2.7.4 represents a subtle but potentially important update over its predecessor, version 2.7.3. Both versions serve as the template compiler for Vue 2.0, vital for developers building applications with the Vue framework. Key dependencies like de-indent and he remain consistent between versions, ensuring continued compatibility for handling code indentation and HTML entity encoding. The developer dependencies also stay the same, pointing to a continued local linking strategy with the core Vue library during development.
The most noticeable difference lies in the dist section. While both versions maintain the same file count (7), the unpackedSize increases slightly from 592183 bytes in 2.7.3 to 592336 bytes in 2.7.4. This suggests minor code modifications or additions likely addressing bug fixes, performance enhancements, or edge-case handling within the template compilation process. The releaseDate also shifts from July 6th to July 8th, 2022, marking the later release of version 2.7.4.
Developers should consider upgrading to 2.7.4 to benefit from these incremental improvements, especially if they've encountered any template compilation issues in previous versions. Though seemingly small, such refinements can contribute to more robust and efficient Vue applications. The MIT license ensures flexibility for integration into various projects. Checking the official Vue changelog for detailed commit messages between these versions is highly recommended for a comprehensive understanding of the implemented changes.
All the vulnerabilities related to the version 2.7.4 of the package
vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)
A vulnerability has been discovered in vue-template-compiler, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass
or Object.prototype.staticStyle
to execute arbitrary JavaScript code. Vue 2 has reached End-of-Life. This vulnerability has been patched in Vue 3.