Vue Template Compiler version 2.7.5 represents a minor update over its predecessor, version 2.7.4. Both versions serve as the template compiler for Vue 2.0, a crucial tool for developers working with the Vue.js framework. Both versions share the same core set of dependencies: de-indent for handling code indentation and he for HTML entity encoding/decoding. They also maintain the same development dependency on the core vue package, sourced locally using a relative file path.
The license remains MIT, and the repository details point to the official Vue.js GitHub repository, ensuring developers have access to the source code and contribution channels. The author is consistently listed as Evan You, the creator of Vue.js.
The primary distinctions lie in the distribution metadata and release timing. Version 2.7.5 was released on July 13, 2022, a few days after version 2.7.4, which came out on July 8, 2022. While both versions comprise 7 files, the unpacked size of version 2.7.5 is slightly larger at 592851 bytes compared to 592336 bytes for version 2.7.4. This suggests that version 2.7.5 likely includes minor bug fixes, performance improvements, or very small feature enhancements.
For developers utilizing vue-template-compiler, upgrading to version 2.7.5 is advisable to benefit from these potential refinements, even though the changes aren't drastic. The update promises the most current and potentially optimized version of the compiler for Vue 2.0 templates. Reviewing the changelog associated with the Vue.js project around the release date is recommended to gain specific insights into the implemented changes.
All the vulnerabilities related to the version 2.7.5 of the package
vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)
A vulnerability has been discovered in vue-template-compiler, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript code. Vue 2 has reached End-of-Life. This vulnerability has been patched in Vue 3.
