Vue-tsc version 2.0.14 represents a subtle but important update over the previous stable version 2.0.13. Both versions serve the same core purpose: providing a command-line interface for the Vue language tooling, facilitating type checking and other language features within Vue projects. The core difference lies in the updated dependencies. Version 2.0.14 upgrades @volar/typescript from version 2.2.0-alpha.8 to 2.2.0-alpha.10, and @vue/language-core from 2.0.13 to 2.0.14.
For developers, this signifies potential improvements and bug fixes within the core language tooling, specifically potentially including updates related to TypeScript integration and Vue's template type checking and language service capabilities. While the changes might not be immediately apparent in daily usage, these dependency upgrades contribute to a more robust and reliable development experience.
The "Install: npm i vue-tsc -D instruction reminds developers that vue-tsc is intended as a development dependency, crucial for build-time checks but not required in the production environment. The repository information points to the vuejs/language-tools GitHub repository, which is the single source of truth and enables developers to investigate more thoroughly any changes, report issues, or contribute directly to the project. Note that the unpacked size decreased between the two versions from 5440 to 4937, maybe showcasing some refactoring, a lighter packaging process, or removal of some unused parts of the code. The release date difference indicates around a 10-day gap between versions. Overall, while seemingly incremental, the upgrade to 2.0.14 will result in an improved usage of Vue with Typescript.
All the vulnerabilities related to the version 2.0.14 of the package
vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)
A vulnerability has been discovered in vue-template-compiler, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript code. Vue 2 has reached End-of-Life. This vulnerability has been patched in Vue 3.
