Vue-tsc version 2.0.16 represents a subtle but important update over the previous stable version, 2.0.15, primarily focusing on dependency management. Both versions serve the same core purpose: providing a command-line tool that wraps the TypeScript compiler (tsc) specifically tailored for Vue.js projects, enabling type checking and compilation of Vue Single-File Components (SFCs) using the Volar language tooling. Installation remains consistent with npm i vue-tsc -D.
The key difference lies in the @volar/typescript dependency. Version 2.0.15 relied on a pre-release, alpha version (2.2.0-alpha.12) of @volar/typescript, while 2.0.16 transitions to a more stable, tilde-specified version (~2.2.0). This tilde range in 2.0.16 indicates that it will install the latest patch version of 2.2.0, providing bug fixes and minor improvements without breaking changes. Additionally, @vue/language-core moves from 2.0.15 to 2.0.16. Developers should take note of this shift, as it implies a refinement of the core language services powering Vue's type checking capabilities.
While file sizes and unpacked sizes are similar between the two versions, the updated dependency is a key concern for Vue developers as it likely addresses stability issues and delivers an improved authoring experience within Vue projects. It will be essential to update to the latest version for users experiencing problems or those seeking most current refinements.
In summary, version 2.0.16 is a recommended upgrade due to its enhanced dependency management, which promises a more stable and reliable environment for Vue.js development with TypeScript.
All the vulnerabilities related to the version 2.0.16 of the package
vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)
A vulnerability has been discovered in vue-template-compiler, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript code. Vue 2 has reached End-of-Life. This vulnerability has been patched in Vue 3.
