Vue-tsc, the command-line tool for type-checking Vue.js single-file components (SFCs) with TypeScript, has released version 2.0.3, a minor update from the previous stable version 2.0.2. Both versions share the same core function: enabling developers to leverage TypeScript's static analysis capabilities within their Vue projects for enhanced code quality and fewer runtime errors.
The key difference lies in the updated dependency on @vue/language-core. Version 2.0.3 utilizes @vue/language-core version 2.0.3, while 2.0.2 depends on version 2.0.2 of the same package. This suggests potential improvements or bug fixes within the core Vue language tooling that are now accessible through the updated vue-tsc release. Developers should be aware of the implication of this dependency update.
Importantly, both versions maintain identical dependencies on semver (^7.5.4) and @volar/typescript (~2.1.0), indicating stability in these areas. The development dependencies, including @types/node, remain consistent, and the peer dependency on typescript persists, requiring users to have a compatible version of TypeScript installed.
The dist metadata highlights that both versions have the same fileCount and unpackedSize, implying the update doesn't significantly alter the package's overall footprint. However, the release date differs, with version 2.0.3 released on March 3, 2024, following version 2.0.2 on March 2, 2024.
For developers, upgrading to vue-tsc 2.0.3 brings the benefit of potential bug fixes, performance improvements, or new features within the underlying @vue/language-core package. As type-checking is critical for building robust Vue applications, staying up-to-date with the latest minor versions is recommended.
All the vulnerabilities related to the version 2.0.3 of the package
vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)
A vulnerability has been discovered in vue-template-compiler, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript code. Vue 2 has reached End-of-Life. This vulnerability has been patched in Vue 3.
