Who contributed to Vue.js on May 11, 2026?

1 developer shipped this update, including dependabot[bot].

What were the notable Vue.js updates?

chore(deps): bump axios from 1.15.0 to 1.15.2.

@vuejs

Vue + the surrounding frontend ecosystem

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

AXIOS SHIPS SECURITY HARDENING FOR NODE HTTP ADAPTER

By RepoJournal · Filed 06:00 UTC on May 11, 2026 · About Vue.js

1 person shipped this

dependabot[bot] @dependabot[bot] 1 cited

Axios 1.15.2 patches prototype pollution vulnerabilities and closes an SSRF vector that could let attackers escape sandbox constraints via Unix domain sockets.

The update [1] delivers critical supply-chain hardening across the board, but the two security wins matter most: prototype-pollution defenses in the Node HTTP adapter close a class of attack that's proven dangerous in production, and the new opt-in `allowedSocketPaths` allowlist blocks SSRF exploitation through Unix domain sockets—a blind spot in most HTTP client configurations. The release also fixes a keep-alive socket memory leak that was quietly eating memory in long-running processes. This is the upgrade you've been waiting for if you're shipping axios in any Node environment touching untrusted input.

Action items

→ Upgrade axios to 1.15.2 in your Node dependencies before next deploy vuejs/v2.cn.vuejs.org [immediate]
→ Audit axios usage for Unix domain socket endpoints and evaluate `allowedSocketPaths` configuration vuejs/v2.cn.vuejs.org [plan]

References

[1] chore(deps): bump axios from 1.15.0 to 1.15.2 ↗ vuejs/v2.cn.vuejs.org

Quick answers

What shipped in Vue.js on May 11, 2026?: Axios 1.15.2 patches prototype pollution vulnerabilities and closes an SSRF vector that could let attackers escape sandbox constraints via Unix domain sockets. In total, 1 pull requests landed.
Who contributed to Vue.js on May 11, 2026?: 1 developer shipped this update, including dependabot[bot].
What were the notable Vue.js updates?: chore(deps): bump axios from 1.15.0 to 1.15.2.

ESLINT-PLUGIN-VUE SHIPS NATIVE EVENT SHADOWING RULE, DEVTOOLS 8.2.0 LANDS

Vue's linter just caught a footgun developers didn't know they had: shadowing native HTML events in component emits.

javascript 14 shipped 1-min read

@vuejs 1 day ago

VUE LANGUAGE TOOLS CUTS TYPECHECK TIME 2.7X WITH TYPESCRIPT NATIVE BRIDGE

Language-tools switched to a TypeScript-native bridge fork and cut build, lint, and test performance in half across the board.

javascript 4 shipped 1-min read

@vuejs 2 days ago

VUE 3.6 RC ARRIVES AS LANGUAGE TOOLS JUMPS TO TYPESCRIPT 7

Vue core pushes toward 3.6 stable while the tooling ecosystem upgrades its type foundation.

javascript 6 shipped 1-min read

@vuejs 3 days ago

CREATE-VUE 3.23.0 SHIPS WITH TYPESCRIPT ENABLED BY DEFAULT

Vue's scaffolding tool flipped the switch on TypeScript adoption, making strict typing the path of least resistance for new projects.

javascript 5 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.