RepoJournal
Vue.js

@vuejs

Vue + the surrounding frontend ecosystem

Keep up with Vue.js in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Sun 14 jun
  2. Mon 15 jun
  3. Tue 16 jun
  4. Wed 17 jun
  5. Thu 18 jun
  6. Fri 19 jun
  7. Sat 27 jun
  8. Sun 28 jun
  9. Mon 29 jun
  10. Tue 30 jun
  11. Wed 1 jul
  12. Sat 4 jul
  13. Sun 5 jul
  14. Mon 6 jul
  15. Tue 7 jul
  16. Wed 8 jul
  17. Thu 9 jul
  18. Mon 13 jul
  19. Tue 14 jul
  20. Wed 15 jul
  21. Thu 16 jul
  22. Fri 17 jul
  23. Sat 18 jul
  24. Sun 19 jul
  25. Mon 20 jul
  26. Tue 21 jul
  27. Wed 22 jul
  28. Thu 23 jul
  29. Fri 24 jul
  30. Today 25 jul
Topics: JavaScript Full archive →

The Wire · Showcase

SUPPLY CHAIN DEFENSE HARDENS ACROSS VUEJS CORE AND TEST-UTILS

By RepoJournal · Filed · About Vue.js

renovate[bot] arpitjain099 skirtles-code
3 people shipped this
renovate[bot] @renovate[bot] 4 cited arpitjain099 @arpitjain099 1 cited skirtles-code @skirtles-code 1 cited

Vue's core team is locking down dependency updates with new release-age gates while hardening CI permissions to block token creep.

Two security-minded infrastructure moves landed overnight that raise the bar for supply chain safety. Vue core merged explicit least-privilege permissions [1] on its CI workflows, capping the GitHub token to read-only `contents` scope to prevent accidental over-scoping as the pipeline evolves. In parallel, the same team added `minimumReleaseAge: 1440` settings [2], which delays npm dependency updates by 24 hours—enough time to catch compromised packages before they're installed, a pattern that aligns Vue with pnpm 11's security defaults. Over in test-utils, the dependency refresh train rolled through with vue-router 5.0.7 [3], @types/node bumps [4], and tooling updates [5] [6]—all low-risk patches that merit merging at standard velocity. The guardrails matter more than the patches here: you're looking at a core team that's closing gaps before they become incidents.

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] chore(ci): set explicit least-privilege workflow permissions ↗ vuejs/core
  2. [2] chore: add `minimumReleaseAge` settings ↗ vuejs/core
  3. [3] chore(deps): update dependency vue-router to v5.0.7 ↗ vuejs/test-utils
  4. [4] chore(deps): update all non-major dependencies ↗ vuejs/test-utils
  5. [5] chore(deps): update dependency vue-tsc to v3.2.9 ↗ vuejs/test-utils
  6. [6] chore(deps): update dependency pkg-pr-new to v0.0.72 ↗ vuejs/test-utils

Quick answers

What shipped in Vue.js on May 14, 2026?
Vue's core team is locking down dependency updates with new release-age gates while hardening CI permissions to block token creep. In total, 3 commits and 7 pull requests landed.
Who contributed to Vue.js on May 14, 2026?
3 developers shipped this update, including arpitjain099, skirtles-code, and renovate[bot].
What were the notable Vue.js updates?
chore(ci): set explicit least-privilege workflow permissions, chore: add `minimumReleaseAge` settings, and chore(deps): update dependency vue-router to v5.0.7.

More from @vuejs

Vue.js @vuejs

ESLINT-PLUGIN-VUE SHIPS NATIVE EVENT SHADOWING RULE, DEVTOOLS 8.2.0 LANDS

Vue's linter just caught a footgun developers didn't know they had: shadowing native HTML events in component emits.

JoCa96 sjh9714 ylc395 github-actions[bot] +3
javascript 14 shipped 1-min read
Vue.js @vuejs

VUE LANGUAGE TOOLS CUTS TYPECHECK TIME 2.7X WITH TYPESCRIPT NATIVE BRIDGE

Language-tools switched to a TypeScript-native bridge fork and cut build, lint, and test performance in half across the board.

johnsoncodehk Ray
javascript 4 shipped 1-min read
Vue.js @vuejs

VUE 3.6 RC ARRIVES AS LANGUAGE TOOLS JUMPS TO TYPESCRIPT 7

Vue core pushes toward 3.6 stable while the tooling ecosystem upgrades its type foundation.

github-actions[bot] KazariEX Henrikh Kantuni
javascript 6 shipped 1-min read
Vue.js @vuejs

CREATE-VUE 3.23.0 SHIPS WITH TYPESCRIPT ENABLED BY DEFAULT

Vue's scaffolding tool flipped the switch on TypeScript adoption, making strict typing the path of least resistance for new projects.

KazariAI edison1105 haoqunjiang
javascript 5 shipped 1-min read

Daily updates, in your inbox

Follow Vue.js

Keep up with Vue.js in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

github-actions[bot] hntrl dependabot ak684 +6
ai-agents 28 shipped 1-min read
Local LLMs Local LLMs

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.

dhiltgen ParthSareen Xuan-Son Nguyen Johannes Gäßler +11
llms 210 shipped 2-min read
CachyOS @CachyOS

HYPRLAND V0.56 FIXES LAND, PACKAGE ECOSYSTEM ROLLS FORWARD

Hyprland configuration updated for v0.56 compatibility across multiple desks, while the AUR-derived ecosystem locked in four automated package bumps.

cantosun99 Jinra Aarrayy Valeri +7
infra 85 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

LIVEVIEW ASYNC CLEANUP FIX SHIPS ALONGSIDE RANGE OPTIMIZATIONS

Phoenix LiveView closes a critical async task test failure while Elixir cuts unnecessary abs calls from Range operations.

Barna Kovacs Alexander Gubarev SteffenDE José Valim +1
elixir 19 shipped 1-min read
Want every project, not just this one?