RepoJournal
Vue.js @vuejs
152 wires and counting

$ follow Vue.js

Keep up with Vue.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-14
stories 10
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

SUPPLY CHAIN DEFENSE HARDENS ACROSS VUEJS CORE AND TEST-UTILS

By RepoJournal · Filed · About Vue.js · Composed from the cited sources · methodology

renovate[bot] arpitjain099 skirtles-code
3 people shipped this
renovate[bot] @renovate[bot] 4 cited arpitjain099 @arpitjain099 1 cited skirtles-code @skirtles-code 1 cited

Vue's core team is locking down dependency updates with new release-age gates while hardening CI permissions to block token creep.

Two security-minded infrastructure moves landed overnight that raise the bar for supply chain safety. Vue core merged explicit least-privilege permissions [1] on its CI workflows, capping the GitHub token to read-only `contents` scope to prevent accidental over-scoping as the pipeline evolves. In parallel, the same team added `minimumReleaseAge: 1440` settings [2], which delays npm dependency updates by 24 hours—enough time to catch compromised packages before they're installed, a pattern that aligns Vue with pnpm 11's security defaults. Over in test-utils, the dependency refresh train rolled through with vue-router 5.0.7 [3], @types/node bumps [4], and tooling updates [5] [6]—all low-risk patches that merit merging at standard velocity. The guardrails matter more than the patches here: you're looking at a core team that's closing gaps before they become incidents.

$ ls vuejs/reviews/ # the step-back reads

the week in review eslint-plugin-vue migrates 26 rules to TypeScript the month in review create-vue 3.24.0 adds tsgo option, tighter templates
Full archive → Weekly reviews →

Quick answers

What shipped in Vue.js on May 14, 2026?
Vue's core team is locking down dependency updates with new release-age gates while hardening CI permissions to block token creep. In total, 3 commits and 7 pull requests landed.
Who contributed to Vue.js on May 14, 2026?
3 developers shipped this update, including arpitjain099, skirtles-code, and renovate[bot].
What were the notable Vue.js updates?
chore(ci): set explicit least-privilege workflow permissions, chore: add `minimumReleaseAge` settings, and chore(deps): update dependency vue-router to v5.0.7.
♥

$ log @vuejs --recent

language-tools trims its HTML data workflow 1 shipped Language-tools moves to trusted publishing, fixes hover and nav regressions 9 shipped language-tools drops a @ts-ignore for inline handler $event 7 shipped Volar smooths strict JS diagnostics, router fixes native hash scroll 13 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training GSM8K scoring parses answers as exact decimals AI Red Teaming PyRIT closes a judge-spoofing hole, promptfoo accepts Langfuse v6

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.