Who contributed to Vue.js on May 15, 2026?

1 developer shipped this update, including arpitjain099.

What were the notable Vue.js updates?

chore(ci): set explicit least-privilege workflow permissions.

@vuejs

Vue + the surrounding frontend ecosystem

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

CREATE-VUE TIGHTENS CI PERMISSIONS

By RepoJournal · Filed 06:01 UTC on May 15, 2026 · About Vue.js

1 person shipped this

arpitjain099 @arpitjain099 1 cited

Create-vue locked down GitHub Actions token scope to follow least-privilege defaults, reducing attack surface without changing build behavior.

Create-vue merged explicit permission controls into its main CI workflow [1], setting GITHUB_TOKEN to read-only access and eliminating unnecessary privilege creep. The change keeps all current CI functionality intact while making future permission decisions intentional and reviewable. This follows GitHub's security best practice of defaulting to the narrowest token scope needed for each job. It's the kind of quiet infrastructure hardening that prevents supply chain risk down the line.

Action items

→ Review your own GitHub Actions workflows for explicit permission blocks vuejs/create-vue [plan]

References

[1] chore(ci): set explicit least-privilege workflow permissions ↗ vuejs/create-vue

Quick answers

What shipped in Vue.js on May 15, 2026?: Create-vue locked down GitHub Actions token scope to follow least-privilege defaults, reducing attack surface without changing build behavior. In total, 1 commits and 1 pull requests landed.
Who contributed to Vue.js on May 15, 2026?: 1 developer shipped this update, including arpitjain099.
What were the notable Vue.js updates?: chore(ci): set explicit least-privilege workflow permissions.

ESLINT-PLUGIN-VUE SHIPS NATIVE EVENT SHADOWING RULE, DEVTOOLS 8.2.0 LANDS

Vue's linter just caught a footgun developers didn't know they had: shadowing native HTML events in component emits.

javascript 14 shipped 1-min read

@vuejs 1 day ago

VUE LANGUAGE TOOLS CUTS TYPECHECK TIME 2.7X WITH TYPESCRIPT NATIVE BRIDGE

Language-tools switched to a TypeScript-native bridge fork and cut build, lint, and test performance in half across the board.

javascript 4 shipped 1-min read

@vuejs 2 days ago

VUE 3.6 RC ARRIVES AS LANGUAGE TOOLS JUMPS TO TYPESCRIPT 7

Vue core pushes toward 3.6 stable while the tooling ecosystem upgrades its type foundation.

javascript 6 shipped 1-min read

@vuejs 3 days ago

CREATE-VUE 3.23.0 SHIPS WITH TYPESCRIPT ENABLED BY DEFAULT

Vue's scaffolding tool flipped the switch on TypeScript adoption, making strict typing the path of least resistance for new projects.

javascript 5 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.