Who contributed to Vue.js on May 21, 2026?

3 developers shipped this update, including rzzf, edison1105, and renovate[bot].

What were the notable Vue.js updates?

ci: pin action versions, ci: allow ecosystem-ci trigger to write pull requests, and chore(deps): update dependency @vitejs/plugin-vue to ^6.0.7.

@vuejs

Vue + the surrounding frontend ecosystem

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

VUE HARDENS CI PIPELINE, ROUTER TIGHTENS TYPE SAFETY

By RepoJournal · Filed 06:01 UTC on May 21, 2026 · About Vue.js

3 people shipped this

rzzf @rzzf 1 cited

edison1105 @edison1105 1 cited

renovate[bot] @renovate[bot] 1 cited

Vue's core team is locking down GitHub Actions with commit hash pinning while Router graduates stricter type definitions for route parameters.

The Vue core team merged critical CI hardening work overnight, pinning GitHub Actions to full commit SHAs instead of mutable tags [1]. This closes a real security vector: tag-based actions can be silently rewritten by third parties, potentially injecting malicious code into your build pipeline. The team also unlocked ecosystem-ci permissions to write pull requests [2], enabling automated compatibility testing across the entire Vue ecosystem. Over in Router, the team is tightening the type system: strict typing for definePage param defaults [5] now prevents silent type mismatches that would have leaked into production. Three additional fixes landed targeting param parsing reliability: filtering invalid query params without breaking route matching [6], avoiding unused param parser imports [7], and ordering param parser types deterministically [8]. Create-vue picked up a minor Vite plugin bump [3], and docs reverted a VueConf 2026 banner that shipped premature [4].

Action items

→ Review your GitHub Actions workflows and pin all third-party actions to commit SHAs vuejs/core [plan]
→ Test Router route parameter handling with the new strict types if you use definePageRoute vuejs/router [monitor]

References

[1] ci: pin action versions ↗ vuejs/core
[2] ci: allow ecosystem-ci trigger to write pull requests ↗ vuejs/core
[3] chore(deps): update dependency @vitejs/plugin-vue to ^6.0.7 ↗ vuejs/create-vue
[4] Revert "added vueconf 2026 banner (#3372)" vuejs/docs
[5] feat: strict type for definePage param default vuejs/router
[6] fix: filter invalid query params without failing to match vuejs/router
[7] fix: avoid importing unused param parsers vuejs/router
[8] fix: deterministic param parser types order vuejs/router

Quick answers

What shipped in Vue.js on May 21, 2026?: Vue's core team is locking down GitHub Actions with commit hash pinning while Router graduates stricter type definitions for route parameters. In total, 9 commits and 3 pull requests landed.
Who contributed to Vue.js on May 21, 2026?: 3 developers shipped this update, including rzzf, edison1105, and renovate[bot].
What were the notable Vue.js updates?: ci: pin action versions, ci: allow ecosystem-ci trigger to write pull requests, and chore(deps): update dependency @vitejs/plugin-vue to ^6.0.7.

ESLINT-PLUGIN-VUE SHIPS NATIVE EVENT SHADOWING RULE, DEVTOOLS 8.2.0 LANDS

Vue's linter just caught a footgun developers didn't know they had: shadowing native HTML events in component emits.

javascript 14 shipped 1-min read

@vuejs 1 day ago

VUE LANGUAGE TOOLS CUTS TYPECHECK TIME 2.7X WITH TYPESCRIPT NATIVE BRIDGE

Language-tools switched to a TypeScript-native bridge fork and cut build, lint, and test performance in half across the board.

javascript 4 shipped 1-min read

@vuejs 2 days ago

VUE 3.6 RC ARRIVES AS LANGUAGE TOOLS JUMPS TO TYPESCRIPT 7

Vue core pushes toward 3.6 stable while the tooling ecosystem upgrades its type foundation.

javascript 6 shipped 1-min read

@vuejs 3 days ago

CREATE-VUE 3.23.0 SHIPS WITH TYPESCRIPT ENABLED BY DEFAULT

Vue's scaffolding tool flipped the switch on TypeScript adoption, making strict typing the path of least resistance for new projects.

javascript 5 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.