The Wire · Showcase
VUE HARDENS CI PIPELINE, ROUTER TIGHTENS TYPE SAFETY
By RepoJournal · Filed · About Vue.js
Vue's core team is locking down GitHub Actions with commit hash pinning while Router graduates stricter type definitions for route parameters.
The Vue core team merged critical CI hardening work overnight, pinning GitHub Actions to full commit SHAs instead of mutable tags [1]. This closes a real security vector: tag-based actions can be silently rewritten by third parties, potentially injecting malicious code into your build pipeline. The team also unlocked ecosystem-ci permissions to write pull requests [2], enabling automated compatibility testing across the entire Vue ecosystem. Over in Router, the team is tightening the type system: strict typing for definePage param defaults [5] now prevents silent type mismatches that would have leaked into production. Three additional fixes landed targeting param parsing reliability: filtering invalid query params without breaking route matching [6], avoiding unused param parser imports [7], and ordering param parser types deterministically [8]. Create-vue picked up a minor Vite plugin bump [3], and docs reverted a VueConf 2026 banner that shipped premature [4].
Action items
- → Review your GitHub Actions workflows and pin all third-party actions to commit SHAs vuejs/core [plan]
- → Test Router route parameter handling with the new strict types if you use definePageRoute vuejs/router [monitor]
References
- [1] ci: pin action versions ↗ vuejs/core
- [2] ci: allow ecosystem-ci trigger to write pull requests ↗ vuejs/core
- [3] chore(deps): update dependency @vitejs/plugin-vue to ^6.0.7 ↗ vuejs/create-vue
- [4] Revert "added vueconf 2026 banner (#3372)" vuejs/docs
- [5] feat: strict type for definePage param default vuejs/router
- [6] fix: filter invalid query params without failing to match vuejs/router
- [7] fix: avoid importing unused param parsers vuejs/router
- [8] fix: deterministic param parser types order vuejs/router
FAQ
- What changed in Vue.js on May 21, 2026?
- Vue's core team is locking down GitHub Actions with commit hash pinning while Router graduates stricter type definitions for route parameters.
- What should Vue.js teams do about it?
- Review your GitHub Actions workflows and pin all third-party actions to commit SHAs • Test Router route parameter handling with the new strict types if you use definePageRoute
- Which Vue.js repositories shipped on May 21, 2026?
- vuejs/core, vuejs/create-vue, vuejs/docs, vuejs/router