RepoJournal
Vue.js @vuejs
117 wires and counting

$ follow Vue.js

Keep up with Vue.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-21
stories 12
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

VUE HARDENS CI PIPELINE, ROUTER TIGHTENS TYPE SAFETY

By RepoJournal · Filed · About Vue.js · Composed from the cited sources · methodology

rzzf edison1105 renovate[bot]
3 people shipped this
rzzf @rzzf 1 cited edison1105 @edison1105 1 cited renovate[bot] @renovate[bot] 1 cited

Vue's core team is locking down GitHub Actions with commit hash pinning while Router graduates stricter type definitions for route parameters.

The Vue core team merged critical CI hardening work overnight, pinning GitHub Actions to full commit SHAs instead of mutable tags [1]. This closes a real security vector: tag-based actions can be silently rewritten by third parties, potentially injecting malicious code into your build pipeline. The team also unlocked ecosystem-ci permissions to write pull requests [2], enabling automated compatibility testing across the entire Vue ecosystem. Over in Router, the team is tightening the type system: strict typing for definePage param defaults [5] now prevents silent type mismatches that would have leaked into production. Three additional fixes landed targeting param parsing reliability: filtering invalid query params without breaking route matching [6], avoiding unused param parser imports [7], and ordering param parser types deterministically [8]. Create-vue picked up a minor Vite plugin bump [3], and docs reverted a VueConf 2026 banner that shipped premature [4].

$ ls vuejs/reviews/ # the step-back reads

the week in review Vue core patches six suspense hydration bugs the month in review Vue's monthly grind: tooling stability and VitePress rewrites mark August
Topics: JavaScript Full archive → Weekly reviews →

Quick answers

What shipped in Vue.js on May 21, 2026?
Vue's core team is locking down GitHub Actions with commit hash pinning while Router graduates stricter type definitions for route parameters. In total, 9 commits and 3 pull requests landed.
Who contributed to Vue.js on May 21, 2026?
3 developers shipped this update, including rzzf, edison1105, and renovate[bot].
What were the notable Vue.js updates?
ci: pin action versions, ci: allow ecosystem-ci trigger to write pull requests, and chore(deps): update dependency @vitejs/plugin-vue to ^6.0.7.
♥

$ log @vuejs --recent

babel-plugin-jsx marks its side effects, pins pnpm 2 shipped CSS var parsing fixed in compiler-sfc, namespace prefixes kept in test-utils attributes() 13 shipped looseEqual handles cycles, v-once children unmount correctly 24 shipped create-vue 3.24.0 adds tsgo option, tighter Oxlint and Vitest templates 11 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.