Who contributed to Vue.js on May 29, 2026?

2 developers shipped this update, including arpitjain099 and KazariEX.

What were the notable Vue.js updates?

fix(ci): read PR title from env in `auto-version` workflow to prevent injection (#6074), fix(ci): read PR title from env in `auto-version` workflow to prevent injection, and fix(vscode): preserve TS auto imports behavior in Vue files (#6072).

@vuejs

Vue + the surrounding frontend ecosystem

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

LANGUAGE TOOLS PATCHES SHELL INJECTION HOLE IN CI WORKFLOW

By RepoJournal · Filed 06:01 UTC on May 29, 2026 · About Vue.js

2 people shipped this

arpitjain099 @arpitjain099 1 cited

KazariEX @KazariEX 1 cited

A supply chain vulnerability in the auto-version GitHub Action could let malicious PR titles execute arbitrary commands during version bumps.

The vulnerability [1] lived in the `auto-version.yml` workflow, which pulled the PR title directly into a shell variable without sanitization. A PR title like `v3.0.0"; id; "` would execute as shell code despite existing regex checks, because GitHub Actions expands template variables before bash runs. The fix [2] now reads the PR title from environment variables instead, which bash treats as data not commands. This is the kind of supply chain risk that compounds quietly across thousands of repos using shared Actions. Update your local copy immediately if you fork language-tools.

Meanwhile, the VSCode extension got a fix [3] that restores TypeScript auto-imports in Vue files [4], closing a gap where IDE behavior diverged from standard TS. Vapor's compiler picked up two hydration fixes [5] [6] synced from core, addressing cursor tracking for nested insertions and useId evaluation order. Vue core shipped beta.13 [7] on the minor branch, so watch the changelog for what's coming next.

Action items

→ Review and merge the auto-version workflow fix [ref:1] immediately if you maintain any shared Actions vuejs/language-tools [immediate]
→ Update language-tools to pick up the VSCode extension fix for TS auto-imports vuejs/language-tools [plan]
→ Monitor v3.6.0-beta.13 changelog for breaking changes before upgrading vuejs/core [monitor]

References

[1] fix(ci): read PR title from env in `auto-version` workflow to prevent injection (#6074) vuejs/language-tools
[2] fix(ci): read PR title from env in `auto-version` workflow to prevent injection ↗ vuejs/language-tools
[3] fix(vscode): preserve TS auto imports behavior in Vue files (#6072) vuejs/language-tools
[4] fix(vscode): preserve TS auto imports behavior in Vue files ↗ vuejs/language-tools
[5] fix(compiler/vapor): preserve hydration cursor for nested insertions vuejs/vue-jsx-vapor
[6] fix(compiler/vapor): preserve useId evaluation order before dynamic vuejs/vue-jsx-vapor
[7] v3.6.0-beta.13 ↗ vuejs/core

Quick answers

What shipped in Vue.js on May 29, 2026?: A supply chain vulnerability in the auto-version GitHub Action could let malicious PR titles execute arbitrary commands during version bumps. In total, 4 commits, 2 pull requests, and 1 releases landed.
Who contributed to Vue.js on May 29, 2026?: 2 developers shipped this update, including arpitjain099 and KazariEX.
What were the notable Vue.js updates?: fix(ci): read PR title from env in `auto-version` workflow to prevent injection (#6074), fix(ci): read PR title from env in `auto-version` workflow to prevent injection, and fix(vscode): preserve TS auto imports behavior in Vue files (#6072).

ESLINT-PLUGIN-VUE SHIPS NATIVE EVENT SHADOWING RULE, DEVTOOLS 8.2.0 LANDS

Vue's linter just caught a footgun developers didn't know they had: shadowing native HTML events in component emits.

javascript 14 shipped 1-min read

@vuejs 1 day ago

VUE LANGUAGE TOOLS CUTS TYPECHECK TIME 2.7X WITH TYPESCRIPT NATIVE BRIDGE

Language-tools switched to a TypeScript-native bridge fork and cut build, lint, and test performance in half across the board.

javascript 4 shipped 1-min read

@vuejs 2 days ago

VUE 3.6 RC ARRIVES AS LANGUAGE TOOLS JUMPS TO TYPESCRIPT 7

Vue core pushes toward 3.6 stable while the tooling ecosystem upgrades its type foundation.

javascript 6 shipped 1-min read

@vuejs 3 days ago

CREATE-VUE 3.23.0 SHIPS WITH TYPESCRIPT ENABLED BY DEFAULT

Vue's scaffolding tool flipped the switch on TypeScript adoption, making strict typing the path of least resistance for new projects.

javascript 5 shipped 1-min read

Elsewhere on the wire

AI Agents about 10 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 10 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.