Skip to content
This repository was archived by the owner on Oct 10, 2026. It is now read-only.

chore(deps): update all non-major dependencies - #298

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Closed

chore(deps): update all non-major dependencies#298
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Oct 10, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
chokidar ^3.5.2 → ^3.6.0 age confidence
glob ^7.1.7 → ^7.2.3 age confidence
globby ^11.0.4 → ^11.1.0 age confidence
scule ^0.2.1 → ^0.3.2 age confidence
siroc 0.15.0 → 0.16.0 age confidence
vue-template-compiler (source) ^2.6.14 → ^2.7.16 age confidence

Release Notes

paulmillr/chokidar (chokidar)

v3.6.0

Compare Source

What's Changed
New Contributors

Full Changelog: paulmillr/chokidar@3.5.3...3.6.0

v3.5.3

Compare Source

What's Changed

New Contributors

Full Changelog: paulmillr/chokidar@3.5.2...3.5.3

isaacs/node-glob (glob)

v7.2.3

Compare Source

v7.2.2

Compare Source

v7.2.0

Compare Source

sindresorhus/globby (globby)

v11.1.0

Compare Source

  • Update dependencies to fix some npm audit notices
unjs/scule (scule)

v0.3.2

Compare Source

Features
0.3.2 (2022-07-27)
Bug Fixes
  • ignore case changes for numbers (9927800)
0.3.1 (2022-07-27)
Bug Fixes

v0.3.1

Compare Source

Features
0.3.2 (2022-07-27)
Bug Fixes
  • ignore case changes for numbers (9927800)
0.3.1 (2022-07-27)
Bug Fixes

v0.3.0

Compare Source

Features
0.3.2 (2022-07-27)
Bug Fixes
  • ignore case changes for numbers (9927800)
0.3.1 (2022-07-27)
Bug Fixes
unjs/siroc (siroc)

v0.16.0

Compare Source

Bug Fixes
vuejs/vue (vue-template-compiler)

v2.7.16

Compare Source

Bug Fixes
  • lifecycle: ensure component effect scopes are disconnected (56ce7f8), closes #​13134

v2.7.15

Compare Source

Bug Fixes

v2.7.14

Compare Source

Bug Fixes

v2.7.13

Compare Source

Bug Fixes

v2.7.12

Compare Source

Reverts

v2.7.11

Compare Source

Bug Fixes
Performance Improvements
  • improve unsub perf for deps with massive amount of subs (8880b55), closes #​12696

v2.7.10

Compare Source

Bug Fixes

v2.7.9

Compare Source

Bug Fixes
Features

v2.7.8

Compare Source

Bug Fixes
Features
  • setup: support listeners on setup context + useListeners() helper (adf3ac8)

v2.7.7

Compare Source

Bug Fixes
  • codegen: script setup should not attempt to resolve native elements as component (e8d3a7d), closes #​12674
  • inject: fix edge case of provided with async-mutated getters (ea5d0f3), closes #​12667
  • setup: ensure setup context slots can be accessed immediately (67760f8), closes #​12672
  • types: vue.d.ts should use relative import to v3-component-public-instance (#​12668) (46ec648), closes #​12666
  • watch: fix queueing multiple post watchers (25ffdb6), closes #​12664

v2.7.6

Compare Source

Bug Fixes

v2.7.5

Compare Source

Bug Fixes
  • add missing export from vue.runtime.mjs (#​12648) (08fb4a2)
  • detect property add/deletion on reactive objects from setup when used in templates (a6e7498)
  • do not set currentInstance in beforeCreate (0825d30), closes #​12636
  • reactivity: fix watch behavior inconsistency + deep ref shallow check (98fb01c), closes #​12643
  • sfc: fix sfc name inference type check (04b4703), closes #​12637
  • types: support Vue interface augmentations in defineComponent (005e52d), closes #​12642
  • watch: fix deep watch for structures containing raw refs (1a2c3c2), closes #​12652

v2.7.4

Compare Source

Bug Fixes
  • build: fix mjs dual package hazard (012e10c), closes #​12626
  • compiler-sfc: use safer deindent default for compatibility with previous behavior (b70a258)
  • pass element creation helper to static render fns for functional components (dc8a68e), closes #​12625
  • ssr/reactivity: fix array setting error at created in ssr [#​12632] (#​12633) (ca7daef)
  • types: fix missing instance properties on defineComponent this (f8de4ca), closes #​12628
  • types: fix this.$slots type for defineComponent (d3add06)
  • types: fix type inference when using components option (1d5a411)
  • types: global component registration type compat w/ defineComponent (26ff4bc), closes #​12622
  • watch: fix watchers triggered in mounted hook (8904ca7), closes #​12624
Features

v2.7.3

Compare Source

Bug Fixes

v2.7.2

Compare Source

Bug Fixes
  • compiler-sfc: preserve old deindent behavior for pug (1294385), closes #​12611
Features

v2.7.1

Compare Source

Bug Fixes
  • lifecycle: ensure component effect scopes are disconnected (56ce7f8), closes #​13134

v2.7.0

Compare Source

Backported Features

In addition, the following APIs are also supported:

  • defineComponent() with improved type inference (compared to Vue.extend)

  • h(), useSlot(), useAttrs(), useCssModules()

  • set(), del() and nextTick() are also provided as named exports in ESM builds.

  • The emits option is also supported, but only for type-checking purposes (does not affect runtime behavior)

    2.7 also supports using ESNext syntax in template expressions. When using a build system, the compiled template render function will go through the same loaders / plugins configured for normal JavaScript. This means if you have configured Babel for .js files, it will also apply to the expressions in your SFC templates.

Notes on API exposure

  • In ESM builds, these APIs are provided as named exports (and named exports only):

    import Vue, { ref } from 'vue'

Vue.ref // undefined, use named export instead

  • In UMD and CJS builds, these APIs are exposed as properties on the global Vue object.

  • When bundling with CJS builds externalized, bundlers should be able to handle ESM interop when externalizing CJS builds.

Behavior Differences from Vue 3

The Composition API is backported using Vue 2's getter/setter-based reactivity system to ensure browser compatibility. This means there are some important behavior differences from Vue 3's proxy-based system:

  • All Vue 2 change detection caveats still apply.

  • reactive(), ref(), and shallowReactive() will directly convert original objects instead of creating proxies. This means:

    // true in 2.7, false in 3.x
reactive(foo) === foo

  • readonly() does create a separate object, but it won't track newly added properties and does not work on arrays.

  • Avoid using arrays as root values in reactive() because without property access the array's mutation won't be tracked (this will result in a warning).

  • Reactivity APIs ignore properties with symbol keys.

In addition, the following features are explicitly NOT ported:

  • ❌ createApp() (Vue 2 doesn't have isolated app scope)
  • ❌ Top-level await in <script setup> (Vue 2 does not support async component initialization)
  • ❌ TypeScript syntax in template expressions (incompatible w/ Vue 2 parser)
  • ❌ Reactivity transform (still experimental)
  • ❌ expose option is not supported for options components (but defineExpose() is supported in <script setup>).
TypeScript Changes

  • defineComponent provides improved type inference similar to that of Vue 3. Note the type of this inside defineComponent() is not interoperable with this from Vue.extend().

  • Similar to Vue 3, TSX support is now built-in. If your project previously had manual JSX type shims, make sure to remove them.

Upgrade Guide

Vue CLI / webpack

  1. Upgrade local @vue/cli-xxx dependencies the latest version in your major version range (if applicable):

    • ~4.5.18 for v4
    • ~5.0.6 for v5

  2. Upgrade vue to ^2.7.0. You can also remove vue-template-compiler from the dependencies - it is no longer needed in 2.7.

    Note: if you are using @vue/test-utils, you may need to keep it in the dependencies for now, but this requirement will also be lifted in a new release of test utils.

  3. Check your package manager lockfile to ensure the following dependencies meet the version requirements. They may be transitive dependencies not listed in package.json.

    • vue-loader: ^15.10.0
    • vue-demi: ^0.13.1

    If not, you will need to remove node_modules and the lockfile and perform a fresh install to ensure they are bumped to the latest version.

  4. If you were previously using @vue/composition-api, update imports from it to vue instead. Note that some APIs exported by the plugin, e.g. createApp, are not ported in 2.7.

  5. Update eslint-plugin-vue to latest version (9+) if you run into unused variable lint errors when using <script setup>.

  6. The SFC compiler for 2.7 now uses PostCSS 8 (upgraded from 7). PostCSS 8 should be backwards compatible with most plugins, but the upgrade may cause issues if you were previously using a custom PostCSS plugin that can only work with PostCSS 7. In such cases, you will need to upgrade the relevant plugins to their PostCSS 8 compatible versions.

Vite

2.7 support for Vite is provided via a new plugin: @​vitejs/plugin-vue2. This new plugin requires Vue 2.7 or above and supersedes the existing vite-plugin-vue2.

Note that the new plugin does not handle Vue-specific JSX / TSX transform, which is intentional. Vue 2 JSX / TSX transform should be handled in a separate, dedicated plugin, which will be provided soon.

Volar Compatibility

2.7 ships improved type definitions so it is no longer necessary to install @vue/runtime-dom just for Volar template type inference support. All you need now is the following config in tsconfig.json:

{
  // ...
  "vueCompilerOptions": {
    "target": 2.7
  }
}
Devtools Support

Vue Devtools 6.2.0 has added support for inspecting 2.7 Composition API state, but the extensions may still need a few days to go through review on respective publishing platforms.

Bug Fixes
  • sfc: only include legacy decorator parser plugin when new plugin is not used (326d24a)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@socket-security

socket-security Bot commented Oct 10, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedglob@​7.2.310010010050100
Updatedsiroc@​0.15.0 ⏵ 0.16.075 +110099 +180100
Addedscule@​0.3.21001009780100
Addedchokidar@​3.6.09910010081100
Addedvue-template-compiler@​2.7.16959910082100
Addedglobby@​11.1.010010010086100

View full report

@danielroe danielroe closed this Oct 10, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@danielroe