build(deps): bump @vue/server-renderer and vue by dependabot[bot] · Pull Request #232 · NetLogo-Mobile/plweb2

dependabot · 2026-10-17T22:55:57Z

Bumps @vue/server-renderer to 3.5.44 and updates ancestor dependency vue. These dependencies need to be updated together.

Updates @vue/server-renderer from 3.5.24 to 3.5.44

Release notes

Sourced from @vue/server-renderer's releases.

v3.5.44

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.43

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.42

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.41

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.40

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.39

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.38

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.37

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.35

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.34

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.33

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.32

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.31

For stable releases, please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from @vue/server-renderer's changelog.

3.5.44 (2026-10-13)

Bug Fixes

compat: expose _setupProxy for Vue 2.7 compiled script setup (fix #11164) (#15618) (f08059d)

compiler-core: parenthesise v-for key in v-memo cache guard (#15724) (d084b90), closes #15723

compiler-dom: correctly stringify 0 and false in v-html (#15571) (9f3b437)

compiler-dom: inject transition persisted for v-show in production (#15783) (89cb272)

compiler-sfc: error when defineModel prop options reference a destructured prop (#15604) (38012a5), closes #15602

custom-element: skip mounting an async custom element removed while its component loads (#15777) (0f8e7b4), closes #15775

hydration: observe children of a display: contents root in hydrateOnVisible (#15773) (7f688e8)

KeepAlive: unmount pruned current component when its vnode was cloned on mount (#15711) (92798ac), closes #15710

reactivity: avoid mutating native array iterators (#15703) (7f9d45d), closes #15643

reactivity: do not track deps in watcher callbacks run inside another effect (#15782) (db00fe9), closes #5009

reactivity: once watcher should stop when its callback throws (#15755) (ae4bd94)

reactivity: preserve shallow collection semantics (#15793) (b600466), closes #15792

runtime-core: detect new prop keys when comparing full props (#15634) (702fa61), closes #15632

runtime-core: keep async placeholder for block patching and pending component updates (#15554) (05ec25f), closes #15551

runtime-core: only flush jobs queued by the root render itself (#15757) (0bea14b), closes #6728

runtime-core: render nothing for an invalid v-for range in production (#15742) (ad19e7d)

runtime-dom: preserve v-show display for unchanged style strings (#15794) (c0a6d3f)

runtime-dom: treat playsinline as a boolean attribute (#15627) (a084e44)

server-renderer: propagate async setup errors (#15857) (6930374), closes #15716

ssr: honor falsy vnode content overrides (#15769) (c11c5c8)

suspense: mount resolved async component with its own namespace (#15640) (2a086a2), closes #15639

suspense: skip rendering async components unmounted while pending (4ab865a)

teleport: move targetStart and keep children before targetAnchor (#15818) (d3c6e02), closes #15817

transition-group: measure nested groups against their moving outer item (#15848) (1936c87), closes #5385 #1531

transition: handle comment-wrapped component roots (#15853) (ff35014), closes #6080 #5500

3.5.43 (2026-09-17)

Bug Fixes

compiler-sfc: ignore comment delimiters inside strings and url() when parsing css vars (#15548) (2fde323)

compiler-sfc: prepend semicolon for await in switch case (#15498) (9a1df69), closes #15495

compiler-sfc: restore await scope when leaving nested blocks (5409708), closes #15465

compiler-sfc: reuse parsed parent configs across tsconfig walks (fix #15478) (#15480) (d6febaa)

hydration: run leave hooks for hydration placeholders (#15431) (5dda192)

reactivity: preserve readonly wrappers in array copy methods (#15469) (599f35b)

runtime-core: unmount v-once children after parent rerenders (#15435) (d720338)

shared: handle circular references in looseEqual (#15499) (718f782), closes #15496

shared: preserve comment-like text in style values (#15471) (b9456cb)

suspense: don't drop nested suspense patches during hydration (#15429) (76d42dc)

suspense: keep the boundary pending while its branch is patched (#15411) (bfcfe9e), closes #7506

suspense: patch a hydrating boundary's pending branch in place (#15432) (2cde6f7)

suspense: unmount the DOM an interrupted async component claimed (#15430) (fb9b45c)

types: keep optional props when a runtime prop uses a generic PropType (#15523) (243aabc), closes #9546

3.5.42 (2026-08-27)

... (truncated)

Commits

bf5f0dd release: v3.5.44
6930374 fix(server-renderer): propagate async setup errors (#15857)
c11c5c8 fix(ssr): honor falsy vnode content overrides (#15769)
ad19e7d fix(runtime-core): render nothing for an invalid v-for range in production (#...
a084e44 fix(runtime-dom): treat playsinline as a boolean attribute (#15627)
5be58b4 release: v3.5.43
d63616c release: v3.5.42
a2b40db fix(server-renderer): reject CR in attribute names (#15266)
d2c458b release: v3.5.41
4e467d7 fix(ssr): normalize hidden states during hydration (#13125)
Additional commits viewable in compare view

Updates vue from 3.5.24 to 3.5.44

Release notes

Sourced from vue's releases.

v3.5.44

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.43

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.42

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.41

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.40

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.39

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.38

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.37

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.35

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.34

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.33

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.32

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.31

For stable releases, please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vue's changelog.

3.5.44 (2026-10-13)

Bug Fixes

compat: expose _setupProxy for Vue 2.7 compiled script setup (fix #11164) (#15618) (f08059d)

compiler-core: parenthesise v-for key in v-memo cache guard (#15724) (d084b90), closes #15723

compiler-dom: correctly stringify 0 and false in v-html (#15571) (9f3b437)

compiler-dom: inject transition persisted for v-show in production (#15783) (89cb272)

compiler-sfc: error when defineModel prop options reference a destructured prop (#15604) (38012a5), closes #15602

custom-element: skip mounting an async custom element removed while its component loads (#15777) (0f8e7b4), closes #15775

hydration: observe children of a display: contents root in hydrateOnVisible (#15773) (7f688e8)

KeepAlive: unmount pruned current component when its vnode was cloned on mount (#15711) (92798ac), closes #15710

reactivity: avoid mutating native array iterators (#15703) (7f9d45d), closes #15643

reactivity: do not track deps in watcher callbacks run inside another effect (#15782) (db00fe9), closes #5009

reactivity: once watcher should stop when its callback throws (#15755) (ae4bd94)

reactivity: preserve shallow collection semantics (#15793) (b600466), closes #15792

runtime-core: detect new prop keys when comparing full props (#15634) (702fa61), closes #15632

runtime-core: keep async placeholder for block patching and pending component updates (#15554) (05ec25f), closes #15551

runtime-core: only flush jobs queued by the root render itself (#15757) (0bea14b), closes #6728

runtime-core: render nothing for an invalid v-for range in production (#15742) (ad19e7d)

runtime-dom: preserve v-show display for unchanged style strings (#15794) (c0a6d3f)

runtime-dom: treat playsinline as a boolean attribute (#15627) (a084e44)

server-renderer: propagate async setup errors (#15857) (6930374), closes #15716

ssr: honor falsy vnode content overrides (#15769) (c11c5c8)

suspense: mount resolved async component with its own namespace (#15640) (2a086a2), closes #15639

suspense: skip rendering async components unmounted while pending (4ab865a)

teleport: move targetStart and keep children before targetAnchor (#15818) (d3c6e02), closes #15817

transition-group: measure nested groups against their moving outer item (#15848) (1936c87), closes #5385 #1531

transition: handle comment-wrapped component roots (#15853) (ff35014), closes #6080 #5500

3.5.43 (2026-09-17)

Bug Fixes

compiler-sfc: ignore comment delimiters inside strings and url() when parsing css vars (#15548) (2fde323)

compiler-sfc: prepend semicolon for await in switch case (#15498) (9a1df69), closes #15495

compiler-sfc: restore await scope when leaving nested blocks (5409708), closes #15465

compiler-sfc: reuse parsed parent configs across tsconfig walks (fix #15478) (#15480) (d6febaa)

hydration: run leave hooks for hydration placeholders (#15431) (5dda192)

reactivity: preserve readonly wrappers in array copy methods (#15469) (599f35b)

runtime-core: unmount v-once children after parent rerenders (#15435) (d720338)

shared: handle circular references in looseEqual (#15499) (718f782), closes #15496

shared: preserve comment-like text in style values (#15471) (b9456cb)

suspense: don't drop nested suspense patches during hydration (#15429) (76d42dc)

suspense: keep the boundary pending while its branch is patched (#15411) (bfcfe9e), closes #7506

suspense: patch a hydrating boundary's pending branch in place (#15432) (2cde6f7)

suspense: unmount the DOM an interrupted async component claimed (#15430) (fb9b45c)

types: keep optional props when a runtime prop uses a generic PropType (#15523) (243aabc), closes #9546

3.5.42 (2026-08-27)

... (truncated)

Commits

bf5f0dd release: v3.5.44
6930374 fix(server-renderer): propagate async setup errors (#15857)
8e8c547 chore(deps): update all non-major dependencies (#15585)
4cb0ca8 chore(deps): update playground (#15685)
e38478f chore(deps): update dawidd6/action-download-artifact action to v27 (#15768)
1caed5a chore(deps): update compiler (#15586)
a49f451 chore(deps): update lint (#15680)
219b858 chore(deps): update build (#15679)
ff35014 fix(transition): handle comment-wrapped component roots (#15853)
d084b90 fix(compiler-core): parenthesise v-for key in v-memo cache guard (#15724)
Additional commits viewable in compare view

Bumps [@vue/server-renderer](https://github.com/vuejs/core/tree/HEAD/packages/server-renderer) to 3.5.44 and updates ancestor dependency [vue](https://github.com/vuejs/core). These dependencies need to be updated together. Updates `@vue/server-renderer` from 3.5.24 to 3.5.44 - [Release notes](https://github.com/vuejs/core/releases) - [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md) - [Commits](https://github.com/vuejs/core/commits/v3.5.44/packages/server-renderer) Updates `vue` from 3.5.24 to 3.5.44 - [Release notes](https://github.com/vuejs/core/releases) - [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md) - [Commits](vuejs/core@v3.5.24...v3.5.44) --- updated-dependencies: - dependency-name: "@vue/server-renderer" dependency-version: 3.5.44 dependency-type: indirect - dependency-name: vue dependency-version: 3.5.44 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-10-17T23:00:01Z

🤖 Codex-Style Code Review by OpenCode (Vue Best Practice Enabled)

💡 Autonomous AI Reviewer inspecting git commit history and Vue code quality.

Code Review Report

PR: build(deps): bump @vue/server-renderer and vue (3.5.24 → 3.5.44)
Base: origin/main · Head: d717b89 (Dependabot) + merge commit
Scope: package.json (+1/−1), package-lock.json (142 lines) — no application source changes.

Changes

package.json: vue ^3.5.24 → ^3.5.44 (direct production dep).
package-lock.json: the entire @vue/* family (vue, @vue/server-renderer, runtime-core, runtime-dom, reactivity, compiler-core/dom/sfc/ssr, shared) moved in lockstep to 3.5.44; transitive bumps of postcss 8.5.23→8.5.30, nanoid 3.3.19→3.3.20, @babel/parser 7.29.8→7.29.9, plus new/hoisted entities@7.0.1 and csstype@3.2.3 entries.

Evaluation

Correctness & consistency — PASS

The whole Vue package family is aligned at exactly 3.5.44 in the lockfile (verified all 10 @vue/* 3.x entries); no duplicate Vue runtime copies are introduced — important for this codebase since naive-ui, vue-router, vue-i18n, md-editor-v3, and @vitejs/plugin-vue@6.0.7 all peer-depend on vue@^3.x and remain satisfied.
Only a lockfile + manifest change; nothing under src/ touched, so no Composition API, reactivity, or lifecycle concerns to review in this diff.
Semver: ^3.5.24 → ^3.5.44 is a patch-level jump within the 3.5 line; Vue 3.5.x guarantees are backward-compatible, and the transitive bumps (postcss, nanoid, @babel/parser) are also patch-level.

Risk — LOW

Electron + Vite 8 + vue-tsc 2.2.0 toolchain unchanged; vue-tsc/@vue/language-core stay at 2.2.0, which supports 3.5.x SFCs.
The only nuance worth a follow-up (pre-existing, not introduced here): vue-tsc is pinned exactly ("vue-tsc": "2.2.0", no caret) while vue moves ahead — if type-check errors appear after this bump, that version skew is the first place to look.

Verdict: ✅ Approve

Clean, mechanical dependency bump with a consistent lockfile and no source-level impact. Recommend merging after CI (build + eslint + Playwright) is green; no code changes requested.

github-actions · 2026-10-17T23:05:29Z

🤖 Codex-Style Code Review by OpenCode (Vue Best Practice Enabled)

💡 Autonomous AI Reviewer inspecting git commit history and Vue code quality.

Let me look at the codebase structure and some Vue components to get context.
Let me look at the full diff stat again more clearly and also check if there might be other changes.
This is a dependency update PR - bumping Vue from 3.5.24 to 3.5.44. Let us look up what changed in Vue 3.5.x patch releases. There might be bug fixes, breaking changes in behavior, etc. Also let us look at the actual codebase usage patterns since the upgrade spans multiple patch versions.

Key things to check for Vue 3.5.x:

Reactivity/props/emits changes
Template/v-on/v-bind behavior changes
Potential regressions

But as an expert reviewer, I should evaluate this properly. Let us also look at how Vue is used in the codebase - some components might be affected by internal changes. Let us scan a few components.

Also lockfiles aren't skipped in the actual changes - but the instruction says "Skip lock files" in the review context. But the PR does change them. Let us focus on meaningful code review.Let us examine the actual source code patterns - maybe there are Vue-specific patterns to watch for with 3.5.44.

Vue 3 Dependency Bump Review (PR #232)

Summary

This PR bumps Vue from ^3.5.24 to ^3.5.44 (and related @vue/* packages) via Dependabot. Only package.json and package-lock.json are modified; no application source code changes. The upgrade spans patch releases and is low-risk from a code-change perspective.

Scope of Changes

package.json: vue → ^3.5.44
package-lock.json: syncs Vue core packages and transitive deps (@vue/compiler-*, @vue/runtime-*, @vue/reactivity, @vue/shared, @vue/server-renderer) plus minor bumps (@babel/parser, entities, postcss, source-map-js)

Compatibility Assessment (Vue 3.5.x patches)

Vue 3.5.25–3.5.44 are patch releases focused primarily on bug fixes and performance improvements (reactivity, compiler, runtime-dom, hydration, KeepAlive/Transition, SSR). No documented breaking changes within the patch series. Key points:

Patch-only scope: safe for caret range
Existing patterns in this codebase (<script setup>, typed defineProps/defineEmits, ref/computed/watch/nextTick, Composition API) align with Vue 3.5 best practices
Peer constraints checked: md-editor-v3 requires vue@^3.5.3 → satisfied

Codebase Observations (for context)

37 Vue SFCs, all using <script setup> (Composition API). 2 files use defineComponent. Patterns look idiomatic.
No obvious use of deprecated or unstable internals that commonly regress across patches.
Lint config includes Vue recommended rules (e.g. vue/no-mutating-props, vue/order-in-components, vue/no-ref-as-operand) and TypeScript strict-ish settings – helpful guardrails.

Risks / Notes

Large lockfile churn (expected for transitive updates). Recommend not reviewing lock line-by-line.
Some transitive version bumps (e.g. entities 4.x→7.x in @vue/compiler-core deps) are internal to Vue toolchain, not direct app deps.
No functional code changes → behavioral risk is limited to Vue bugfixes/regressions in this patch range.

Recommendations (before merge)

Type check: npm run build runs vue-tsc --build --force – must pass.
Lint: npm run eslint (or CI lint) should pass with no new violations.
Smoke test: run dev build or preview critical flows (router, keep-alive, infinite scroll, PWA SW behavior) in staging if possible.
CI: ensure all checks (lint, build, tests/e2e if any) pass.

Verdict

Approved. This is a routine, safe dependency upgrade with no application code changes. Proceed once CI/typecheck/lint pass.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 17, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-6ad8c7e44f branch from 9f743d5 to d717b89 Compare October 17, 2026 22:58

github-actions Bot merged commit 7171dcb into main Oct 17, 2026
2 of 4 checks passed

github-actions Bot approved these changes Oct 17, 2026

View reviewed changes

dependabot Bot deleted the dependabot/npm_and_yarn/multi-6ad8c7e44f branch October 17, 2026 22:58

Navigation Menu

Repository navigation

build(deps): bump @vue/server-renderer and vue - #232

build(deps): bump @vue/server-renderer and vue#232
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-6ad8c7e44f

dependabot Bot commented on behalf of github Oct 17, 2026 •

edited

Loading

Uh oh!

Uh oh!

github-actions Bot commented Oct 17, 2026

Uh oh!

github-actions Bot commented Oct 17, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v3.5.44

v3.5.43

v3.5.42

v3.5.41

v3.5.40

v3.5.39

v3.5.38

v3.5.37

v3.5.35

v3.5.34

v3.5.33

v3.5.32

v3.5.31

3.5.44 (2026-10-13)

Bug Fixes

3.5.43 (2026-09-17)

Bug Fixes

3.5.42 (2026-08-27)

v3.5.44

v3.5.43

v3.5.42

v3.5.41

v3.5.40

v3.5.39

v3.5.38

v3.5.37

v3.5.35

v3.5.34

v3.5.33

v3.5.32

v3.5.31

3.5.44 (2026-10-13)

Bug Fixes

3.5.43 (2026-09-17)

Bug Fixes

3.5.42 (2026-08-27)

Uh oh!

Uh oh!

github-actions Bot commented Oct 17, 2026

🤖 Codex-Style Code Review by OpenCode (Vue Best Practice Enabled)

Code Review Report

Changes

Evaluation

Verdict: ✅ Approve

Uh oh!

github-actions Bot commented Oct 17, 2026

🤖 Codex-Style Code Review by OpenCode (Vue Best Practice Enabled)

Vue 3 Dependency Bump Review (PR #232)

Summary

Scope of Changes

Compatibility Assessment (Vue 3.5.x patches)

Codebase Observations (for context)

Risks / Notes

Recommendations (before merge)

Verdict

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 17, 2026 •

edited

Loading