Vue.js: Vapor Mode Performance and Security Updates

Transcript

Good morning, this is your Vue.js development briefing for May 14th, 2026.

The Vue.js core team merged eight pull requests yesterday, with significant focus on Vapor mode improvements. Johnson Codehk merged a major refactor that decouples createSelector from createFor in the runtime-vapor system, simplifying the API by removing closure-captured state and making selector registration explicit. This change affected eight files with 276 additions and 134 deletions.

Edison1105 contributed three performance-focused merges for v-for handling. The first detaches v-for item scopes to improve lifecycle management and disposal handling. The second preserves v-for selector source offsets by centralizing parser configuration across compiler modules. The third coalesces v-for selector source updates to prevent redundant invocations during rapid selector updates.

Johnson Codehk also synchronized the reactivity system with the latest alien-signals upstream commit, updating from version 3.0.0 to past 3.2.0. This includes improvements to the propagate function for handling subscribers during reactive runs.

On the infrastructure side, Skirtle merged dependency update security settings, adding a one-day minimum release age to help prevent supply chain attacks. Arpit Jain enhanced CI security by setting explicit least-privilege workflow permissions, restricting the GitHub token scope to contents read-only.

Minor housekeeping included a typo fix in compiler-core codegen comments.

What's next: The Vapor mode optimizations suggest continued focus on runtime performance improvements. The security enhancements indicate ongoing attention to development pipeline hardening.

That's your Vue.js briefing for today. Stay updated with the latest developments.