Skip to content

v3.2.0

Latest
Latest

Choose a tag to compare

View all tags
@molon molon released this 08 Sep 10:02
v3.2.0
2ec5b35
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Go 1.26 plus a round of corejs security upgrades. Verified with apidiff: no Go API changes at all against v3.1.0. The minor bump is for the go directive, which raises the floor for consumers.

Breaking changes

No API breakage, but the minimum Go version is now 1.26.0 (was 1.25.8). Downstream modules below that will not build.

Bundled frontend assets

  • corejs/dist/vue.global.prod.js / vue.global.dev.js: Vue 3.5.40 → 3.5.42. This is the global Vue runtime downstream serves via web.JSVueComponentsPack(), so it reaches every page rendered through it, including third-party bundles that mark vue as external.
  • corejs/dist/index.js: 462018 → 466818 bytes, rebuilt under vite 6. corejs/src/ is unchanged, so the delta is minifier identifier reassignment, the new CJS wrapper, and the lodash bump below.
  • Fixes the lodash caveat noted in v3.1.0. v3.1.0 declared lodash: ^4.18.1 in package.json but shipped a dist/index.js that still inlined 4.17.21, so CVE-2026-2950 / CVE-2026-4800 were not actually fixed in the served code. The bundle is rebuilt here and now carries 4.18.1. Note that 4.18 hardens baseUnset against prototype pollution: __proto__, constructor and prototype are rejected as path keys, which affects _.unset and _.omit. web itself only uses debounce, union and without, but the full lodash is re-exported as plaid().lodash, so downstream code calling omit/unset on those keys will see the new behaviour.

Security (dev-only, not in the go:embed bundle)

  • vitest ^1.6.1 → ^3.2.7 — GHSA-5xrq-8626-4rwp (critical)
  • vite ^5.4.21 → ^6.4.3 — GHSA-fx2h-pf6j-xcff (high) plus two medium
  • Six transitive pins via overrides: shell-quote 1.10.0, nanoid 3.3.18, ws 8.21.3, js-cookie 3.0.8, js-yaml 4.3.2, postcss 8.5.28

Build

pnpm.overrides moved from corejs/package.json to corejs/pnpm-workspace.yaml. Recent pnpm no longer reads the former, which was failing pnpm install on master with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH.

What's Changed

  • fix: Go 1.26 + corejs security upgrades (Vue 3.5.42, vitest 3.2.7, vite 6.4.3, 6 transitive pins) by @shenzhaoyan in #141

New Contributors

Full Changelog: v3.1.0...v3.2.0

Contributors

shenzhaoyan
Assets 2
Loading