[renovate-bot-cbcoutinho]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
vue (source)	3.5.43 → 3.5.44

---

Release Notes

vuejs/core (vue)

v3.5.44

Compare Source

Bug Fixes

• compat: expose _setupProxy for Vue 2.7 compiled script setup (fix #​11164) (#​15618) (f08059d)
• compiler-core: parenthesise v-for key in v-memo cache guard (#​15724) (d084b90), closes #​15723
• compiler-dom: correctly stringify 0 and false in v-html (#​15571) (9f3b437)
• compiler-dom: inject transition persisted for v-show in production (#​15783) (89cb272)
• compiler-sfc: error when defineModel prop options reference a destructured prop (#​15604) (38012a5), closes #​15602
• custom-element: skip mounting an async custom element removed while its component loads (#​15777) (0f8e7b4), closes #​15775
• hydration: observe children of a display: contents root in hydrateOnVisible (#​15773) (7f688e8)
• KeepAlive: unmount pruned current component when its vnode was cloned on mount (#​15711) (92798ac), closes #​15710
• reactivity: avoid mutating native array iterators (#​15703) (7f9d45d), closes #​15643
• reactivity: do not track deps in watcher callbacks run inside another effect (#​15782) (db00fe9), closes #​5009
• reactivity: once watcher should stop when its callback throws (#​15755) (ae4bd94)
• reactivity: preserve shallow collection semantics (#​15793) (b600466), closes #​15792
• runtime-core: detect new prop keys when comparing full props (#​15634) (702fa61), closes #​15632
• runtime-core: keep async placeholder for block patching and pending component updates (#​15554) (05ec25f), closes #​15551
• runtime-core: only flush jobs queued by the root render itself (#​15757) (0bea14b), closes #​6728
• runtime-core: render nothing for an invalid v-for range in production (#​15742) (ad19e7d)
• runtime-dom: preserve v-show display for unchanged style strings (#​15794) (c0a6d3f)
• runtime-dom: treat playsinline as a boolean attribute (#​15627) (a084e44)
• server-renderer: propagate async setup errors (#​15857) (6930374), closes #​15716
• ssr: honor falsy vnode content overrides (#​15769) (c11c5c8)
• suspense: mount resolved async component with its own namespace (#​15640) (2a086a2), closes #​15639
• suspense: skip rendering async components unmounted while pending (4ab865a)
• teleport: move targetStart and keep children before targetAnchor (#​15818) (d3c6e02), closes #​15817
• transition-group: measure nested groups against their moving outer item (#​15848) (1936c87), closes #​5385 #​1531
• transition: handle comment-wrapped component roots (#​15853) (ff35014), closes #​6080 #​5500

---

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
astrolabe-docs	Ready	Preview	Oct 22, 2026 4:05am UTC

[claude]

Claude finished @renovate-bot-cbcoutinho[bot]'s task in 14s —— View job

---

Review: vue 3.5.43 → 3.5.44

• Read the diff (package-lock.json only, +74/−74)
• Check the scope of the lockfile changes
• Check the release notes against how this app uses Vue

Summary: This is a lockfile-only patch bump. I found no problems. I didn't run the build, lint, or e2e suites. The only checks I made were reading the diff and the release notes.

Diff

• All @vue/* packages move together from 3.5.43 to 3.5.44: compiler-core, compiler-dom, compiler-sfc, compiler-ssr, reactivity, runtime-core, runtime-dom, server-renderer, shared and vue. No package is left on a mismatched version.
• Three transitive ranges move with the bump: @babel/parser ^7.29.8 → ^7.29.9, postcss ^8.5.28 → ^8.5.29, and source-map-js ^1.2.1 → ^1.2.2. They're patch-level bumps.
• package.json is untouched. Its range presumably already admits 3.5.44, so only the lockfile needed to change.

Risk

• The release is bug fixes only, with no API changes. A few touch behavior the Astrolabe frontend (src/App.vue, src/components/, built with Vite) could plausibly hit:
  • The reactivity watcher fixes: "do not track deps in watcher callbacks run inside another effect" and "once watcher should stop when its callback throws".
  • The v-show fixes: display preservation and transition persisted.
  • The runtime-core fix that detects new prop keys when comparing full props.
• All of these are corrections toward documented behavior. I'd treat the risk as low, but it's worth a quick manual look at any component that relies on watcher side effects or v-show with transitions.
• Nothing in the notes touches the Nextcloud Vue component library's peer expectations.

Test coverage

• The PR adds no API surface, so the CLAUDE.md mandatory e2e and Pact gate doesn't apply.
• CI should confirm npm run build and npm run lint pass. Per CLAUDE.md, the e2e workflow runs separately from ci.yml's summary gate, so check that one on its own before merging.

Verdict: Looks good to merge once CI and e2e are green.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud