Skip to content

fix(runtime-vapor): avoid exposing built-in components internals via template ref#14448

Merged
edison1105 merged 5 commits intominorfrom
edison/fix/exposed
Feb 25, 2026
Merged

fix(runtime-vapor): avoid exposing built-in components internals via template ref#14448
edison1105 merged 5 commits intominorfrom
edison/fix/exposed

Conversation

@edison1105
Copy link
Copy Markdown
Member

@edison1105 edison1105 commented Feb 12, 2026

Summary by CodeRabbit

  • Tests
    • Updated test environment configuration with environment variable flag for e2e test preparation
    • Enhanced component instance accessibility for testing scenarios
    • Improved handling of fragment elements in component references

@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Feb 12, 2026

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • ✅ Review completed - (🔄 Check again to review again)
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch edison/fix/exposed

Comment @coderabbitai help to get the list of available commands and usage tips.

@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new bot commented Feb 12, 2026

Open in StackBlitz

@vue/compiler-core

pnpm add https://pkg.pr.new/@vue/compiler-core@14448
npm i https://pkg.pr.new/@vue/compiler-core@14448
yarn add https://pkg.pr.new/@vue/compiler-core@14448.tgz

@vue/compiler-dom

pnpm add https://pkg.pr.new/@vue/compiler-dom@14448
npm i https://pkg.pr.new/@vue/compiler-dom@14448
yarn add https://pkg.pr.new/@vue/compiler-dom@14448.tgz

@vue/compiler-sfc

pnpm add https://pkg.pr.new/@vue/compiler-sfc@14448
npm i https://pkg.pr.new/@vue/compiler-sfc@14448
yarn add https://pkg.pr.new/@vue/compiler-sfc@14448.tgz

@vue/compiler-ssr

pnpm add https://pkg.pr.new/@vue/compiler-ssr@14448
npm i https://pkg.pr.new/@vue/compiler-ssr@14448
yarn add https://pkg.pr.new/@vue/compiler-ssr@14448.tgz

@vue/compiler-vapor

pnpm add https://pkg.pr.new/@vue/compiler-vapor@14448
npm i https://pkg.pr.new/@vue/compiler-vapor@14448
yarn add https://pkg.pr.new/@vue/compiler-vapor@14448.tgz

@vue/reactivity

pnpm add https://pkg.pr.new/@vue/reactivity@14448
npm i https://pkg.pr.new/@vue/reactivity@14448
yarn add https://pkg.pr.new/@vue/reactivity@14448.tgz

@vue/runtime-core

pnpm add https://pkg.pr.new/@vue/runtime-core@14448
npm i https://pkg.pr.new/@vue/runtime-core@14448
yarn add https://pkg.pr.new/@vue/runtime-core@14448.tgz

@vue/runtime-dom

pnpm add https://pkg.pr.new/@vue/runtime-dom@14448
npm i https://pkg.pr.new/@vue/runtime-dom@14448
yarn add https://pkg.pr.new/@vue/runtime-dom@14448.tgz

@vue/runtime-vapor

pnpm add https://pkg.pr.new/@vue/runtime-vapor@14448
npm i https://pkg.pr.new/@vue/runtime-vapor@14448
yarn add https://pkg.pr.new/@vue/runtime-vapor@14448.tgz

@vue/server-renderer

pnpm add https://pkg.pr.new/@vue/server-renderer@14448
npm i https://pkg.pr.new/@vue/server-renderer@14448
yarn add https://pkg.pr.new/@vue/server-renderer@14448.tgz

@vue/shared

pnpm add https://pkg.pr.new/@vue/shared@14448
npm i https://pkg.pr.new/@vue/shared@14448
yarn add https://pkg.pr.new/@vue/shared@14448.tgz

vue

pnpm add https://pkg.pr.new/vue@14448
npm i https://pkg.pr.new/vue@14448
yarn add https://pkg.pr.new/vue@14448.tgz

@vue/compat

pnpm add https://pkg.pr.new/@vue/compat@14448
npm i https://pkg.pr.new/@vue/compat@14448
yarn add https://pkg.pr.new/@vue/compat@14448.tgz

commit: d088ef6

@github-actions
Copy link
Copy Markdown

Size Report

Bundles

File Size Gzip Brotli
compiler-dom.global.prod.js 86.4 kB 30.2 kB 26.6 kB
runtime-dom.global.prod.js 110 kB 41.6 kB 37.3 kB
vue.global.prod.js 169 kB 61.4 kB 54.7 kB

Usages

Name Size Gzip Brotli
createApp (CAPI only) 50.3 kB 19.7 kB 17.9 kB
createApp 59.3 kB 23 kB 20.9 kB
createApp + vaporInteropPlugin 82.3 kB 30.5 kB 27.7 kB
createVaporApp 28.6 kB 11.1 kB 10.2 kB
createSSRApp 63.5 kB 24.7 kB 22.5 kB
createVaporSSRApp 32 kB 12.4 kB 11.3 kB
defineCustomElement 65.3 kB 24.8 kB 22.5 kB
defineVaporCustomElement 38.9 kB 14.4 kB 13.2 kB
overall 74.1 kB 28.3 kB 25.7 kB

@edison1105 edison1105 added the scope: vapor related to vapor mode label Feb 12, 2026
@edison1105 edison1105 changed the title fix(runtime-vapor): avoid exposing KeepAlive internals via template ref fix(runtime-vapor): avoid exposing built-in components internals via template ref Feb 12, 2026
Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

♻️ Duplicate comments (1)
packages/runtime-vapor/src/components/TransitionGroup.ts (1)

60-62: Same typing suppression pattern as in Transition.ts.

This is the same @ts-expect-error/expose() context-typing gap already flagged; please address both callsites via the shared typing fix.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@packages/runtime-vapor/src/components/TransitionGroup.ts` around lines 60 -
62, The // `@ts-expect-error` on the setup call is hiding an untyped context; fix
it by typing the setup context instead of suppressing errors: import
SetupContext from 'vue' (or use the correct SetupContext generic) and change the
signature to setup(props: TransitionGroupProps, { slots, expose }: SetupContext)
(and call expose() as before), removing the comment; apply the same shared
typing fix to the matching setup in Transition.ts so both callsites use the
correctly typed SetupContext.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/runtime-vapor/src/components/KeepAlive.ts`:
- Line 153: Do not reset keepAliveInstance.exposed to null during HMR; remove
the assignment (or restore the previous exposed value) so the exposed reference
remains intact across rerenders—locate the line that sets
keepAliveInstance.exposed = null in KeepAlive.ts and either delete that
statement or replace it with logic that preserves the existing exposed value
instead of assigning null.

In `@packages/runtime-vapor/src/components/Transition.ts`:
- Around line 91-94: The expose() calls in Transition and TransitionGroup are
violating the FunctionalVaporComponent signature because expose is defined as
expose: <T extends Record<string, any> = Exposed>(exposed: T) => void but the
components call expose() with no arg; fix by making the parameter optional on
the FunctionalVaporComponent signature (change to expose: <T extends
Record<string, any> = Exposed>(exposed?: T) => void) so callers like Transition
and TransitionGroup can call expose() without error, or alternatively update the
callers (Transition and TransitionGroup) to call expose({}) instead; update the
signature in the component type (FunctionalVaporComponent / component.ts) if you
want a systemic fix, or change the two expose() calls in Transition and
TransitionGroup to expose({}) if you prefer a localized change.

---

Duplicate comments:
In `@packages/runtime-vapor/src/components/TransitionGroup.ts`:
- Around line 60-62: The // `@ts-expect-error` on the setup call is hiding an
untyped context; fix it by typing the setup context instead of suppressing
errors: import SetupContext from 'vue' (or use the correct SetupContext generic)
and change the signature to setup(props: TransitionGroupProps, { slots, expose
}: SetupContext) (and call expose() as before), removing the comment; apply the
same shared typing fix to the matching setup in Transition.ts so both callsites
use the correctly typed SetupContext.

ℹ️ Review info

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 0c1e4a0 and d088ef6.

📒 Files selected for processing (6)
  • package.json
  • packages-private/vapor-e2e-test/transition/App.vue
  • packages/runtime-vapor/src/apiTemplateRef.ts
  • packages/runtime-vapor/src/components/KeepAlive.ts
  • packages/runtime-vapor/src/components/Transition.ts
  • packages/runtime-vapor/src/components/TransitionGroup.ts

@edison1105 edison1105 merged commit 3badf50 into minor Feb 25, 2026
22 of 23 checks passed
@edison1105 edison1105 deleted the edison/fix/exposed branch February 25, 2026 03:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

scope: vapor related to vapor mode

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants