Skip to content

fix: computed and inject leak via mixins#1050

Merged
webfansplz merged 1 commit intovuejs:mainfrom
skirtles-code:mixins-leak
Feb 28, 2026
Merged

fix: computed and inject leak via mixins#1050
webfansplz merged 1 commit intovuejs:mainfrom
skirtles-code:mixins-leak

Conversation

@skirtles-code
Copy link
Contributor

Fixes #1049.

An example to reproduce the problem:

<script setup>
import { h } from 'vue'

const Mixin = {
  computed: {
    a() {
      return 1
    },
  },
}

const Comp1 = {
  mixins: [Mixin],
  computed: {
    b() {
      return 2
    },
  },
  render() {
    return h('div', 'comp 1')
  },
}

const Comp2 = {
  mixins: [Mixin],
  render() {
    return h('div', 'comp 2')
  },
}
</script>

<template>
  <div>
    <Comp1 />
    <hr>
    <Comp2 />
  </div>
</template>

In this example, inspecting Comp2 shows a computed property called b, even though Comp2 doesn't have a property called b. That property has leaked from Comp1, via the mixin.

In mergeOptions, we currently have this line:

to[key] = from[key]

That's using the original object from the mixin, not a copy. This is the underlying problem. Later we hit this line:

Object.assign(to[key], from[key])

That modifies to[key], adding properties from from[key]. In my earlier example, to[key] is the computed object from the mixin, and this copies in the property b from Comp2.

The same problem applies to inject.

@netlify
Copy link

netlify bot commented Feb 27, 2026

Deploy Preview for vue-devtools-docs canceled.

Name Link
🔨 Latest commit b538890
🔍 Latest deploy log https://app.netlify.com/projects/vue-devtools-docs/deploys/69a117736685a0000846328c

@pkg-pr-new
Copy link

pkg-pr-new bot commented Feb 27, 2026

Open in StackBlitz

@vue/devtools-applet

npm i https://pkg.pr.new/@vue/devtools-applet@1050

@vue/devtools-core

npm i https://pkg.pr.new/@vue/devtools-core@1050

@vue/devtools

npm i https://pkg.pr.new/@vue/devtools@1050

@vue/devtools-api

npm i https://pkg.pr.new/@vue/devtools-api@1050

@vue/devtools-kit

npm i https://pkg.pr.new/@vue/devtools-kit@1050

@vue/devtools-electron

npm i https://pkg.pr.new/@vue/devtools-electron@1050

@vue/devtools-shared

npm i https://pkg.pr.new/@vue/devtools-shared@1050

@vue/devtools-ui

npm i https://pkg.pr.new/@vue/devtools-ui@1050

vite-plugin-vue-devtools

npm i https://pkg.pr.new/vite-plugin-vue-devtools@1050

commit: 87b22ad

@webfansplz webfansplz merged commit ecca70f into vuejs:main Feb 28, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Plugin is unexpectedly **writing** to our Vue app

2 participants