chore(deps): vue ^ 3.5.42

[floatpanebot]

What?

This PR contains the following updates:

Package	Change	Age	Confidence
vue (source)	3.5.39 → 3.5.42

---

Release Notes

vuejs/core (vue)

v3.5.42

Compare Source

Bug Fixes

• hydration: handle async component unmount before lazy hydration (#​15252) (6e1814a)
• hydration: handle moving unresolved async fragment (#​15263) (a72036f)
• runtime-core: avoid caching unmounted suspense children (#​15291) (b535917), closes #​15288
• runtime-core: keep .trim result when combined with .number v-model modifier (#​15346) (f8d42e1)
• runtime-core: resolve $el for dev root comment fragment (#​15313) (8654f35), closes #​12680
• runtime-dom: support !important on CSS custom properties in style binding (#​15348) (31da934)
• server-renderer: reject CR in attribute names (#​15266) (a2b40db)
• shared: correctly compare Map and Set values (#​15328) (ef82a26), closes #​15320
• suspense: don't treat the leaving branch as the fallback while its mount is pending (#​15333) (cd19745), closes #​15332
• v-model: re-sync select when model is overridden in change handler (#​15298) (6eaecc1), closes #​10505

v3.5.41

Compare Source

Bug Fixes

• compiler-core: preserve vnode lifecycle in stable v-for (#​11682) (02421cd), closes #​9239 #​12569
• compiler-sfc: handle transformed template AST after cache invalidation (#​15136) (a4440c0), closes #​15126 #​15128
• custom-element: preserve nested async mount order (#​15154) (71f9ff5), closes #​15153
• custom-element: warn when props override native properties (#​12125) (22b53ea), closes #​12124
• runtime-core: avoid re-fetching resource props with unchanged values (#​15105) (a7513a1)
• runtime-core: restore SSR setup state when handling async setup result (#​15114) (b6191cb), closes #​15113
• scheduler: avoid stack overflow when flushing very large post cb arrays (#​15143) (c04a45d), closes #​15142
• slots: handle nullish v-bind slot props (#​15177) (2506700)
• ssr: normalize hidden states during hydration (#​13125) (4e467d7)
• transition: support transition to teleport component child (#​11959) (77061fe), closes #​11910
• types: preserve defineModel inference with factory defaults (#​15097) (0516c43), closes #​15096
• v-model: preserve text input before hydration (#​14411) (2468464), closes #​14403

v3.5.40

Compare Source

Bug Fixes

• compiler-core: avoid leaking slot branch keys (#​15051) (20c9d26), closes #​15048
• hydration: pass namespace when patching dynamic props (#​15082) (e0d2723), closes #​15081 #​15050
• reactivity: handle effect removal during scope stop (#​15084) (378f978), closes #​15083
• runtime-core: skip lazy hydration for detached roots (#​15092) (97f3525), closes #​15091
• runtime-core: unwind dangling blocks when slot content throws (#​15071) (ddc132d), closes #​15070
• runtime-dom: respect current select model type (#​15010) (eb89e93), closes #​15009
• server-renderer: handle errors in optimized component renders (#​12601) (474907c), closes #​12575
• server-renderer: remove package dependency cycle (#​15063) (4d35eca)
• shared: prevent SSR comment escaping from creating closing delimiters (#​15045) (bd962bb)
• types: don't constrain component $el type to Element (#​15040) (164460a)

Why?

Automated dependency update via Renovate.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[floatpanebot]

❌ Security failed

Commit: 9a6da19 · run logs

Failed jobs:

• govulncheck — Run govulncheck ./... and update vulnerable deps.

Failure details

Build errors:

• 2026-09-10T18:10:57.6455028Z ##[error] #1: spellcheck/download.go:40: spellcheck.Download calls http.Client.Do, which eventually calls url.URL.Parse
• 2026-09-10T18:10:57.6466892Z ##[error] #1: fetcher/fetcher.go:421: fetcher.connectWithOptions calls imapclient.DialStartTLS, which eventually calls tls.Conn.Handshake
• 2026-09-10T18:10:57.6468648Z ##[error] #2: spellcheck/download.go:40: spellcheck.Download calls http.Client.Do, which eventually calls tls.Conn.HandshakeContext
• 2026-09-10T18:10:57.6469902Z ##[error] #3: backend/jmap/jmap.go:362: jmap.Provider.FetchAttachment calls io.ReadAll, which calls tls.Conn.Read
• 2026-09-10T18:10:57.6471032Z ##[error] #4: main.go:4411: matcha.main calls fmt.Fprintf, which calls tls.Conn.Write
• 2026-09-10T18:10:57.6454995Z ##[error] #1: spellcheck/download.go:40: spellcheck.Download calls http.Client.Do, which eventually calls url.URL.Parse
• 2026-09-10T18:10:57.6466861Z ##[error] #1: fetcher/fetcher.go:421: fetcher.connectWithOptions calls imapclient.DialStartTLS, which eventually calls tls.Conn.Handshake
• 2026-09-10T18:10:57.6468644Z ##[error] #2: spellcheck/download.go:40: spellcheck.Download calls http.Client.Do, which eventually calls tls.Conn.HandshakeContext