@vue/compiler-sfc 3.5.40 → 3.5.41

package/dist/compiler-sfc.cjs.js

@@ -1,5 +1,5 @@
 /**
-* @vue/compiler-sfc v3.5.40
+* @vue/compiler-sfc v3.5.41
 * (c) 2018-present Yuxi (Evan) You and Vue contributors
 * @license MIT
 **/
@@ -1703,17 +1703,34 @@ function createCache(max = 500) {
   return new LRUCache({ max });
 }
 
-function isImportUsed(local, sfc) {
-  return resolveTemplateUsedIdentifiers(sfc).has(local);
+function resolveTemplateAST(inAST, options) {
+  if (!(inAST == null ? void 0 : inAST.transformed)) {
+    return inAST;
+  }
+  const { compiler = CompilerDOM__namespace, compilerOptions, ssr, onError } = options;
+  const newAST = (ssr ? CompilerDOM__namespace : compiler).parse(inAST.source, {
+    prefixIdentifiers: true,
+    ...compilerOptions,
+    parseMode: "sfc",
+    onError
+  });
+  const template = newAST.children.find(
+    (node) => node.type === 1 && node.tag === "template"
+  );
+  return compilerCore.createRoot(template.children, inAST.source);
+}
+
+function isImportUsed(local, sfc, options) {
+  return resolveTemplateUsedIdentifiers(sfc, options).has(local);
 }
 const templateAnalysisCache = createCache();
-function resolveTemplateVModelIdentifiers(sfc) {
-  return resolveTemplateAnalysisResult(sfc, false).vModelIds;
+function resolveTemplateVModelIdentifiers(sfc, options) {
+  return resolveTemplateAnalysisResult(sfc, false, options).vModelIds;
 }
-function resolveTemplateUsedIdentifiers(sfc) {
-  return resolveTemplateAnalysisResult(sfc).usedIds;
+function resolveTemplateUsedIdentifiers(sfc, options) {
+  return resolveTemplateAnalysisResult(sfc, true, options).usedIds;
 }
-function resolveTemplateAnalysisResult(sfc, collectUsedIds = true) {
+function resolveTemplateAnalysisResult(sfc, collectUsedIds = true, options) {
   const { content, ast } = sfc.template;
   const cached = templateAnalysisCache.get(content);
   if (cached && (!collectUsedIds || cached.usedIds)) {
@@ -1721,7 +1738,15 @@ function resolveTemplateAnalysisResult(sfc, collectUsedIds = true) {
   }
   const ids = collectUsedIds ? /* @__PURE__ */ new Set() : void 0;
   const vModelIds = /* @__PURE__ */ new Set();
-  ast.children.forEach(walk);
+  const root = resolveTemplateAST(ast, {
+    compiler: options == null ? void 0 : options.compiler,
+    compilerOptions: options == null ? void 0 : options.compilerOptions,
+    ssr: options == null ? void 0 : options.ssr,
+    // ignore errors since they were already reported by the SFC parser
+    onError: () => {
+    }
+  });
+  root.children.forEach(walk);
   function walk(node) {
     var _a;
     switch (node.type) {
@@ -4299,18 +4324,12 @@ function doCompileTemplate({
   if (compiler !== defaultCompiler) {
     inAST = void 0;
   }
-  if (inAST == null ? void 0 : inAST.transformed) {
-    const newAST = (ssr ? CompilerDOM__namespace : compiler).parse(inAST.source, {
-      prefixIdentifiers: true,
-      ...compilerOptions,
-      parseMode: "sfc",
-      onError: (e) => errors.push(e)
-    });
-    const template = newAST.children.find(
-      (node) => node.type === 1 && node.tag === "template"
-    );
-    inAST = compilerCore.createRoot(template.children, inAST.source);
-  }
+  inAST = resolveTemplateAST(inAST, {
+    compiler,
+    compilerOptions,
+    ssr,
+    onError: (e) => errors.push(e)
+  });
   let { code, ast, preamble, map } = compiler.compile(inAST || source, {
     mode: "module",
     prefixIdentifiers: true,
@@ -20492,6 +20511,17 @@ const closePattern = /\\}/g;
 const commaPattern = /\\,/g;
 const periodPattern = /\\\./g;
 const EXPANSION_MAX = 100_000;
+// `EXPANSION_MAX` caps the *number* of expansions, but not their length. An
+// input like `'{a,b}'.repeat(1500)` stays under that count - its output is
+// truncated to 100k results - while making every result ~1500 characters
+// long. The result set, and the intermediate arrays built while combining
+// brace sets, then grow large enough to exhaust memory and crash the process
+// (CVE-2026-14257). `EXPANSION_MAX_LENGTH` bounds the total number of
+// characters the accumulator may hold at any point, so memory stays flat no
+// matter how many brace groups are chained. The limit sits well above any
+// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M
+// characters) so legitimate input is unaffected.
+const EXPANSION_MAX_LENGTH = 4_000_000;
 function numeric(str) {
     return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0);
 }
@@ -20540,7 +20570,7 @@ function expand(str, options = {}) {
     if (!str) {
         return [];
     }
-    const { max = EXPANSION_MAX } = options;
+    const { max = EXPANSION_MAX, maxLength = EXPANSION_MAX_LENGTH } = options;
     // I don't know why Bash 4.3 does this, but it does.
     // Anything starting with {} will have the first two bytes preserved
     // but *only* at the top level, so {},a}b will not expand to anything,
@@ -20550,7 +20580,7 @@ function expand(str, options = {}) {
     if (str.slice(0, 2) === '{}') {
         str = '\\{\\}' + str.slice(2);
     }
-    return expand_(escapeBraces(str), max, true).map(unescapeBraces);
+    return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces);
 }
 function embrace(str) {
     return '{' + str + '}';
@@ -20564,22 +20594,117 @@ function lte(i, y) {
 function gte(i, y) {
     return i >= y;
 }
-function expand_(str, max, isTop) {
-    /** @type {string[]} */
-    const expansions = [];
-    const m = balanced('{', '}', str);
-    if (!m)
-        return [str];
-    // no need to expand pre, since it is guaranteed to be free of brace-sets
-    const pre = m.pre;
-    const post = m.post.length ? expand_(m.post, max, false) : [''];
-    if (/\$$/.test(m.pre)) {
-        for (let k = 0; k < post.length && k < max; k++) {
-            const expansion = pre + '{' + m.body + '}' + post[k];
-            expansions.push(expansion);
+// Build `{ acc[a] + pre + values[v] }` for every combination, capping the
+// number of results at `max` and the total number of characters at `maxLength`.
+// This is the one place output grows, so bounding it here keeps the single
+// accumulator - and therefore memory - flat regardless of how many brace groups
+// are combined (CVE-2026-14257).
+function combine(acc, pre, values, max, maxLength, dropEmpties) {
+    const out = [];
+    let length = 0;
+    for (let a = 0; a < acc.length; a++) {
+        for (let v = 0; v < values.length; v++) {
+            if (out.length >= max)
+                return out;
+            const expansion = acc[a] + pre + values[v];
+            // Bash drops empty results at the top level. Skip them before they count
+            // against `max`, so `max` bounds the number of *kept* results.
+            if (dropEmpties && !expansion)
+                continue;
+            if (length + expansion.length > maxLength)
+                return out;
+            out.push(expansion);
+            length += expansion.length;
         }
     }
-    else {
+    return out;
+}
+// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`)
+// sequence body.
+function expandSequence(body, isAlphaSequence, max, maxLength) {
+    const n = body.split(/\.\./);
+    const N = [];
+    // A sequence body always splits into two or three parts, but the compiler
+    // can't know that.
+    /* c8 ignore start */
+    if (n[0] === undefined || n[1] === undefined) {
+        return N;
+    }
+    /* c8 ignore stop */
+    const x = numeric(n[0]);
+    const y = numeric(n[1]);
+    const width = Math.max(n[0].length, n[1].length);
+    let incr = n.length === 3 && n[2] !== undefined ?
+        Math.max(Math.abs(numeric(n[2])), 1)
+        : 1;
+    let test = lte;
+    const reverse = y < x;
+    if (reverse) {
+        incr *= -1;
+        test = gte;
+    }
+    const pad = n.some(isPadded);
+    let length = 0;
+    for (let i = x; test(i, y) && N.length < max; i += incr) {
+        let c;
+        if (isAlphaSequence) {
+            c = String.fromCharCode(i);
+            if (c === '\\') {
+                c = '';
+            }
+        }
+        else {
+            c = String(i);
+            if (pad) {
+                const need = width - c.length;
+                if (need > 0) {
+                    const z = new Array(need + 1).join('0');
+                    if (i < 0) {
+                        c = '-' + z + c.slice(1);
+                    }
+                    else {
+                        c = z + c;
+                    }
+                }
+            }
+        }
+        if (length + c.length > maxLength)
+            break;
+        N.push(c);
+        length += c.length;
+    }
+    return N;
+}
+function expand_(str, max, maxLength, isTop) {
+    // Consume the string's top-level brace groups left to right, threading a
+    // running set of combined prefixes (`acc`). Expanding the tail iteratively -
+    // rather than recursing on `m.post` once per group - keeps the native stack
+    // depth constant, so deeply chained input (`'{a,b}'.repeat(3000)`) can no
+    // longer overflow the stack, and leaves a single accumulator whose size
+    // `maxLength` bounds directly (CVE-2026-14257).
+    let acc = [''];
+    // Bash drops empty results, but only when the *first* top-level group is a
+    // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop
+    // is on the final strings, so it is applied to whichever `combine` produces
+    // them (the one with no brace set left in the tail).
+    let dropEmpties = false;
+    let firstGroup = true;
+    for (;;) {
+        const m = balanced('{', '}', str);
+        // No brace set left: the rest of the string is literal.
+        if (!m) {
+            return combine(acc, str, [''], max, maxLength, dropEmpties);
+        }
+        // no need to expand pre, since it is guaranteed to be free of brace-sets
+        const pre = m.pre;
+        if (/\$$/.test(pre)) {
+            acc = combine(acc, pre + '{' + m.body + '}', [''], max, maxLength, dropEmpties && !m.post.length);
+            firstGroup = false;
+            if (!m.post.length)
+                break;
+            str = m.post;
+            continue;
+        }
         const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
         const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
         const isSequence = isNumericSequence || isAlphaSequence;
@@ -20588,87 +20713,69 @@ function expand_(str, max, isTop) {
             // {a},b}
             if (m.post.match(/,(?!,).*\}/)) {
                 str = m.pre + '{' + m.body + escClose + m.post;
-                return expand_(str, max, true);
+                isTop = true;
+                continue;
             }
-            return [str];
+            // Nothing here expands, so the whole remaining string is literal.
+            return combine(acc, pre + '{' + m.body + '}' + m.post, [''], max, maxLength, dropEmpties);
         }
-        let n;
+        if (firstGroup) {
+            dropEmpties = isTop && !isSequence;
+            firstGroup = false;
+        }
+        let values;
         if (isSequence) {
-            n = m.body.split(/\.\./);
+            values = expandSequence(m.body, isAlphaSequence, max, maxLength);
         }
         else {
-            n = parseCommaParts(m.body);
+            let n = parseCommaParts(m.body);
             if (n.length === 1 && n[0] !== undefined) {
                 // x{{a,b}}y ==> x{a}y x{b}y
-                n = expand_(n[0], max, false).map(embrace);
+                n = expand_(n[0], max, maxLength, false).map(embrace);
                 //XXX is this necessary? Can't seem to hit it in tests.
                 /* c8 ignore start */
                 if (n.length === 1) {
-                    return post.map(p => m.pre + n[0] + p);
+                    acc = combine(acc, pre + n[0], [''], max, maxLength, dropEmpties && !m.post.length);
+                    if (!m.post.length)
+                        break;
+                    str = m.post;
+                    continue;
                 }
                 /* c8 ignore stop */
             }
-        }
-        // at this point, n is the parts, and we know it's not a comma set
-        // with a single entry.
-        let N;
-        if (isSequence && n[0] !== undefined && n[1] !== undefined) {
-            const x = numeric(n[0]);
-            const y = numeric(n[1]);
-            const width = Math.max(n[0].length, n[1].length);
-            let incr = n.length === 3 && n[2] !== undefined ?
-                Math.max(Math.abs(numeric(n[2])), 1)
-                : 1;
-            let test = lte;
-            const reverse = y < x;
-            if (reverse) {
-                incr *= -1;
-                test = gte;
-            }
-            const pad = n.some(isPadded);
-            N = [];
-            for (let i = x; test(i, y); i += incr) {
-                let c;
-                if (isAlphaSequence) {
-                    c = String.fromCharCode(i);
-                    if (c === '\\') {
-                        c = '';
-                    }
+            // Values that `combine` is going to drop as empty produce no result, so
+            // they must not count against `max` - otherwise `{a,,b}` with `max: 2`
+            // would stop at `['a', '']` and yield one result instead of two. Skipping
+            // them outright keeps `values` bounded while leaving `max` a bound on
+            // *kept* results.
+            let dropsEmpties = dropEmpties && !m.post.length && !pre;
+            for (let d = 0; dropsEmpties && d < acc.length; d++) {
+                if (acc[d]) {
+                    dropsEmpties = false;
                 }
-                else {
-                    c = String(i);
-                    if (pad) {
-                        const need = width - c.length;
-                        if (need > 0) {
-                            const z = new Array(need + 1).join('0');
-                            if (i < 0) {
-                                c = '-' + z + c.slice(1);
-                            }
-                            else {
-                                c = z + c;
-                            }
-                        }
-                    }
-                }
-                N.push(c);
             }
-        }
-        else {
-            N = [];
-            for (let j = 0; j < n.length; j++) {
-                N.push.apply(N, expand_(n[j], max, false));
-            }
-        }
-        for (let j = 0; j < N.length; j++) {
-            for (let k = 0; k < post.length && expansions.length < max; k++) {
-                const expansion = pre + N[j] + post[k];
-                if (!isTop || isSequence || expansion) {
-                    expansions.push(expansion);
+            values = [];
+            let valuesLength = 0;
+            outer: for (let j = 0; j < n.length; j++) {
+                const expanded = expand_(n[j], max, maxLength, false);
+                for (let k = 0; k < expanded.length; k++) {
+                    const v = expanded[k];
+                    if (dropsEmpties && !v)
+                        continue;
+                    if (values.length >= max || valuesLength + v.length > maxLength) {
+                        break outer;
+                    }
+                    values.push(v);
+                    valuesLength += v.length;
                 }
             }
         }
+        acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length);
+        if (!m.post.length)
+            break;
+        str = m.post;
     }
-    return expansions;
+    return acc;
 }
 
 const MAX_PATTERN_LENGTH = 1024 * 64;
@@ -25337,7 +25444,7 @@ Upgrade your vite or vue-loader version for compatibility with the latest experi
   function registerUserImport(source2, local, imported, isType, isFromSetup, needTemplateUsageCheck) {
     let isUsedInTemplate = needTemplateUsageCheck;
     if (needTemplateUsageCheck && ctx.isTS && sfc.template && !sfc.template.src && !sfc.template.lang) {
-      isUsedInTemplate = isImportUsed(local, sfc);
+      isUsedInTemplate = isImportUsed(local, sfc, options.templateOptions);
     }
     ctx.userImports[local] = {
       isType,
@@ -25684,7 +25791,10 @@ const ${normalScriptDefaultVar} = ${defaultSpecifier.local.name}
     ctx.bindingMetadata[key] = setupBindings[key];
   }
   if (sfc.template && !sfc.template.src && sfc.template.ast) {
-    const vModelIds = resolveTemplateVModelIdentifiers(sfc);
+    const vModelIds = resolveTemplateVModelIdentifiers(
+      sfc,
+      options.templateOptions
+    );
     if (vModelIds.size) {
       const toDemote = /* @__PURE__ */ new Set();
       for (const id of vModelIds) {
@@ -26151,7 +26261,7 @@ function mergeSourceMaps(scriptMap, templateMap, templateLineOffset) {
   return generator.toJSON();
 }
 
-const version = "3.5.40";
+const version = "3.5.41";
 const parseCache = parseCache$1;
 const errorMessages = {
   ...CompilerDOM.errorMessages,

package/dist/compiler-sfc.esm-browser.js

@@ -1,5 +1,5 @@
 /**
-* @vue/compiler-sfc v3.5.40
+* @vue/compiler-sfc v3.5.41
 * (c) 2018-present Yuxi (Evan) You and Vue contributors
 * @license MIT
 **/
@@ -216,8 +216,11 @@ const isVoidTag = /* @__PURE__ */ makeMap(VOID_TAGS);
 
 const specialBooleanAttrs = `itemscope,allowfullscreen,formnovalidate,ismap,nomodule,novalidate,readonly`;
 const isBooleanAttr = /* @__PURE__ */ makeMap(
-  specialBooleanAttrs + `,async,autofocus,autoplay,controls,default,defer,disabled,hidden,inert,loop,open,required,reversed,scoped,seamless,checked,muted,multiple,selected`
+  specialBooleanAttrs + `,async,autofocus,autoplay,controls,default,defer,disabled,inert,loop,open,required,reversed,scoped,seamless,checked,muted,multiple,selected`
 );
+function includeBooleanAttr(value) {
+  return !!value || value === "";
+}
 const unsafeAttrCharRE = /[>/="'\u0009\u000a\u000c\u0020]/;
 const attrValidationCache = {};
 function isSSRSafeAttrName(name) {
@@ -4764,6 +4767,7 @@ function requireLib () {
 	  SloppyFunctionAnnexB: "In non-strict mode code, functions can only be declared at top level, inside a block, or as the body of an if statement.",
 	  SourcePhaseImportRequiresDefault: 'Only `import source x from "./module"` is valid.',
 	  StaticPrototype: "Classes may not have static property named prototype.",
+	  SuperCallNotNewExpression: "Cannot use new with super(...).",
 	  SuperNotAllowed: "`super()` is only valid inside a class constructor of a subclass. Maybe a typo in the method name ('constructor') or not extending another class?",
 	  SuperPrivateField: "Private fields can't be accessed on super.",
 	  TrailingDecorator: "Decorators must be attached to a class element.",
@@ -4793,7 +4797,6 @@ function requireLib () {
 	  UnexpectedTokenUnaryExponentiation: "Illegal expression. Wrap left hand side or entire exponentiation in parentheses.",
 	  UnexpectedUsingDeclaration: "Using declaration cannot appear in the top level when source type is `script` or in the bare case statement.",
 	  UnexpectedVoidPattern: "Unexpected void binding.",
-	  UnsupportedBind: "Binding should be performed on object property.",
 	  UnsupportedDecoratorExport: "A decorated export must export a class declaration.",
 	  UnsupportedDefaultExport: "Only expressions, functions or classes are allowed as the `default` export.",
 	  UnsupportedImport: "`import` can only be used in `import()` or `import.meta`.",
@@ -4861,6 +4864,10 @@ function requireLib () {
 	  PrimaryTopicNotAllowed: "Topic reference was used in a lexical context without topic binding.",
 	  PrimaryTopicRequiresSmartPipeline: 'Topic reference is used, but the pipelineOperator plugin was not passed a "proposal": "hack" or "smart" option.'
 	});
+	var FunctionBindErrors = {
+	  UnsupportedBind: "Binding should be performed on object property.",
+	  UnsupportedBindRHS: "The right-hand side of binding can not be super or import."
+	};
 	const _excluded = ["message"];
 	function defineHidden(obj, key, value) {
 	  Object.defineProperty(obj, key, {
@@ -4951,7 +4958,7 @@ function requireLib () {
 	  }
 	  return ParseErrorConstructors;
 	}
-	const Errors = Object.assign({}, ParseErrorEnum(ModuleErrors), ParseErrorEnum(StandardErrors), ParseErrorEnum(StrictModeErrors), ParseErrorEnum(ParseExpressionErrors), ParseErrorEnum`pipelineOperator`(PipelineOperatorErrors));
+	const Errors = Object.assign({}, ParseErrorEnum(ModuleErrors), ParseErrorEnum(StandardErrors), ParseErrorEnum(StrictModeErrors), ParseErrorEnum(ParseExpressionErrors), ParseErrorEnum`pipelineOperator`(PipelineOperatorErrors), ParseErrorEnum`functionBind`(FunctionBindErrors));
 	function createDefaultOptions() {
 	  return {
 	    sourceType: "script",
@@ -15644,7 +15651,7 @@ function requireLib () {
 	      type
 	    } = this.state;
 	    if (!noCalls && type === 15) {
-	      return this.parseBind(base, startLoc, noCalls, state);
+	      return this.parseBind(base, startLoc, state);
 	    } else if (tokenIsTemplate(type)) {
 	      return this.parseTaggedTemplateExpression(base, startLoc, state);
 	    }
@@ -15697,13 +15704,18 @@ function requireLib () {
 	      return this.finishNode(node, "MemberExpression");
 	    }
 	  }
-	  parseBind(base, startLoc, noCalls, state) {
+	  parseBind(base, startLoc, state) {
 	    const node = this.startNodeAt(startLoc);
 	    node.object = base;
 	    this.next();
-	    node.callee = this.parseNoCallExpr();
+	    const isImport = this.match(83);
+	    const callee = this.parseNoCallExpr();
+	    if (callee.type === "Super" || isImport && callee.type === "ImportExpression" || callee.type === "Import") {
+	      throw this.raise(Errors.UnsupportedBindRHS, callee);
+	    }
+	    node.callee = callee;
 	    state.stop = true;
-	    return this.parseSubscripts(this.finishNode(node, "BindExpression"), startLoc, noCalls);
+	    return this.parseSubscripts(this.finishNode(node, "BindExpression"), startLoc, false);
 	  }
 	  parseCoverCallAndAsyncArrowHead(base, startLoc, state, optional) {
 	    const oldMaybeInArrowParameters = this.state.maybeInArrowParameters;
@@ -16299,9 +16311,12 @@ function requireLib () {
 	    const isImport = this.match(83);
 	    const callee = this.parseNoCallExpr();
 	    node.callee = callee;
-	    if (isImport && (callee.type === "Import" || callee.type === "ImportExpression")) {
+	    if (isImport && callee.type === "ImportExpression" || callee.type === "Import") {
 	      this.raise(Errors.ImportCallNotNewExpression, callee);
 	    }
+	    if (callee.type === "Super") {
+	      this.raise(Errors.SuperCallNotNewExpression, callee);
+	    }
 	  }
 	  parseTemplateElement(isTagged) {
 	    const {
@@ -26058,6 +26073,7 @@ const transformFor = createStructuralDirectiveTransform(
         node.loc
       );
       return () => {
+        var _a;
         let childBlock;
         const { children } = forNode;
         if (isTemplate) {
@@ -26101,7 +26117,8 @@ const transformFor = createStructuralDirectiveTransform(
           if (isTemplate && keyProperty) {
             injectProp(childBlock, keyProperty, context);
           }
-          if (childBlock.isBlock !== !isStableFragment) {
+          const shouldUseBlock = !isStableFragment || childBlock.isBlockRequired === true;
+          if (childBlock.isBlock !== shouldUseBlock) {
             if (childBlock.isBlock) {
               removeHelper(OPEN_BLOCK);
               removeHelper(
@@ -26113,12 +26130,15 @@ const transformFor = createStructuralDirectiveTransform(
               );
             }
           }
-          childBlock.isBlock = !isStableFragment;
+          childBlock.isBlock = shouldUseBlock;
           if (childBlock.isBlock) {
             helper(OPEN_BLOCK);
             helper(getVNodeBlockHelper(context.inSSR, childBlock.isComponent));
           } else {
             helper(getVNodeHelper(context.inSSR, childBlock.isComponent));
+            if (childBlock.needsPatch) {
+              childBlock.patchFlag = ((_a = childBlock.patchFlag) != null ? _a : 0) | 512;
+            }
           }
         }
         if (memo) {
@@ -26537,6 +26557,8 @@ const transformElement = (node, context) => {
     let vnodeDynamicProps;
     let dynamicPropNames;
     let vnodeDirectives;
+    let needsPatch = false;
+    let isBlockRequired = false;
     let shouldUseBlock = (
       // dynamic component may resolve to plain elements
       isDynamicComponent || vnodeTag === TELEPORT || vnodeTag === SUSPENSE || !isComponent && // <svg> and <foreignObject> must be forced into blocks so that block
@@ -26556,6 +26578,8 @@ const transformElement = (node, context) => {
       vnodeProps = propsBuildResult.props;
       patchFlag = propsBuildResult.patchFlag;
       dynamicPropNames = propsBuildResult.dynamicPropNames;
+      needsPatch = propsBuildResult.needsPatch;
+      isBlockRequired = propsBuildResult.isBlockRequired;
       const directives = propsBuildResult.directives;
       vnodeDirectives = directives && directives.length ? createArrayExpression(
         directives.map((dir) => buildDirectiveArgs(dir, context))
@@ -26606,7 +26630,7 @@ const transformElement = (node, context) => {
     if (dynamicPropNames && dynamicPropNames.length) {
       vnodeDynamicProps = stringifyDynamicPropNames(dynamicPropNames);
     }
-    node.codegenNode = createVNodeCall(
+    const vnodeCall = node.codegenNode = createVNodeCall(
       context,
       vnodeTag,
       vnodeProps,
@@ -26619,6 +26643,13 @@ const transformElement = (node, context) => {
       isComponent,
       node.loc
     );
+    needsPatch = needsPatch && (patchFlag === 0 || patchFlag === 32);
+    if (needsPatch) {
+      vnodeCall.needsPatch = true;
+    }
+    if (isBlockRequired) {
+      vnodeCall.isBlockRequired = true;
+    }
   };
 };
 function resolveComponentType(node, context, ssr = false) {
@@ -26725,6 +26756,7 @@ function buildProps(node, context, props = node.props, isComponent, isDynamicCom
   const runtimeDirectives = [];
   const hasChildren = children.length > 0;
   let shouldUseBlock = false;
+  let isBlockRequired = false;
   let patchFlag = 0;
   let hasRef = false;
   let hasClassBinding = false;
@@ -26766,19 +26798,20 @@ function buildProps(node, context, props = node.props, isComponent, isDynamicCom
       if (isEventHandler && isReservedProp(name)) {
         hasVnodeHook = true;
       }
+      if (name === "ref") {
+        hasRef = true;
+      }
       if (isEventHandler && value.type === 14) {
         value = value.arguments[0];
       }
       if (value.type === 20 || (value.type === 4 || value.type === 8) && getConstantType(value, context) > 0) {
         return;
       }
-      if (name === "ref") {
-        hasRef = true;
-      } else if (name === "class") {
+      if (name === "class") {
         hasClassBinding = true;
       } else if (name === "style") {
         hasStyleBinding = true;
-      } else if (name !== "key" && !dynamicPropNames.includes(name)) {
+      } else if (name !== "ref" && name !== "key" && !dynamicPropNames.includes(name)) {
         dynamicPropNames.push(name);
       }
       if (isComponent && (name === "class" || name === "style") && !dynamicPropNames.includes(name)) {
@@ -26843,14 +26876,13 @@ function buildProps(node, context, props = node.props, isComponent, isDynamicCom
       if (isVOn && ssr) {
         continue;
       }
-      if (
-        // #938: elements with dynamic keys should be forced into blocks
-        isVBind && isStaticArgOf(arg, "key") || // inline before-update hooks need to force block so that it is invoked
-        // before children
-        isVOn && hasChildren && isStaticArgOf(arg, "vue:before-update")
-      ) {
+      if (isVBind && isStaticArgOf(arg, "key")) {
         shouldUseBlock = true;
       }
+      if (isVOn && hasChildren && arg && isStaticExp(arg) && camelize(arg.content) === "vue:beforeUpdate") {
+        shouldUseBlock = true;
+        isBlockRequired = true;
+      }
       if (isVBind && isStaticArgOf(arg, "ref")) {
         pushRefVForMarker();
       }
@@ -26901,6 +26933,7 @@ function buildProps(node, context, props = node.props, isComponent, isDynamicCom
         runtimeDirectives.push(prop);
         if (hasChildren) {
           shouldUseBlock = true;
+          isBlockRequired = true;
         }
       }
     }
@@ -26939,7 +26972,8 @@ function buildProps(node, context, props = node.props, isComponent, isDynamicCom
       patchFlag |= 32;
     }
   }
-  if (!shouldUseBlock && (patchFlag === 0 || patchFlag === 32) && (hasRef || hasVnodeHook || runtimeDirectives.length > 0)) {
+  const needsPatch = (patchFlag === 0 || patchFlag === 32) && (hasRef || hasVnodeHook || runtimeDirectives.length > 0);
+  if (!shouldUseBlock && needsPatch) {
     patchFlag |= 512;
   }
   if (!context.inSSR && propsExpression) {
@@ -27005,7 +27039,9 @@ function buildProps(node, context, props = node.props, isComponent, isDynamicCom
     directives: runtimeDirectives,
     patchFlag,
     dynamicPropNames,
-    shouldUseBlock
+    shouldUseBlock,
+    needsPatch,
+    isBlockRequired
   };
 }
 function dedupeProperties(properties) {
@@ -28268,12 +28304,15 @@ function stringifyElement(node, context) {
           res += ` ${p.arg.content}="__VUE_EXP_START__${exp.content}__VUE_EXP_END__"`;
           continue;
         }
-        if (isBooleanAttr(p.arg.content) && exp.content === "false") {
+        if ((isBooleanAttr(p.arg.content) || p.arg.content === "hidden") && exp.content === "false") {
           continue;
         }
         let evaluated = evaluateConstant(exp);
         if (evaluated != null) {
           const arg = p.arg && p.arg.content;
+          if (arg === "hidden" && typeof evaluated === "number" && !includeBooleanAttr(evaluated)) {
+            continue;
+          }
           if (arg === "class") {
             evaluated = normalizeClass(evaluated);
           } else if (arg === "style") {
@@ -29171,17 +29210,53 @@ function createCache(max = 500) {
   }
 }
 
-function isImportUsed(local, sfc) {
-  return resolveTemplateUsedIdentifiers(sfc).has(local);
+var __defProp$b = Object.defineProperty;
+var __defProps$a = Object.defineProperties;
+var __getOwnPropDescs$a = Object.getOwnPropertyDescriptors;
+var __getOwnPropSymbols$b = Object.getOwnPropertySymbols;
+var __hasOwnProp$b = Object.prototype.hasOwnProperty;
+var __propIsEnum$b = Object.prototype.propertyIsEnumerable;
+var __defNormalProp$b = (obj, key, value) => key in obj ? __defProp$b(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues$b = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp$b.call(b, prop))
+      __defNormalProp$b(a, prop, b[prop]);
+  if (__getOwnPropSymbols$b)
+    for (var prop of __getOwnPropSymbols$b(b)) {
+      if (__propIsEnum$b.call(b, prop))
+        __defNormalProp$b(a, prop, b[prop]);
+    }
+  return a;
+};
+var __spreadProps$a = (a, b) => __defProps$a(a, __getOwnPropDescs$a(b));
+function resolveTemplateAST(inAST, options) {
+  if (!(inAST == null ? void 0 : inAST.transformed)) {
+    return inAST;
+  }
+  const { compiler = CompilerDOM, compilerOptions, ssr, onError } = options;
+  const newAST = (ssr ? CompilerDOM : compiler).parse(inAST.source, __spreadProps$a(__spreadValues$b({
+    prefixIdentifiers: true
+  }, compilerOptions), {
+    parseMode: "sfc",
+    onError
+  }));
+  const template = newAST.children.find(
+    (node) => node.type === 1 && node.tag === "template"
+  );
+  return createRoot(template.children, inAST.source);
+}
+
+function isImportUsed(local, sfc, options) {
+  return resolveTemplateUsedIdentifiers(sfc, options).has(local);
 }
 const templateAnalysisCache = createCache();
-function resolveTemplateVModelIdentifiers(sfc) {
-  return resolveTemplateAnalysisResult(sfc, false).vModelIds;
+function resolveTemplateVModelIdentifiers(sfc, options) {
+  return resolveTemplateAnalysisResult(sfc, false, options).vModelIds;
 }
-function resolveTemplateUsedIdentifiers(sfc) {
-  return resolveTemplateAnalysisResult(sfc).usedIds;
+function resolveTemplateUsedIdentifiers(sfc, options) {
+  return resolveTemplateAnalysisResult(sfc, true, options).usedIds;
 }
-function resolveTemplateAnalysisResult(sfc, collectUsedIds = true) {
+function resolveTemplateAnalysisResult(sfc, collectUsedIds = true, options) {
   const { content, ast } = sfc.template;
   const cached = templateAnalysisCache.get(content);
   if (cached && (!collectUsedIds || cached.usedIds)) {
@@ -29189,7 +29264,15 @@ function resolveTemplateAnalysisResult(sfc, collectUsedIds = true) {
   }
   const ids = collectUsedIds ? /* @__PURE__ */ new Set() : void 0;
   const vModelIds = /* @__PURE__ */ new Set();
-  ast.children.forEach(walk);
+  const root = resolveTemplateAST(ast, {
+    compiler: options == null ? void 0 : options.compiler,
+    compilerOptions: options == null ? void 0 : options.compilerOptions,
+    ssr: options == null ? void 0 : options.ssr,
+    // ignore errors since they were already reported by the SFC parser
+    onError: () => {
+    }
+  });
+  root.children.forEach(walk);
   function walk(node) {
     var _a;
     switch (node.type) {
@@ -32502,6 +32585,13 @@ const ssrTransformElement = (node, context) => {
                         false
                       )
                     );
+                  } else if (attrName === "hidden") {
+                    openTag.push(
+                      createCallExpression(
+                        context.helper(SSR_RENDER_DYNAMIC_ATTR),
+                        [key, value]
+                      )
+                    );
                   } else if (isSSRSafeAttrName(attrName)) {
                     openTag.push(
                       createCallExpression(context.helper(SSR_RENDER_ATTR), [
@@ -33609,18 +33699,12 @@ function doCompileTemplate({
   if (compiler !== defaultCompiler) {
     inAST = void 0;
   }
-  if (inAST == null ? void 0 : inAST.transformed) {
-    const newAST = (ssr ? CompilerDOM : compiler).parse(inAST.source, __spreadProps$5(__spreadValues$6({
-      prefixIdentifiers: true
-    }, compilerOptions), {
-      parseMode: "sfc",
-      onError: (e) => errors.push(e)
-    }));
-    const template = newAST.children.find(
-      (node) => node.type === 1 && node.tag === "template"
-    );
-    inAST = createRoot(template.children, inAST.source);
-  }
+  inAST = resolveTemplateAST(inAST, {
+    compiler,
+    compilerOptions,
+    ssr,
+    onError: (e) => errors.push(e)
+  });
   let { code, ast, preamble, map } = compiler.compile(inAST || source, __spreadProps$5(__spreadValues$6({
     mode: "module",
     prefixIdentifiers: true,
@@ -34315,6 +34399,10 @@ function requireStringifier () {
 	const STYLE_TAG = /(<)(\/?style\b)/gi;
 	const COMMENT_OPEN = /(<)(!--)/g;
 
+	// Characters that end an at-rule name, mirroring RE_AT_END in the tokenizer.
+	// Params starting with anything else need a space to stay separate tokens.
+	const AT_NAME_END = /[\t\n\f\r "#'()/;[\\\]{}]/;
+
 	function escapeHTMLInCSS(str) {
 	  if (typeof str !== 'string') return str
 	  if (!str.includes('<')) return str
@@ -34343,14 +34431,15 @@ function requireStringifier () {
 	function atruleStart(str, node) {
 	  let name = '@' + node.name;
 	  let params = node.params ? str.rawValue(node, 'params') : '';
+	  let afterName = node.raws.afterName;
 
-	  if (typeof node.raws.afterName !== 'undefined') {
-	    name += node.raws.afterName;
-	  } else if (params) {
-	    name += ' ';
+	  if (typeof afterName === 'undefined') {
+	    afterName = params ? ' ' : '';
+	  } else if (afterName === '' && params && !AT_NAME_END.test(params[0])) {
+	    afterName = ' ';
 	  }
 
-	  return name + params
+	  return name + afterName + params
 	}
 
 	function pushBody(str, stack, node) {
@@ -34364,10 +34453,24 @@ function requireStringifier () {
 	  let semicolon = str.raw(node, 'semicolon');
 	  let isDocument = node.type === 'document';
 	  for (let i = nodes.length - 1; i >= 0; i--) {
+	    let child = nodes[i];
+	    let childSemicolon = last !== i || semicolon;
+	    // A childless at-rule or a custom property declaration that still has
+	    // following siblings must be terminated. Without the semicolon those
+	    // trailing comments are folded into the at-rule's prelude or the custom
+	    // property's value and disappear when the output is re-parsed.
+	    if (
+	      !childSemicolon &&
+	      i < nodes.length - 1 &&
+	      ((child.type === 'atrule' && !child.nodes) ||
+	        (child.type === 'decl' && child.prop.startsWith('--')))
+	    ) {
+	      childSemicolon = true;
+	    }
 	    stack.push({
 	      document: isDocument,
-	      node: nodes[i],
-	      semicolon: last !== i || semicolon
+	      node: child,
+	      semicolon: childSemicolon
 	    });
 	  }
 	}
@@ -35919,22 +36022,14 @@ var hasRequiredNonSecure;
 function requireNonSecure () {
 	if (hasRequiredNonSecure) return nonSecure;
 	hasRequiredNonSecure = 1;
-	// This alphabet uses `A-Za-z0-9_-` symbols.
-	// The order of characters is optimized for better gzip and brotli compression.
-	// References to the same file (works both for gzip and brotli):
-	// `'use`, `andom`, and `rict'`
-	// References to the brotli default dictionary:
-	// `-26T`, `1983`, `40px`, `75px`, `bush`, `jack`, `mind`, `very`, and `wolf`
 	let urlAlphabet =
 	  'useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict';
 
 	let customAlphabet = (alphabet, defaultSize = 21) => {
 	  return (size = defaultSize) => {
 	    let id = '';
-	    // A compact alternative for `for (var i = 0; i < step; i++)`.
 	    let i = size | 0;
-	    while (i--) {
-	      // `| 0` is more compact and faster than `Math.floor()`.
+	    while (i-- > 0) {
 	      id += alphabet[(Math.random() * alphabet.length) | 0];
 	    }
 	    return id
@@ -35943,10 +36038,8 @@ function requireNonSecure () {
 
 	let nanoid = (size = 21) => {
 	  let id = '';
-	  // A compact alternative for `for (var i = 0; i < step; i++)`.
 	  let i = size | 0;
-	  while (i--) {
-	    // `| 0` is more compact and faster than `Math.floor()`.
+	  while (i-- > 0) {
 	    id += urlAlphabet[(Math.random() * 64) | 0];
 	  }
 	  return id
@@ -36051,19 +36144,13 @@ function requirePreviousMap () {
 
 	  loadFile(path, cssFile, trusted) {
 	    if (!trusted && !this.unsafeMap) {
-	      if (!/\.map$/i.test(path)) {
+	      if (!/\.map$/i.test(path)) return undefined
+	      if (!cssFile) return undefined
+
+	      let rel = relative(dirname(cssFile), path);
+	      if (rel === '..' || rel.startsWith('..' + sep) || isAbsolute(rel)) {
 	        return undefined
 	      }
-	      if (cssFile) {
-	        let relativePath = relative(dirname(cssFile), path);
-	        if (
-	          relativePath === '..' ||
-	          relativePath.startsWith('..' + sep) ||
-	          isAbsolute(relativePath)
-	        ) {
-	          return undefined
-	        }
-	      }
 	    }
 	    this.root = dirname(path);
 	    if (existsSync(path)) {
@@ -37793,12 +37880,22 @@ function requireWarning () {
 	if (hasRequiredWarning) return warning;
 	hasRequiredWarning = 1;
 
+	let Container = /*@__PURE__*/ requireContainer$1();
+	let { my } = /*@__PURE__*/ requireSymbols();
+
 	class Warning {
 	  constructor(text, opts = {}) {
 	    this.type = 'warning';
 	    this.text = text;
 
 	    if (opts.node && opts.node.source) {
+	      if (!opts.node[my]) {
+	        // The node comes from another PostCSS copy in node_modules, so it does
+	        // not have this copy’s methods. Container#normalize() rebuilds such
+	        // nodes on insert, but a node passed straight to Result#warn() never
+	        // goes through it.
+	        Container.rebuild(opts.node);
+	      }
 	      let range = opts.node.rangeBy(opts);
 	      this.line = range.start.line;
 	      this.column = range.start.column;
@@ -38675,7 +38772,7 @@ function requireProcessor$1 () {
 
 	class Processor {
 	  constructor(plugins = []) {
-	    this.version = '8.5.19';
+	    this.version = '8.5.23';
 	    this.plugins = this.normalize(plugins);
 	  }
 
@@ -50951,7 +51048,7 @@ Upgrade your vite or vue-loader version for compatibility with the latest experi
   function registerUserImport(source2, local, imported, isType, isFromSetup, needTemplateUsageCheck) {
     let isUsedInTemplate = needTemplateUsageCheck;
     if (needTemplateUsageCheck && ctx.isTS && sfc.template && !sfc.template.src && !sfc.template.lang) {
-      isUsedInTemplate = isImportUsed(local, sfc);
+      isUsedInTemplate = isImportUsed(local, sfc, options.templateOptions);
     }
     ctx.userImports[local] = {
       isType,
@@ -51298,7 +51395,10 @@ const ${normalScriptDefaultVar} = ${defaultSpecifier.local.name}
     ctx.bindingMetadata[key] = setupBindings[key];
   }
   if (sfc.template && !sfc.template.src && sfc.template.ast) {
-    const vModelIds = resolveTemplateVModelIdentifiers(sfc);
+    const vModelIds = resolveTemplateVModelIdentifiers(
+      sfc,
+      options.templateOptions
+    );
     if (vModelIds.size) {
       const toDemote = /* @__PURE__ */ new Set();
       for (const id of vModelIds) {
@@ -51776,7 +51876,7 @@ var __spreadValues = (a, b) => {
     }
   return a;
 };
-const version = "3.5.40";
+const version = "3.5.41";
 const parseCache = parseCache$1;
 const errorMessages = __spreadValues(__spreadValues({}, errorMessages$1), DOMErrorMessages);
 const walk = walk$2;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vue/compiler-sfc",
-  "version": "3.5.40",
+  "version": "3.5.41",
   "description": "@vue/compiler-sfc",
   "main": "dist/compiler-sfc.cjs.js",
   "module": "dist/compiler-sfc.esm-browser.js",
@@ -42,26 +42,26 @@
   },
   "homepage": "https://github.com/vuejs/core/tree/main/packages/compiler-sfc#readme",
   "dependencies": {
-    "@babel/parser": "^7.29.7",
+    "@babel/parser": "^7.29.8",
     "estree-walker": "^2.0.2",
     "magic-string": "^0.30.21",
     "postcss": "^8.5.19",
     "source-map-js": "^1.2.1",
-    "@vue/compiler-core": "3.5.40",
-    "@vue/compiler-ssr": "3.5.40",
-    "@vue/compiler-dom": "3.5.40",
-    "@vue/shared": "3.5.40"
+    "@vue/compiler-core": "3.5.41",
+    "@vue/shared": "3.5.41",
+    "@vue/compiler-dom": "3.5.41",
+    "@vue/compiler-ssr": "3.5.41"
   },
   "devDependencies": {
-    "@babel/types": "^7.29.7",
+    "@babel/types": "^7.29.8",
     "@vue/consolidate": "^1.0.0",
     "hash-sum": "^2.0.0",
     "lru-cache": "10.1.0",
     "merge-source-map": "^1.1.0",
-    "minimatch": "~10.2.5",
+    "minimatch": "~10.2.6",
     "postcss-modules": "^6.0.1",
     "postcss-selector-parser": "^7.1.4",
     "pug": "^3.0.4",
-    "sass": "^1.101.0"
+    "sass": "^1.102.0"
   }
 }