@vue/compiler-sfc 3.5.43 → 3.5.44

package/dist/compiler-sfc.cjs.js

@@ -1,5 +1,5 @@
 /**
-* @vue/compiler-sfc v3.5.43
+* @vue/compiler-sfc v3.5.44
 * (c) 2018-present Yuxi (Evan) You and Vue contributors
 * @license MIT
 **/
@@ -25109,11 +25109,18 @@ function transformDestructuredProps(ctx, vueImportAliases) {
   const excludedIds = /* @__PURE__ */ new WeakSet();
   const parentStack = [];
   const propsLocalToPublicMap = /* @__PURE__ */ Object.create(null);
+  const modelOptionNodes = /* @__PURE__ */ new Set();
+  let currentModelOption = null;
   for (const key in ctx.propsDestructuredBindings) {
     const { local } = ctx.propsDestructuredBindings[key];
     rootScope[local] = true;
     propsLocalToPublicMap[local] = key;
   }
+  for (const { runtimeOptionNodes } of Object.values(ctx.modelDecls)) {
+    for (const node of runtimeOptionNodes) {
+      modelOptionNodes.add(node);
+    }
+  }
   function pushScope(isFunctionScope = false) {
     const scope = currentScope = Object.create(currentScope);
     scopeStack.push(scope);
@@ -25185,6 +25192,18 @@ function transformDestructuredProps(ctx, vueImportAliases) {
     });
   }
   function rewriteId(id, parent, parentStack2) {
+    if (currentModelOption) {
+      const isDefault = (currentModelOption.type === "ObjectProperty" || currentModelOption.type === "ObjectMethod") && resolveObjectKey(
+        currentModelOption.key,
+        currentModelOption.computed
+      ) === "default";
+      ctx.error(
+        `\`${DEFINE_MODEL}()\` prop options cannot reference destructured props because they are hoisted outside of the setup() function.` + (isDefault ? ` Use the props argument of the default factory instead, e.g. default: props => props${shared.genPropsAccessExp(
+          propsLocalToPublicMap[id.name]
+        ).slice(`__props`.length)}` : ``),
+        id
+      );
+    }
     if (parent.type === "AssignmentExpression" && id === parent.left || parent.type === "UpdateExpression") {
       ctx.error(`Cannot assign to destructured props as they are readonly.`, id);
     }
@@ -25223,6 +25242,9 @@ function transformDestructuredProps(ctx, vueImportAliases) {
       if (parent && parent.type.startsWith("TS") && !CompilerDOM.TS_NODE_TYPES.includes(parent.type)) {
         return this.skip();
       }
+      if (modelOptionNodes.has(node)) {
+        currentModelOption = node;
+      }
       checkUsage(node, "watch", vueImportAliases.watch);
       checkUsage(node, "toRef", vueImportAliases.toRef);
       if (CompilerDOM.isFunctionType(node)) {
@@ -25268,6 +25290,9 @@ function transformDestructuredProps(ctx, vueImportAliases) {
     },
     leave(node, parent) {
       parent && parentStack.pop();
+      if (node === currentModelOption) {
+        currentModelOption = null;
+      }
       if (CompilerDOM.isFunctionType(node)) {
         popScope(true);
       } else if (node.type === "BlockStatement" && !CompilerDOM.isFunctionType(parent)) {
@@ -26371,7 +26396,7 @@ function mergeSourceMaps(scriptMap, templateMap, templateLineOffset) {
   return generator.toJSON();
 }
 
-const version = "3.5.43";
+const version = "3.5.44";
 const parseCache = parseCache$1;
 const errorMessages = {
   ...CompilerDOM.errorMessages,

package/dist/compiler-sfc.esm-browser.js

@@ -1,5 +1,5 @@
 /**
-* @vue/compiler-sfc v3.5.43
+* @vue/compiler-sfc v3.5.44
 * (c) 2018-present Yuxi (Evan) You and Vue contributors
 * @license MIT
 **/
@@ -214,7 +214,7 @@ const isSVGTag = /* @__PURE__ */ makeMap(SVG_TAGS);
 const isMathMLTag = /* @__PURE__ */ makeMap(MATH_TAGS);
 const isVoidTag = /* @__PURE__ */ makeMap(VOID_TAGS);
 
-const specialBooleanAttrs = `itemscope,allowfullscreen,formnovalidate,ismap,nomodule,novalidate,readonly`;
+const specialBooleanAttrs = `itemscope,allowfullscreen,formnovalidate,ismap,nomodule,novalidate,playsinline,readonly`;
 const isBooleanAttr = /* @__PURE__ */ makeMap(
   specialBooleanAttrs + `,async,autofocus,autoplay,controls,default,defer,disabled,inert,loop,open,required,reversed,scoped,seamless,checked,muted,multiple,selected`
 );
@@ -4474,7 +4474,8 @@ const errorMessages$1 = {
   [42]: `v-model value must be a valid JavaScript member expression.`,
   [43]: `v-model cannot be used on v-for or v-slot scope variables because they are not writable.`,
   [44]: `v-model cannot be used on a prop, because local prop bindings are not writable.
-Use a v-bind binding combined with a v-on listener that emits update:x event instead.`,
+Use a v-bind binding combined with a v-on listener that emits update:x event instead.
+For props declared with defineModel(), assign the returned ref to a variable and use v-model on that variable.`,
   [45]: `v-model cannot be used on a const binding because it is not writable.`,
   [46]: `Error parsing JavaScript expression: `,
   [47]: `<KeepAlive> expects exactly one child component.`,
@@ -7578,13 +7579,15 @@ function requireLib () {
 	    const arrows = [];
 	    while (stack.length !== 0) {
 	      const node = stack.pop();
-	      if (node.type === "ArrowFunctionExpression" && node.body.type !== "BlockStatement") {
+	      if (node.type === "ArrowFunctionExpression") {
 	        if (node.typeParameters || !node.returnType) {
 	          this.finishArrowValidation(node);
 	        } else {
 	          arrows.push(node);
 	        }
-	        stack.push(node.body);
+	        if (node.body.type !== "BlockStatement") {
+	          stack.push(node.body);
+	        }
 	      } else if (node.type === "ConditionalExpression") {
 	        stack.push(node.consequent);
 	        stack.push(node.alternate);
@@ -14754,8 +14757,11 @@ function requireLib () {
 	    }
 	  }
 	  fillOptionalPropertiesForTSESLint(node) {
-	    var _node$directive, _node$decorators, _node$optional, _node$typeAnnotation, _node$accessibility, _node$decorators2, _node$override, _node$readonly, _node$static, _node$declare, _node$returnType, _node$typeParameters, _node$optional2, _node$optional3, _node$accessibility2, _node$readonly2, _node$static2, _node$declare2, _node$definite, _node$readonly3, _node$typeAnnotation2, _node$accessibility3, _node$decorators3, _node$override2, _node$optional4, _node$id, _node$abstract, _node$declare3, _node$decorators4, _node$implements, _node$superTypeArgume, _node$typeParameters2, _node$declare4, _node$definite2, _node$const, _node$declare5, _node$computed, _node$qualifier, _node$options, _node$declare6, _node$extends, _node$optional5, _node$readonly4, _node$declare7, _node$global, _node$const2, _node$in, _node$out;
+	    var _node$phase, _node$directive, _node$decorators, _node$optional, _node$typeAnnotation, _node$accessibility, _node$decorators2, _node$override, _node$readonly, _node$static, _node$declare, _node$returnType, _node$typeParameters, _node$optional2, _node$optional3, _node$accessibility2, _node$readonly2, _node$static2, _node$declare2, _node$definite, _node$readonly3, _node$typeAnnotation2, _node$accessibility3, _node$decorators3, _node$override2, _node$optional4, _node$id, _node$abstract, _node$declare3, _node$decorators4, _node$implements, _node$superTypeArgume, _node$typeParameters2, _node$declare4, _node$definite2, _node$const, _node$declare5, _node$computed, _node$qualifier, _node$options, _node$declare6, _node$extends, _node$optional5, _node$readonly4, _node$declare7, _node$global, _node$const2, _node$in, _node$out;
 	    switch (node.type) {
+	      case "ImportDeclaration":
+	        (_node$phase = node.phase) != null ? _node$phase : node.phase = null;
+	        return;
 	      case "ExpressionStatement":
 	        (_node$directive = node.directive) != null ? _node$directive : node.directive = undefined;
 	        return;
@@ -22808,10 +22814,12 @@ function requireSourceMapGenerator$1 () {
 
 	      if (mapping.generatedLine !== previousGeneratedLine) {
 	        previousGeneratedColumn = 0;
-	        while (mapping.generatedLine !== previousGeneratedLine) {
-	          next += ';';
-	          previousGeneratedLine++;
-	        }
+	        // One ';' per skipped line. Build large gaps with a single flat
+	        // string: appending ';' one by one creates a rope node per line, which
+	        // can exhaust the heap for a big gap (CVE-2026-93749).
+	        var lineDelta = mapping.generatedLine - previousGeneratedLine;
+	        next += lineDelta === 1 ? ';' : ';'.repeat(lineDelta);
+	        previousGeneratedLine = mapping.generatedLine;
 	      }
 	      else {
 	        if (i > 0) {
@@ -23153,6 +23161,15 @@ function requireQuickSort$1 () {
 	  return templateFn(comparator);
 	}
 
+	let isEvalAllowed = (function () {
+	  try {
+	    new Function('return 0')();
+	    return true;
+	  } catch {
+	    return false;
+	  }
+	})();
+
 	/**
 	 * Sort the given array in-place with the given comparator function.
 	 *
@@ -23164,7 +23181,7 @@ function requireQuickSort$1 () {
 
 	let sortCache = new WeakMap();
 	quickSort$1.quickSort = function (ary, comparator, start = 0) {
-	  let doQuickSort = sortCache.get(comparator);
+	  let doQuickSort = isEvalAllowed ? sortCache.get(comparator) : SortTemplate();
 	  if (doQuickSort === void 0) {
 	    doQuickSort = cloneSort(comparator);
 	    sortCache.set(comparator, doQuickSort);
@@ -23193,6 +23210,14 @@ function requireSourceMapConsumer$1 () {
 	var base64VLQ = /*@__PURE__*/ requireBase64Vlq$1();
 	var quickSort = /*@__PURE__*/ requireQuickSort$1().quickSort;
 
+	// Upper bound for a section's `offset.line` in an indexed source map. A flat
+	// map spends one ';' per generated line, so a tiny indexed map with a huge
+	// offset.line turns into a huge amount of work and memory once its mappings
+	// are copied into a SourceMapGenerator (CVE-2026-93749). Ten million lines is
+	// far beyond any real generated file. Columns are VLQ-encoded as deltas and
+	// don't amplify, so they only need to be valid integers.
+	var MAX_SECTION_OFFSET_LINE = 1e7;
+
 	function SourceMapConsumer(aSourceMap, aSourceMapURL) {
 	  var sourceMap = aSourceMap;
 	  if (typeof aSourceMap === 'string') {
@@ -24116,6 +24141,7 @@ function requireSourceMapConsumer$1 () {
 	    line: -1,
 	    column: 0
 	  };
+	  var maxOffsetLine = 0;
 	  this._sections = sections.map(function (s) {
 	    if (s.url) {
 	      // The url field will require support for asynchronicity.
@@ -24126,12 +24152,32 @@ function requireSourceMapConsumer$1 () {
 	    var offsetLine = util.getArg(offset, 'line');
 	    var offsetColumn = util.getArg(offset, 'column');
 
+	    if (!isValidOffset(offsetLine) || !isValidOffset(offsetColumn)) {
+	      throw new Error('Section offset line and column must be non-negative integers.');
+	    }
+	    if (offsetLine > MAX_SECTION_OFFSET_LINE) {
+	      throw new Error('Section offset line must not exceed ' + MAX_SECTION_OFFSET_LINE + '.');
+	    }
+
 	    if (offsetLine < lastOffset.line ||
 	        (offsetLine === lastOffset.line && offsetColumn < lastOffset.column)) {
 	      throw new Error('Section offsets must be ordered and non-overlapping.');
 	    }
 	    lastOffset = offset;
 
+	    var consumer = new SourceMapConsumer(util.getArg(s, 'map'), aSourceMapURL);
+
+	    // Offsets of a nested indexed map add up with this one, so apply the
+	    // bound to the total.
+	    var totalOffsetLine = offsetLine + (consumer._maxOffsetLine || 0);
+	    if (totalOffsetLine > MAX_SECTION_OFFSET_LINE) {
+	      throw new Error('Section offset line must not exceed ' + MAX_SECTION_OFFSET_LINE +
+	                      ', including offsets of nested sections.');
+	    }
+	    if (totalOffsetLine > maxOffsetLine) {
+	      maxOffsetLine = totalOffsetLine;
+	    }
+
 	    return {
 	      generatedOffset: {
 	        // The offset fields are 0-based, but we use 1-based indices when
@@ -24139,9 +24185,24 @@ function requireSourceMapConsumer$1 () {
 	        generatedLine: offsetLine + 1,
 	        generatedColumn: offsetColumn + 1
 	      },
-	      consumer: new SourceMapConsumer(util.getArg(s, 'map'), aSourceMapURL)
+	      consumer: consumer
 	    }
 	  });
+
+	  // The largest offset.line of any section, including nested sections.
+	  this._maxOffsetLine = maxOffsetLine;
+	}
+
+	/**
+	 * Section offsets come from untrusted input and are used as line/column
+	 * numbers, so only accept non-negative safe integers (rejects NaN, Infinity,
+	 * strings, fractions, etc).
+	 */
+	function isValidOffset(aValue) {
+	  return typeof aValue === 'number' &&
+	    aValue >= 0 &&
+	    aValue <= 9007199254740991 && // Number.MAX_SAFE_INTEGER
+	    Math.floor(aValue) === aValue;
 	}
 
 	IndexedSourceMapConsumer.prototype = Object.create(SourceMapConsumer.prototype);
@@ -24159,8 +24220,12 @@ function requireSourceMapConsumer$1 () {
 	  get: function () {
 	    var sources = [];
 	    for (var i = 0; i < this._sections.length; i++) {
-	      for (var j = 0; j < this._sections[i].consumer.sources.length; j++) {
-	        sources.push(this._sections[i].consumer.sources[j]);
+	      // Read the getter once per section: for a nested indexed map it is
+	      // itself this getter, and re-reading it per item is exponential in the
+	      // nesting depth (CVE-2026-93749).
+	      var sectionSources = this._sections[i].consumer.sources;
+	      for (var j = 0; j < sectionSources.length; j++) {
+	        sources.push(sectionSources[j]);
 	      }
 	    }
 	    return sources;
@@ -24493,6 +24558,13 @@ function requireSourceNode$1 () {
 	      // to the SourceNode without any mapping.
 	      // Each line is added as separate string.
 	      while (lastGeneratedLine < mapping.generatedLine) {
+	        if (remainingLinesIndex >= remainingLines.length) {
+	          // The generated code is exhausted. Skip the rest instead of adding
+	          // empty lines one by one: a mapping may point far past the end of
+	          // the code (e.g. an indexed map section with a huge offset.line).
+	          lastGeneratedLine = mapping.generatedLine;
+	          break;
+	        }
 	        node.add(shiftNextLine());
 	        lastGeneratedLine++;
 	      }
@@ -26151,7 +26223,7 @@ const transformFor = createStructuralDirectiveTransform(
             createCompoundExpression([`const _memo = (`, memo.exp, `)`]),
             createCompoundExpression([
               `if (_cached && _cached.el`,
-              ...keyExp ? [` && _cached.key === `, keyExp] : [],
+              ...keyExp ? [` && _cached.key === (`, keyExp, `)`] : [],
               ` && ${context.helperString(
                 IS_MEMO_SAME
               )}(_cached, _memo)) return _cached`
@@ -28093,7 +28165,8 @@ const transformTransition = (node, context) => {
         if (!node.children.length) {
           return;
         }
-        if (hasMultipleChildren(node)) {
+        const multipleChildren = hasMultipleChildren(node);
+        if (multipleChildren) {
           context.onError(
             createDOMCompilerError(
               63,
@@ -28288,8 +28361,9 @@ function stringifyNode(node, context) {
   }
 }
 function stringifyElement(node, context) {
+  var _a;
   let res = `<${node.tag}`;
-  let innerHTML = "";
+  let innerHTML = void 0;
   for (let i = 0; i < node.props.length; i++) {
     const p = node.props[i];
     if (p.type === 6) {
@@ -28323,7 +28397,7 @@ function stringifyElement(node, context) {
           )}"`;
         }
       } else if (p.name === "html") {
-        innerHTML = evaluateConstant(p.exp);
+        innerHTML = (_a = evaluateConstant(p.exp)) != null ? _a : "";
       } else if (p.name === "text") {
         innerHTML = escapeHtml(
           toDisplayString(evaluateConstant(p.exp))
@@ -28335,7 +28409,7 @@ function stringifyElement(node, context) {
     res += ` ${context.scopeId}`;
   }
   res += `>`;
-  if (innerHTML) {
+  if (innerHTML !== void 0) {
     res += innerHTML;
   } else {
     for (let i = 0; i < node.children.length; i++) {
@@ -28557,7 +28631,8 @@ const validateHtmlNesting = (node, context) => {
 
 const DOMNodeTransforms = [
   transformStyle,
-  ...[transformTransition, validateHtmlNesting] 
+  transformTransition,
+  ...[validateHtmlNesting] 
 ];
 const DOMDirectiveTransforms = {
   cloak: noopDirectiveTransform,
@@ -34462,22 +34537,10 @@ function requireStringifier () {
 	if (hasRequiredStringifier) return stringifier;
 	hasRequiredStringifier = 1;
 
-	// Escapes sequences that could break out of an HTML <style> context.
-	// Uses CSS unicode escaping (\3c = '<') which is valid CSS and parsed
-	// correctly by all compliant CSS consumers.
-	const STYLE_TAG = /(<)(\/?style\b)/gi;
-	const COMMENT_OPEN = /(<)(!--)/g;
-
 	// Characters that end an at-rule name, mirroring RE_AT_END in the tokenizer.
 	// Params starting with anything else need a space to stay separate tokens.
 	const AT_NAME_END = /[\t\n\f\r "#'()/;[\\\]{}]/;
 
-	function escapeHTMLInCSS(str) {
-	  if (typeof str !== 'string') return str
-	  if (!str.includes('<')) return str
-	  return str.replace(STYLE_TAG, '\\3c $2').replace(COMMENT_OPEN, '\\3c $2')
-	}
-
 	const DEFAULT_RAW = {
 	  after: '\n',
 	  beforeClose: '\n',
@@ -34512,11 +34575,12 @@ function requireStringifier () {
 	}
 
 	// `*--x` is not a custom property: the parser checks the first token, and the
-	// `*`/`_` hack prefix moves from `prop` into `before` only after that.
+	// `*`/`_` hack prefix moves from `prop` into `before` only after that. A free
+	// semicolon in front of the declaration also ends up in `before`.
 	function isCustomProperty(node) {
 	  if (!node.prop.startsWith('--')) return false
 	  let before = node.raws.before;
-	  return typeof before === 'undefined' || !/\S$/.test(before)
+	  return typeof before === 'undefined' || !/[^\s;]$/.test(before)
 	}
 
 	function pushBody(str, stack, node) {
@@ -34554,17 +34618,17 @@ function requireStringifier () {
 
 	function pushBlock(str, stack, node, start) {
 	  let between = str.raw(node, 'between', 'beforeOpen');
-	  str.builder(escapeHTMLInCSS(start + between) + '{', node, 'start');
+	  str.builder(start + between + '{', node, 'start');
 
 	  let hasNodes = node.nodes && node.nodes.length;
 	  let close = () => {
 	    let after = hasNodes
 	      ? str.raw(node, 'after')
 	      : str.raw(node, 'after', 'emptyBody');
-	    if (after) str.builder(escapeHTMLInCSS(after));
+	    if (after) str.builder(after);
 	    str.builder('}', node, 'end');
 	    if (node.type === 'rule' && node.raws.ownSemicolon) {
-	      str.builder(escapeHTMLInCSS(node.raws.ownSemicolon), node, 'end');
+	      str.builder(node.raws.ownSemicolon, node, 'end');
 	    }
 	  };
 
@@ -34587,7 +34651,7 @@ function requireStringifier () {
 	      this.block(node, start);
 	    } else {
 	      let end = (node.raws.between || '') + (semicolon ? ';' : '');
-	      this.builder(escapeHTMLInCSS(start + end), node);
+	      this.builder(start + end, node);
 	    }
 	  }
 
@@ -34622,7 +34686,7 @@ function requireStringifier () {
 
 	  block(node, start) {
 	    let between = this.raw(node, 'between', 'beforeOpen');
-	    this.builder(escapeHTMLInCSS(start + between) + '{', node, 'start');
+	    this.builder(start + between + '{', node, 'start');
 
 	    let after;
 	    if (node.nodes && node.nodes.length) {
@@ -34632,7 +34696,7 @@ function requireStringifier () {
 	      after = this.raw(node, 'after', 'emptyBody');
 	    }
 
-	    if (after) this.builder(escapeHTMLInCSS(after));
+	    if (after) this.builder(after);
 	    this.builder('}', node, 'end');
 	  }
 
@@ -34659,7 +34723,7 @@ function requireStringifier () {
 	      let child = entry.node;
 	      let before = this.raw(child, 'before');
 	      if (before) {
-	        this.builder(entry.document ? before : escapeHTMLInCSS(before));
+	        this.builder(before);
 	      }
 
 	      if (expandable && child.type === 'rule') {
@@ -34675,7 +34739,7 @@ function requireStringifier () {
 	  comment(node) {
 	    let left = this.raw(node, 'left', 'commentLeft');
 	    let right = this.raw(node, 'right', 'commentRight');
-	    this.builder(escapeHTMLInCSS('/*' + left + node.text + right + '*/'), node);
+	    this.builder('/*' + left + node.text + right + '*/', node);
 	  }
 
 	  decl(node, semicolon) {
@@ -34689,7 +34753,7 @@ function requireStringifier () {
 	    }
 
 	    if (semicolon) string += ';';
-	    this.builder(escapeHTMLInCSS(string), node);
+	    this.builder(string, node);
 	  }
 
 	  document(node) {
@@ -34894,21 +34958,20 @@ function requireStringifier () {
 	  }
 
 	  root(node) {
-	    if (node.source && node.source.input.hasBOM) {
+	    let inDocument = node.parent && node.parent.type === 'document';
+	    if (!inDocument && node.source && node.source.input.hasBOM) {
 	      this.builder('\uFEFF', node, 'start');
 	    }
 	    this.body(node);
 	    if (node.raws.after) {
-	      let after = node.raws.after;
-	      let isDocument = node.parent && node.parent.type === 'document';
-	      this.builder(isDocument ? after : escapeHTMLInCSS(after));
+	      this.builder(node.raws.after);
 	    }
 	  }
 
 	  rule(node) {
 	    this.block(node, this.rawValue(node, 'selector'));
 	    if (node.raws.ownSemicolon) {
-	      this.builder(escapeHTMLInCSS(node.raws.ownSemicolon), node, 'end');
+	      this.builder(node.raws.ownSemicolon, node, 'end');
 	    }
 	  }
 
@@ -34941,9 +35004,67 @@ function requireStringify () {
 
 	let Stringifier = /*@__PURE__*/ requireStringifier();
 
+	const STYLE_TAG = /(<)(\/?style\b)/gi;
+	const COMMENT_OPEN = /(<)(!--)/g;
+
+	function escapeHTMLInCSS(str) {
+	  if (!str.includes('<')) return str
+	  return str.replace(STYLE_TAG, '\\3c $2').replace(COMMENT_OPEN, '\\3c $2')
+	}
+
+	class SafeStringifier extends Stringifier {
+	  escapeHTML(node, print) {
+	    let builder = this.builder;
+	    let chunks, css;
+	    this.builder = (str, child, type) => {
+	      if (chunks) {
+	        css += str;
+	        chunks.push(str, child, type);
+	      } else if (str.includes('<')) {
+	        // Dangerous sequences start with `<`, so everything before
+	        // the first `<` is safe to pass through. The rest is buffered
+	        // to escape it as a whole.
+	        css = str;
+	        chunks = [str, child, type];
+	      } else {
+	        builder(str, child, type);
+	      }
+	    };
+	    print();
+	    this.builder = builder;
+	    if (!chunks) return
+
+	    let escaped = escapeHTMLInCSS(css);
+	    if (escaped === css) {
+	      // Keep the chunks to get a precise source map
+	      for (let i = 0; i < chunks.length; i += 3) {
+	        builder(chunks[i], chunks[i + 1], chunks[i + 2]);
+	      }
+	    } else {
+	      // Escaping happens only on a hack attempt, source map is not important
+	      builder(escaped, node);
+	    }
+	  }
+
+	  root(node) {
+	    if (node.parent && node.parent.type === 'document') {
+	      // Document raws around the Root hold markup and are kept as is since CSS in Document can be marked with <style>
+	      this.escapeHTML(node, () => this.body(node));
+	      if (node.raws.after) this.builder(node.raws.after);
+	    } else {
+	      this.escapeHTML(node, () => super.root(node));
+	    }
+	  }
+	}
+
 	function stringify(node, builder) {
-	  let str = new Stringifier(builder);
-	  str.stringify(node);
+	  let str = new SafeStringifier(builder);
+	  // Root escapes its own output and keeps markup in Document raws
+	  if (node.type === 'root' || node.type === 'document') {
+	    str.stringify(node);
+	  } else {
+	    str.escapeHTML(node, () => str.stringify(node));
+	  }
 	}
 
 	stringify_1 = stringify;
@@ -36716,8 +36837,21 @@ function requireList () {
 	    let inQuote = false;
 	    let prevQuote = '';
 	    let escape = false;
+	    let inComment = false;
+
+	    for (let i = 0; i < string.length; i++) {
+	      let letter = string[i];
+
+	      if (inComment) {
+	        current += letter;
+	        if (letter === '*' && string[i + 1] === '/') {
+	          current += '/';
+	          i += 1;
+	          inComment = false;
+	        }
+	        continue
+	      }
 
-	    for (let letter of string) {
 	      if (escape) {
 	        escape = false;
 	      } else if (letter === '\\') {
@@ -36729,6 +36863,11 @@ function requireList () {
 	      } else if (letter === '"' || letter === "'") {
 	        inQuote = true;
 	        prevQuote = letter;
+	      } else if (letter === '/' && string[i + 1] === '*') {
+	        current += '/*';
+	        i += 1;
+	        inComment = true;
+	        continue
 	      } else if (letter === '(') {
 	        func += 1;
 	      } else if (letter === ')') {
@@ -36990,16 +37129,22 @@ function requireMapGenerator () {
 	        }
 	      }
 	    } else if (this.css) {
+	      // Single forward pass. Removing every annotation from the whole
+	      // string separately would be O(n^2) on many annotations.
 	      let annotation = '/*# sourceMappingURL=';
+	      let css = '';
+	      let cursor = 0;
 	      let startIndex;
-	      while ((startIndex = this.css.lastIndexOf(annotation)) !== -1) {
+	      while ((startIndex = this.css.indexOf(annotation, cursor)) !== -1) {
 	        let endIndex = this.css.indexOf('*/', startIndex + annotation.length);
 	        if (endIndex === -1) break
-	        while (startIndex > 0 && this.css[startIndex - 1] === '\n') {
+	        while (startIndex > cursor && this.css[startIndex - 1] === '\n') {
 	          startIndex--;
 	        }
-	        this.css = this.css.slice(0, startIndex) + this.css.slice(endIndex + 2);
+	        css += this.css.slice(cursor, startIndex);
+	        cursor = endIndex + 2;
 	      }
+	      if (cursor > 0) this.css = css + this.css.slice(cursor);
 	    }
 	  }
 
@@ -37794,6 +37939,9 @@ function requireParser$1 () {
 	    let token, type;
 	    let length = tokens.length;
 	    let value = '';
+	    // Last character of `value`. Reading it from `value` would flatten
+	    // the string concatenation on every comment and make parsing O(n^2).
+	    let last = '';
 	    let clean = true;
 	    let next, prev;
 
@@ -37806,16 +37954,18 @@ function requireParser$1 () {
 	        prev = tokens[i - 1] ? tokens[i - 1][0] : 'empty';
 	        next = tokens[i + 1] ? tokens[i + 1][0] : 'empty';
 	        if (!SAFE_COMMENT_NEIGHBOR[prev] && !SAFE_COMMENT_NEIGHBOR[next]) {
-	          if (value.slice(-1) === ',') {
+	          if (last === ',') {
 	            clean = false;
 	          } else {
 	            value += token[1];
+	            last = token[1].slice(-1);
 	          }
 	        } else {
 	          clean = false;
 	        }
 	      } else {
 	        value += token[1];
+	        last = token[1].slice(-1);
 	      }
 	    }
 	    if (!clean) {
@@ -38892,7 +39042,7 @@ function requireProcessor$1 () {
 
 	class Processor {
 	  constructor(plugins = []) {
-	    this.version = '8.5.28';
+	    this.version = '8.5.29';
 	    this.plugins = this.normalize(plugins);
 	  }
 
@@ -50742,11 +50892,18 @@ function transformDestructuredProps(ctx, vueImportAliases) {
   const excludedIds = /* @__PURE__ */ new WeakSet();
   const parentStack = [];
   const propsLocalToPublicMap = /* @__PURE__ */ Object.create(null);
+  const modelOptionNodes = /* @__PURE__ */ new Set();
+  let currentModelOption = null;
   for (const key in ctx.propsDestructuredBindings) {
     const { local } = ctx.propsDestructuredBindings[key];
     rootScope[local] = true;
     propsLocalToPublicMap[local] = key;
   }
+  for (const { runtimeOptionNodes } of Object.values(ctx.modelDecls)) {
+    for (const node of runtimeOptionNodes) {
+      modelOptionNodes.add(node);
+    }
+  }
   function pushScope(isFunctionScope = false) {
     const scope = currentScope = Object.create(currentScope);
     scopeStack.push(scope);
@@ -50818,6 +50975,18 @@ function transformDestructuredProps(ctx, vueImportAliases) {
     });
   }
   function rewriteId(id, parent, parentStack2) {
+    if (currentModelOption) {
+      const isDefault = (currentModelOption.type === "ObjectProperty" || currentModelOption.type === "ObjectMethod") && resolveObjectKey(
+        currentModelOption.key,
+        currentModelOption.computed
+      ) === "default";
+      ctx.error(
+        `\`${DEFINE_MODEL}()\` prop options cannot reference destructured props because they are hoisted outside of the setup() function.` + (isDefault ? ` Use the props argument of the default factory instead, e.g. default: props => props${genPropsAccessExp(
+          propsLocalToPublicMap[id.name]
+        ).slice(`__props`.length)}` : ``),
+        id
+      );
+    }
     if (parent.type === "AssignmentExpression" && id === parent.left || parent.type === "UpdateExpression") {
       ctx.error(`Cannot assign to destructured props as they are readonly.`, id);
     }
@@ -50856,6 +51025,9 @@ function transformDestructuredProps(ctx, vueImportAliases) {
       if (parent && parent.type.startsWith("TS") && !TS_NODE_TYPES.includes(parent.type)) {
         return this.skip();
       }
+      if (modelOptionNodes.has(node)) {
+        currentModelOption = node;
+      }
       checkUsage(node, "watch", vueImportAliases.watch);
       checkUsage(node, "toRef", vueImportAliases.toRef);
       if (isFunctionType(node)) {
@@ -50901,6 +51073,9 @@ function transformDestructuredProps(ctx, vueImportAliases) {
     },
     leave(node, parent) {
       parent && parentStack.pop();
+      if (node === currentModelOption) {
+        currentModelOption = null;
+      }
       if (isFunctionType(node)) {
         popScope(true);
       } else if (node.type === "BlockStatement" && !isFunctionType(parent)) {
@@ -52034,7 +52209,7 @@ var __spreadValues = (a, b) => {
     }
   return a;
 };
-const version = "3.5.43";
+const version = "3.5.44";
 const parseCache = parseCache$1;
 const errorMessages = __spreadValues(__spreadValues({}, errorMessages$1), DOMErrorMessages);
 const walk = walk$2;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vue/compiler-sfc",
-  "version": "3.5.43",
+  "version": "3.5.44",
   "description": "@vue/compiler-sfc",
   "main": "dist/compiler-sfc.cjs.js",
   "module": "dist/compiler-sfc.esm-browser.js",
@@ -42,15 +42,15 @@
   },
   "homepage": "https://github.com/vuejs/core/tree/main/packages/compiler-sfc#readme",
   "dependencies": {
-    "@babel/parser": "^7.29.8",
-    "@vue/compiler-core": "3.5.43",
-    "@vue/compiler-dom": "3.5.43",
-    "@vue/compiler-ssr": "3.5.43",
-    "@vue/shared": "3.5.43",
+    "@babel/parser": "^7.29.9",
+    "@vue/compiler-core": "3.5.44",
+    "@vue/compiler-dom": "3.5.44",
+    "@vue/compiler-ssr": "3.5.44",
+    "@vue/shared": "3.5.44",
     "estree-walker": "^2.0.2",
     "magic-string": "^0.30.21",
-    "postcss": "^8.5.28",
-    "source-map-js": "^1.2.1"
+    "postcss": "^8.5.29",
+    "source-map-js": "^1.2.2"
   },
   "devDependencies": {
     "@babel/types": "^7.29.8",
@@ -62,6 +62,6 @@
     "postcss-modules": "^6.0.1",
     "postcss-selector-parser": "^7.1.6",
     "pug": "^3.0.4",
-    "sass": "^1.104.1"
+    "sass": "^1.105.1"
   }
 }