vue
The progressive JavaScript framework for building modern web UI.
About
The progressive JavaScript framework for building modern web UI.
What detecting vue tells you about a site
vue marks a site built on the second-most-popular reactive framework, with a template-and-reactivity model distinct from React's. Its presence implies the surrounding stack is Vue-native — Pinia or Vuex for state, Vue Router for navigation, and very often Nuxt as the meta-framework sitting on top.
Why the exact vue version matters
Vue 2 and Vue 3 are effectively different frameworks: Vue 3's Composition API, `<script setup>`, and Proxy-based reactivity are a clean break from Vue 2's Options API. Vue 2 reached end-of-life at the end of 2023, so detecting a Vue 2 bundle flags an unmaintained, security-relevant dependency. The exact bundled version is the only reliable way to place a site on the right side of that line.
vue in a real-world stack
When you find vue in a bundle, it rarely travels alone. vue-router and pinia (or the older vuex), and commonly Nuxt for SSR.
Quick facts
npm install vueThis package powers Vue.js
The vue package is the canonical implementation of Vue.js. Sourcemap Explorer uses this exact npm package as the framework-level fingerprint when it flags Vue.js on a page — both via the bundled node_modules/vue/ source paths and via the embedded package.json inside the JavaScript sourcemap.
Common pairings
Packages this one expects to find in the same project. Each is also a Sourcemap Explorer detection target.
What vue pulls in
vue declares 5 direct dependencies — each one also rides into any bundle that ships vue, so they are detection targets too. Reading them is a quick way to understand the package's real footprint .
How Sourcemap Explorer detects vue
vue ships as v3.5.40, published 2026-07-16 and carries 5 direct dependencies, 1 peer dependency (typescript), 584 versions on the registry. Those exact numbers are the footprint Sourcemap Explorer matches when vue rides inside a deployed bundle — here is how the detection works.
We catch vue from two complementary signals: bundled source paths and the embedded package.json. Modern bundlers (webpack, Vite, esbuild, Rollup, Turbopack) preserve the original node_modules/vue/ paths inside the JavaScript sourcemap's sources[] array — that's the canonical signal. When the matching package.json is also captured in sourcesContent[], we read the exact version field — patch number included. No regex guessing, no version inference.
- 1
Confirm the site exposes sourcemaps
In DevTools Network, check the response headers of any application script for `SourceMap` or `X-SourceMap`. Failing that, fetch the script's last 4 KB and look for a `//# sourceMappingURL=` comment — that map is where the `vue` paths live.
- 2
Find the package in the bundle
Open DevTools → Network → reload. Click any application script and look at its sourcemap. Inside, search `sources[]` for entries matching `node_modules/vue/` — every match confirms the package is bundled. The matching `sourcesContent[i]` for `node_modules/vue/package.json` gives you the exact installed version.
- 3
Read the version directly from package.json
Run `jq -r '. as $m | $m.sources | to_entries[] | select(.value | endswith("node_modules/vue/package.json")) | $m.sourcesContent[.key] | fromjson | .version' bundle.js.map`. Sourcemap Explorer automates the same query in the popup.
Major releases of vue
When each major version first landed. Major bumps are where breaking changes live, so this timeline is the fastest way to date the vue version a site actually ships against the ecosystem.
Recent security advisories for vue
The 1 most recent advisories affecting some versions of vue, aggregated from OSV.dev (GitHub Advisory + CVE data). A listing here doesn't mean the version a given site ships is affected — each advisory applies to a specific version range. Sourcemap Explorer reads the exact bundled version so you can check it against these ranges.
ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function
Recent versions
vue README
Live mirror of the GitHub README, for reference. Updated whenever the repo's default branch changes.
vuejs/core 
Getting Started
Please follow the documentation at vuejs.org!
Sponsors
Vue.js is an MIT-licensed open source project with its ongoing development made possible entirely by the support of these awesome backers. If you'd like to join them, please consider sponsoring Vue's development.
Special Sponsor
Questions
For questions and support please use the official forum or community chat. The issue list of this repo is exclusively for bug reports and feature requests.
Issues
Please make sure to respect issue requirements and use the new issue helper when opening an issue. Issues not conforming to the guidelines may be closed immediately.
Stay In Touch
Contribution
Please make sure to read the Contributing Guide before making a pull request. If you have a Vue-related project/component/tool, add it with a pull request to this curated list!
Thank you to all the people who already contributed to Vue!
Note: Showing the first 500 contributors only due to GitHub image size limitations
License
Copyright (c) 2013-present, Yuxi (Evan) You
FAQ
What is vue used for?
The progressive JavaScript framework for building modern web UI.
How can I tell if a website is using vue?
Open the page in Chrome with the Sourcemap Explorer extension installed and read the Stack tab. We catch `vue` from two complementary signals: `node_modules/vue/` paths inside the JavaScript sourcemap, and the embedded `package.json` we read for exact-version detection. Without the extension you can do the same lookup manually in DevTools — the steps are listed in the "How Sourcemap Explorer detects" section above.
How do I find out which version of vue a website is running?
Read it straight from the site's JavaScript sourcemap. When a build ships source maps, the bundled `vue/package.json` carries the exact `version` string — Sourcemap Explorer extracts it in one click on the Stack tab, and you can do it by hand in DevTools by opening the `.map` file and searching for `node_modules/vue/package.json`. That is far more reliable than inferring the version from an asset-hash or a `?ver=` query string, which is all surface-level detectors have to go on. The current npm release is 3.5.40, but real deployments frequently run an older pinned version — which is exactly why reading the bundled number matters.
What is the latest version of vue?
3.5.40, as published on the npm registry. The "Recent versions" table on this page lists the most recent 8 releases with their release dates. Sourcemap Explorer reports the version actually bundled into a site, which can lag the latest release by months on real-world deployments.
Is vue actively maintained?
Very actively maintained — the last release shipped within the past three months. The last published release was 2026-07-16. Source code: https://github.com/vuejs/core.
What is the relationship between vue and Vue.js?
vue is the canonical npm package for Vue.js. Sourcemap Explorer treats finding `vue` in a bundle as the framework-level signal that Vue.js is on the page, and the page you're reading is the canonical Sourcemap Explorer entry for the package itself.
Does vue have known security vulnerabilities?
1 recent advisory affecting some versions of vue is listed in the "Recent security advisories" section above, aggregated from OSV.dev (GitHub Advisory + CVE data). Whether a particular site is exposed depends entirely on the exact version it ships — each advisory applies to a specific version range, not to the package as a whole. That is why the precise bundled version matters: Sourcemap Explorer reads the version a site actually runs, so you can check it against the affected ranges instead of assuming the latest release is what's deployed.
Where can I read more?
Project homepage: https://vuejs.org/. Source code: https://github.com/vuejs/core. Published on npm: https://www.npmjs.com/package/vue. Licensed as MIT.
Keep reading on Sourcemap Explorer
Detection deep dives
Alternative tools
Detected by Sourcemap Explorer
When a bundle ships sourcemaps, we read the embedded package.json for vue and report the precise version (the registry's latest is v3.5.40, published 2026-07-16; the bundled copy is often older). Without sourcemaps, an import / require in the page's scripts is enough to flag it.