fix(server-renderer): use ssrRenderClass helper for className attribute by edison1105 · Pull Request #14327 · vuejs/core

edison1105 · 2026-01-16T09:21:38Z

fix https://github.com/vuejs/core/security/advisories/GHSA-5c3j-59mh-x5gj

Summary by CodeRabbit

Bug Fixes
- Server-side rendering now treats class and className consistently and normalizes values for correct HTML output.
- Array class values are rendered with space-separated tokens (e.g., class="foo bar" instead of class="foo,bar"), avoiding malformed class attributes.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

coderabbitai · 2026-01-16T09:21:51Z

📝 Walkthrough

Walkthrough

Unified server-side rendering handling of class/className to use ssrRenderClass() for normalization and escaping; tests updated to expect space-separated class lists for array inputs.

Changes

Cohort / File(s)	Summary
Server-Renderer Attribute Handling `packages/server-renderer/src/helpers/ssrRenderAttrs.ts`	Replaced special-case `className` coercion with `ssrRenderClass(value)` so both `class` and `className` use the same normalization/escaping path.
Tests `packages/server-renderer/__tests__/ssrRenderAttrs.spec.ts`	Updated test expectation: arrays for `className` now render as space-separated values (e.g., `class="foo bar"`) instead of comma-separated.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Suggested labels

hammer: p3-minor-bug

Suggested reviewers

johnsoncodehk

Poem

🐰 I nibbled code beneath the moon,
I hopped in lines and hummed a tune,
I stitched class names, neat and true,
Spaces now where commas flew,
A tiny hop — the render's new! 🥕

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: using ssrRenderClass helper for className attribute handling in server-side rendering.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

📝 Generate docstrings

📜 Recent review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 9ddfe25 and fdcd994.

📒 Files selected for processing (2)

packages/server-renderer/__tests__/ssrRenderAttrs.spec.ts
packages/server-renderer/src/helpers/ssrRenderAttrs.ts

🚧 Files skipped from review as they are similar to previous changes (1)

packages/server-renderer/src/helpers/ssrRenderAttrs.ts

🔇 Additional comments (1)

packages/server-renderer/__tests__/ssrRenderAttrs.spec.ts (1)

147-157: LGTM — updated expectation matches normalized class rendering.

_{✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

fix https://github.com/vuejs/core/security/advisories/GHSA-5c3j-59mh-x5gj

github-actions · 2026-01-16T09:25:34Z

Size Report

Bundles

File	Size	Gzip	Brotli
runtime-dom.global.prod.js	103 kB	39.1 kB	35.2 kB
vue.global.prod.js	161 kB	59.1 kB	52.6 kB

Usages

Name	Size	Gzip	Brotli
createApp (CAPI only)	47 kB	18.4 kB	16.8 kB
createApp	55.2 kB	21.4 kB	19.6 kB
createSSRApp	59.4 kB	23.2 kB	21.1 kB
defineCustomElement	60.7 kB	23.1 kB	21.1 kB
overall	69.5 kB	26.7 kB	24.3 kB

pkg-pr-new · 2026-01-16T09:28:09Z

Open in StackBlitz

@vue/compiler-core

pnpm add https://pkg.pr.new/@vue/compiler-core@14327

npm i https://pkg.pr.new/@vue/compiler-core@14327

yarn add https://pkg.pr.new/@vue/[email protected]

@vue/compiler-dom

pnpm add https://pkg.pr.new/@vue/compiler-dom@14327

npm i https://pkg.pr.new/@vue/compiler-dom@14327

yarn add https://pkg.pr.new/@vue/[email protected]

@vue/compiler-sfc

pnpm add https://pkg.pr.new/@vue/compiler-sfc@14327

npm i https://pkg.pr.new/@vue/compiler-sfc@14327

yarn add https://pkg.pr.new/@vue/[email protected]

@vue/compiler-ssr

pnpm add https://pkg.pr.new/@vue/compiler-ssr@14327

npm i https://pkg.pr.new/@vue/compiler-ssr@14327

yarn add https://pkg.pr.new/@vue/[email protected]

@vue/reactivity

pnpm add https://pkg.pr.new/@vue/reactivity@14327

npm i https://pkg.pr.new/@vue/reactivity@14327

yarn add https://pkg.pr.new/@vue/[email protected]

@vue/runtime-core

pnpm add https://pkg.pr.new/@vue/runtime-core@14327

npm i https://pkg.pr.new/@vue/runtime-core@14327

yarn add https://pkg.pr.new/@vue/[email protected]

@vue/runtime-dom

pnpm add https://pkg.pr.new/@vue/runtime-dom@14327

npm i https://pkg.pr.new/@vue/runtime-dom@14327

yarn add https://pkg.pr.new/@vue/[email protected]

@vue/server-renderer

pnpm add https://pkg.pr.new/@vue/server-renderer@14327

npm i https://pkg.pr.new/@vue/server-renderer@14327

yarn add https://pkg.pr.new/@vue/[email protected]

@vue/shared

pnpm add https://pkg.pr.new/@vue/shared@14327

npm i https://pkg.pr.new/@vue/shared@14327

yarn add https://pkg.pr.new/@vue/[email protected]

vue

pnpm add https://pkg.pr.new/vue@14327

npm i https://pkg.pr.new/vue@14327

yarn add https://pkg.pr.new/[email protected]

@vue/compat

pnpm add https://pkg.pr.new/@vue/compat@14327

npm i https://pkg.pr.new/@vue/compat@14327

yarn add https://pkg.pr.new/@vue/[email protected]

commit: fdcd994

fix(server-renderer): use ssrRenderClass helper for className attribute

fdcd994

fix https://github.com/vuejs/core/security/advisories/GHSA-5c3j-59mh-x5gj

edison1105 force-pushed the edison/fix/ssrClassName branch from 9ddfe25 to fdcd994 Compare January 16, 2026 09:24

edison1105 added ready to merge The PR is ready to be merged. scope: ssr ❗ p4-important Priority 4: this fixes bugs that violate documented behavior, or significantly improves perf. labels Jan 16, 2026

edison1105 merged commit a4708f3 into main Jan 16, 2026
23 of 26 checks passed

edison1105 deleted the edison/fix/ssrClassName branch January 16, 2026 09:39

claude bot mentioned this pull request Jan 27, 2026

chore(deps): update dependency vue to v3.5.27 cbcoutinho/nextcloud-mcp-server#496

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(server-renderer): use ssrRenderClass helper for className attribute#14327

fix(server-renderer): use ssrRenderClass helper for className attribute#14327
edison1105 merged 1 commit intomainfrom
edison/fix/ssrClassName

edison1105 commented Jan 16, 2026 •

edited by coderabbitai bot

Loading

Uh oh!

coderabbitai bot commented Jan 16, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Suggested labels

Suggested reviewers

Poem

Uh oh!

github-actions bot commented Jan 16, 2026

Uh oh!

pkg-pr-new bot commented Jan 16, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

edison1105 commented Jan 16, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Suggested labels

Suggested reviewers

Poem

Uh oh!

github-actions bot commented Jan 16, 2026

Size Report

Bundles

Usages

Uh oh!

pkg-pr-new bot commented Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

edison1105 commented Jan 16, 2026 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Jan 16, 2026 •

edited

Loading

pkg-pr-new bot commented Jan 16, 2026 •

edited

Loading