# What changed in @vue/reactivity

> 24 changes in @vue/reactivity 3 from its official release notes, upgrade guides and advisories: 1 security. Each one cited. Sources checked 2026-10-24. HTML: https://unstale.sh/npm/@vue/reactivity/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @vue/reactivity 3

### Security

- @vue/server-renderer: XSS via missing CR in attribute-name blacklist (3.5.42) — [security advisory](https://github.com/advisories/GHSA-G2V6-RQMX-R4W6)

### Performance

- Type checks are skipped for cached proxies, improving reactivity performance. (3.5.35) — [release notes](https://github.com/vuejs/core/blob/bf5f0dd877dd3c23ce85c2cbc1dd771567e84c8c/CHANGELOG.md#3535-2026-05-27)

### Fixes and other changes

- Reactivity no longer mutates native array iterators. (3.5.44) — [release notes](https://github.com/vuejs/core/blob/bf5f0dd877dd3c23ce85c2cbc1dd771567e84c8c/CHANGELOG.md#3544-2026-10-13)
- A once watcher now stops when its callback throws. (3.5.44) — [release notes](https://github.com/vuejs/core/blob/bf5f0dd877dd3c23ce85c2cbc1dd771567e84c8c/CHANGELOG.md#3544-2026-10-13)
- Shallow collection behavior is preserved. (3.5.44) — [release notes](https://github.com/vuejs/core/blob/bf5f0dd877dd3c23ce85c2cbc1dd771567e84c8c/CHANGELOG.md#3544-2026-10-13)
- Dependencies are no longer tracked in watcher callbacks run inside another effect. (3.5.44) — [release notes](https://github.com/vuejs/core/blob/bf5f0dd877dd3c23ce85c2cbc1dd771567e84c8c/CHANGELOG.md#3544-2026-10-13)
- Array copy methods now preserve readonly wrappers. (3.5.43) — [release notes](https://github.com/vuejs/core/blob/bf5f0dd877dd3c23ce85c2cbc1dd771567e84c8c/CHANGELOG.md#3543-2026-09-17)
- Map and Set values are now compared correctly in reactivity. (3.5.42) — [release notes](https://github.com/vuejs/core/blob/bf5f0dd877dd3c23ce85c2cbc1dd771567e84c8c/CHANGELOG.md#3542-2026-08-27)
- Fixes handling of effects removed while an effect scope is stopping. (3.5.40) — [release notes](https://github.com/vuejs/core/blob/bf5f0dd877dd3c23ce85c2cbc1dd771567e84c8c/CHANGELOG.md#3540-2026-07-16)
- Effects are no longer triggered when setting a reactive value fails. (3.5.39) — [release notes](https://github.com/vuejs/core/blob/bf5f0dd877dd3c23ce85c2cbc1dd771567e84c8c/CHANGELOG.md#3539-2026-06-25)
- Triggers the immediate callback for empty watch sources. (3.5.36) — [release notes](https://github.com/vuejs/core/blob/bf5f0dd877dd3c23ce85c2cbc1dd771567e84c8c/CHANGELOG.md#3536-2026-06-11)
- Preserves the watch callback’s return value when the callback is wrapped for once: true. (3.5.36) — [release notes](https://github.com/vuejs/core/blob/bf5f0dd877dd3c23ce85c2cbc1dd771567e84c8c/CHANGELOG.md#3536-2026-06-11)
- Prevents an orphan effect when an effect is created in a stopped scope. (3.5.34) — [release notes](https://github.com/vuejs/core/blob/bf5f0dd877dd3c23ce85c2cbc1dd771567e84c8c/CHANGELOG.md#3534-2026-05-06)
- Effect scopes are unlinked correctly when off is called out of order. (3.5.33) — [release notes](https://github.com/vuejs/core/blob/bf5f0dd877dd3c23ce85c2cbc1dd771567e84c8c/CHANGELOG.md#3533-2026-04-22)
- Types now allow customRef to have different getter and setter types. (3.5.32) — [release notes](https://github.com/vuejs/core/blob/bf5f0dd877dd3c23ce85c2cbc1dd771567e84c8c/CHANGELOG.md#3532-2026-04-03)
- shallowReactive now uses private branding in its types. (3.5.32) — [release notes](https://github.com/vuejs/core/blob/bf5f0dd877dd3c23ce85c2cbc1dd771567e84c8c/CHANGELOG.md#3532-2026-04-03)
- Normalizes property keys before dependency lookup and improves types. (3.5.31) — [release notes](https://github.com/vuejs/core/blob/bf5f0dd877dd3c23ce85c2cbc1dd771567e84c8c/CHANGELOG.md#3531-2026-03-25)
- Preserves reactivity when calling reduce on reactive arrays. (3.5.30) — [release notes](https://github.com/vuejs/core/blob/bf5f0dd877dd3c23ce85c2cbc1dd771567e84c8c/CHANGELOG.md#3530-2026-03-09)
- Handles the edge case of a Set initialized with reactive values. (3.5.30) — [release notes](https://github.com/vuejs/core/blob/bf5f0dd877dd3c23ce85c2cbc1dd771567e84c8c/CHANGELOG.md#3530-2026-03-09)
- Avoids duplicate raw and proxy entries when adding values to a Set. (3.5.30) — [release notes](https://github.com/vuejs/core/blob/bf5f0dd877dd3c23ce85c2cbc1dd771567e84c8c/CHANGELOG.md#3530-2026-03-09)
- EffectScope now has the __v_skip flag to prevent reactive conversion. (3.5.28) — [release notes](https://github.com/vuejs/core/blob/bf5f0dd877dd3c23ce85c2cbc1dd771567e84c8c/CHANGELOG.md#3528-2026-02-09)
- Collection iteration now inherits iterator instance methods, fixing behavior for developers iterating reactive collections. (3.5.27) — [release notes](https://github.com/vuejs/core/blob/bf5f0dd877dd3c23ce85c2cbc1dd771567e84c8c/CHANGELOG.md#3527-2026-01-19)
- Iterated array items are now wrapped correctly to preserve their readonly status. (3.5.25) — [release notes](https://github.com/vuejs/core/blob/bf5f0dd877dd3c23ce85c2cbc1dd771567e84c8c/CHANGELOG.md#3525-2025-11-24)
- Fixes edge cases involving ref unwrapping. (3.5.25) — [release notes](https://github.com/vuejs/core/blob/bf5f0dd877dd3c23ce85c2cbc1dd771567e84c8c/CHANGELOG.md#3525-2025-11-24)