Apostrophe 3.61.1: hotfix for bug in Vue 2.7.16

[boutell]

Vue 2.7.16, released on December 24th, introduced a bug into Apostrophe's rich text toolbar, causing it to become invisible.

This has been fixed in Apostrophe 3.61.1 by pinning Apostrophe's dependency to Vue 2.7.15. Since Vue 2.x has reached its end of development date, we do not anticipate any fixes from the Vue team for bugs introduced in 2.7.16, but if we are able to determine that the issue can be reasonably considered a bug in Apostrophe and not in Vue 2.7.16 and it has a practical solution then we may upgrade to Vue 2.7.16 at a later time.

This is a good time to remind the community that support for Vue 3.x in Apostrophe is coming soon. We have achieved a successful proof of concept using the Vue 3 2.x compatibility mode, and we are working on bringing that support to other key 3.x modules before we make the transition, which will happen in a 4.0.0 release — solely because that avoids any backwards compatibility breaks for those typing npm update.

To be clear, 4.0.0 will not be a major change in any way except for those who have already written custom ApostropheCMS admin UI Vue code, and even for them the changes required will be few and well-documented. We are planning to change the version number only to ensure automated updates do not introduce surprises.

In the meantime, we are committed to providing community support for any critical security issues in Vue 2.x. However it is worth noting that, as the Vue team has already pointed out, there has never been a security issue in Vue itself.