build(deps): bump @unhead/vue from 3.1.3 to 3.1.7

[dependabot]

Bumps @unhead/vue from 3.1.3 to 3.1.7.

Release notes

Sourced from @​unhead/vue's releases.

v3.1.7

   🐞 Bug Fixes

• Guard plugins against double registration  -  by @​harlan-zw in unjs/unhead#791 (2bb78)
• Harden head rendering malformed input  -  by @​harlan-zw in unjs/unhead#814 (a18e2)
• Reduce minimal bundle size  -  by @​harlan-zw (37600)
• Satisfy bundle size type checks  -  by @​harlan-zw (e8a77)
• Keep vue server exports scoped  -  by @​harlan-zw (dae11)
• Harden script registry keys  -  by @​harlan-zw (5557f)
• angular:
  • Correct package type exports  -  by @​harlan-zw in unjs/unhead#802 (9e150)
  • Request-scope the server head  -  by @​harlan-zw in unjs/unhead#810 (7d8e4)
• bundler:
  • Lazy-load Vite devtools plugin behind Vite hooks  -  by @​harlan-zw in unjs/unhead#790 (e66e2)
• dom:
  • Correct and optimize the client DOM renderer  -  by @​harlan-zw in unjs/unhead#787 (ace35)
• react:
  • Make composables StrictMode double-invoke safe  -  by @​harlan-zw in unjs/unhead#809 (7a5ba)
• schema-org:
  • Missing subpath exports and vue import cycle  -  by @​harlan-zw in unjs/unhead#785 (10a21)
• solid-js:
  • Harden streaming wrapper  -  by @​harlan-zw in unjs/unhead#804 (9b383)
• streaming:
  • Use emitted Vite IIFE asset URL  -  by @​harlan-zw in unjs/unhead#789 (4e368)
• unhead:
  • Identity-based useScript callback and trigger cleanup  -  by @​harlan-zw in unjs/unhead#807 (67d35)
• vue:
  • Avoid render-scoped Head watchers  -  by @​harlan-zw in unjs/unhead#806 (48e30)
  • Normalize useSeoMeta patches  -  by @​harlan-zw in unjs/unhead#805 (dc2b8)
• vue,svelte,angular,solid:
  • Dispose useScript callbacks by identity  -  by @​harlan-zw in unjs/unhead#808 (b796a)

   🏎 Performance

• Optimize SSR hot paths  -  by @​harlan-zw in unjs/unhead#794 (f806f)
• Reduce bundle size  -  by @​harlan-zw in unjs/unhead#817 (89781)
• schema-org:
  • Skip unused duplicate cleanup  -  by @​harlan-zw in unjs/unhead#816 (90ab8)
  • Reduce entry normalization  -  by @​harlan-zw in unjs/unhead#815 (aa9c7)
• ssr:
  • Self-closing tag hot path  -  by @​harlan-zw in unjs/unhead#801 (dafb4)
• unhead:
  • Avoid fallback hash allocations  -  by @​TheAlexLichter in unjs/unhead#784 (9916b)
  • Structural-sharing walkResolver to cut SSR allocation  -  by @​harlan-zw in unjs/unhead#812 (7dbdc)
  • Remove the dead unhead:payload mechanism  -  by @​harlan-zw in unjs/unhead#813 (9cb64)

    View changes on GitHub

v3.1.6

   🏎 Performance

... (truncated)

Commits

• e69a7a8 chore: release v3.1.7
• 897819c perf: reduce bundle size (#817)
• 7d1f8a4 chore(build): remove Rollup side-effect warnings (#818)
• b796acf fix(vue,svelte,angular,solid): dispose useScript callbacks by identity (#808)
• dc2b801 fix(vue): normalize useSeoMeta patches (#805)
• 4e368bc fix(streaming): use emitted Vite IIFE asset URL (#789)
• 48e3029 fix(vue): avoid render-scoped Head watchers (#806)
• b68cdc1 ci: bench infrastructure and combined size + perf PR report (#793)
• 8e3efe4 chore: release v3.1.6
• 8d87797 chore: release v3.1.5
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​unhead/​vue@​3.1.3 ⏵ 3.1.7

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@unhead/[email protected] → npm/@emnapi/[email protected] ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report