<p dir="auto">Always  fire first element callback.</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="    &lt;ul&gt;
        &lt;li
            v-repeat=&quot;todos&quot;
            v-on=&quot;click:callback&quot;
        &gt;
            {{content}} : {{done}}
        &lt;/li&gt;
    &lt;/ul&gt;"><pre class="notranslate"><code class="notranslate">    &lt;ul&gt;
        &lt;li
            v-repeat="todos"
            v-on="click:callback"
        &gt;
            {{content}} : {{done}}
        &lt;/li&gt;
    &lt;/ul&gt;
</code></pre></div>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="  var demo = new Vue({
    template: demo_template,
    data: {
      title: 'todos',
      todos: [
        {callback: function(){console.log(this.$index);}},
        {callback: function(){console.log(this.$index);}}
      ]
  }"><pre class="notranslate"><code class="notranslate">  var demo = new Vue({
    template: demo_template,
    data: {
      title: 'todos',
      todos: [
        {callback: function(){console.log(this.$index);}},
        {callback: function(){console.log(this.$index);}}
      ]
  }
</code></pre></div>
<p dir="auto">All element retrun 0. My code is wrong?</p>
<h3 dir="auto">Version</h3>
<p dir="auto">2.6.10</p>
<h3 dir="auto">Reproduction link</h3>
<p dir="auto"><a href="https://github.com/meditatingdragon/starter-gridsome-vuetify">https://github.com/meditatingdragon/starter-gridsome-vuetify</a></p>
<h3 dir="auto">Steps to reproduce</h3>
<p dir="auto">Have <code class="notranslate">gridsome</code> as a dependency (or whatever depends on <code class="notranslate">vue-server-renderer</code>) and observe GitHub and Snyk.</p>
<h3 dir="auto">What is expected?</h3>
<p dir="auto">No vulnerabilities</p>
<h3 dir="auto">What is actually happening?</h3>
<p dir="auto">XSS vulnerability caused by an outdated version of <code class="notranslate">serialize-javascript</code> (i.e. older than <code class="notranslate">v2.1.1</code>).</p>
<hr>
<p dir="auto">I tried highlighting this issue in the discord server but it didn't seem that people cared.<br>
<a href="https://npmjs.com/advisories/1426" rel="nofollow">https://npmjs.com/advisories/1426</a></p>