Vue 2 is EOL; migration to Vue 3 is underway. Moreover, it's not clear whether this issue can actually be triggered:

1. I could not reproduce it with our .vue files. In the example, the template is provided as a string. Doing a quick search on the Tuleap codebase, I have found zero such cases, we always pass template via single-file components, which go through a "compilation" step that seems to remove this issue.
2. I don't think there are any bad closing tags in our codebase. My IDE would not let me write it, I had to copy/paste the bad snippet, and then eslint would complain, it would appear during code review, etc. Basically, there are very few chances of triggering this.
3. At the worst case, it is a ReDoS, the app will be very slow, but it's not an XSS where data can be extracted.