diff --git a/.github/scripts/pr-malware-scan.cjs b/.github/scripts/pr-malware-scan.cjs
index fdd0fc6c..c94892b7 100644
--- a/.github/scripts/pr-malware-scan.cjs
+++ b/.github/scripts/pr-malware-scan.cjs
@@ -32,7 +32,7 @@ const POPULAR_PACKAGES = [
   'workbox-core', 'vite-plugin-pwa', 'msw', 'supertest', 'zxcvbn', 'otplib', 'speakeasy', 'nodemailer',
 ];
 
-const TEXT_EXT = /\.(c|m)?(j|t)sx?$|\.(json|jsonc|md|mdx|rs|toml|ya?ml|css|scss|html|sql|prisma|lock|svg|txt|snap|sh|py|graphql|spec|example|env|xml|csv|ini|cfg|conf|dict|gitignore|gitattributes|editorconfig|nvmrc|npmrc|dockerignore|mts|cts)$/i;
+const TEXT_EXT = /\.(c|m)?(j|t)sx?$|\.(json|jsonc|md|mdx|rs|toml|ya?ml|css|scss|html|sql|prisma|lock|svg|txt|snap|sh|py|graphql|spec|example|env|xml|csv|ini|cfg|conf|dict|gitignore|gitattributes|editorconfig|nvmrc|npmrc|dockerignore|mts|cts|vue|svelte|astro|less|sass|go|mod|sum)$/i;
 const MEDIA_EXT = /\.(woff2?|ttf|otf|eot|png|jpe?g|gif|ico|webp|bmp|pdf|mp3|mp4|wav|zip|gz|tgz|wasm)$/i;
 const DOC_EXT = /\.(md|mdx|txt)$/i;
 const GENERATED = /(^|\/)(package-lock\.json|Cargo\.lock|yarn\.lock|pnpm-lock\.yaml)$|(^|\/)test_snapshots\/|(^|\/)generated\/|\.snap$|\.min\.(js|css)$|\.svg$/;
diff --git a/changelog.d/scanner-component-extensions.md b/changelog.d/scanner-component-extensions.md
new file mode 100644
index 00000000..d7d72c84
--- /dev/null
+++ b/changelog.d/scanner-component-extensions.md
@@ -0,0 +1,5 @@
+Malware scan: `.vue`, `.svelte`, `.astro`, `.less`, `.sass`, `.go`,
+`go.mod` and `go.sum` files are now scanned as code. Before this, a Vue
+single-file component was flagged HIGH as "disguised code" (JavaScript
+inside a file with a non-code extension), which wrongly blocked
+docforum-core #207. The same line rules still apply to these files.