Skip to content

chore: bump rollup dep for fixing vuln#362

Merged
peppescg merged 1 commit intomainfrom
fix-rollup-vuln
Mar 2, 2026
Merged

chore: bump rollup dep for fixing vuln#362
peppescg merged 1 commit intomainfrom
fix-rollup-vuln

Conversation

@peppescg
Copy link
Collaborator

@peppescg peppescg commented Mar 2, 2026

No description provided.

@peppescg peppescg self-assigned this Mar 2, 2026
Copilot AI review requested due to automatic review settings March 2, 2026 09:29
@github-actions github-actions bot added the size/S Small PR: 100-299 lines changed label Mar 2, 2026
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the project’s dependency resolution to mitigate a Rollup-related vulnerability by forcing Rollup to a newer secure version via pnpm overrides, and updates the lockfile accordingly.

Changes:

  • Add a pnpm override to require Rollup >=4.59.0 in package.json.
  • Update pnpm-lock.yaml to reflect Rollup 4.59.0 and related platform-specific Rollup packages.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.

File Description
package.json Adds a pnpm override to enforce a minimum Rollup version for vulnerability mitigation.
pnpm-lock.yaml Updates resolved Rollup and @rollup/* package versions to match the new override.
Files not reviewed (1)
  • pnpm-lock.yaml: Language not supported

@peppescg peppescg merged commit 5b3dbba into main Mar 2, 2026
14 checks passed
@peppescg peppescg deleted the fix-rollup-vuln branch March 2, 2026 11:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size/S Small PR: 100-299 lines changed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants