Skip to content

Bump rollup from 4.56.0 to 4.59.0#2376

Merged
ericcornelissen merged 1 commit intomainfrom
dependabot/npm_and_yarn/rollup-4.59.0
Feb 26, 2026
Merged

Bump rollup from 4.56.0 to 4.59.0#2376
ericcornelissen merged 1 commit intomainfrom
dependabot/npm_and_yarn/rollup-4.59.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Feb 26, 2026

Bumps rollup from 4.56.0 to 4.59.0.

Release notes

Sourced from rollup's releases.

v4.59.0

4.59.0

2026-02-22

Features

  • Throw when the generated bundle contains paths that would leave the output directory (#6276)

Pull Requests

v4.58.0

4.58.0

2026-02-20

Features

  • Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#6272)

Pull Requests

v4.57.1

4.57.1

2026-01-30

Bug Fixes

  • Fix heap corruption issue in Windows (#6251)
  • Ensure exports of a dynamic import are fully included when called from a try...catch (#6254)

Pull Requests

... (truncated)

Changelog

Sourced from rollup's changelog.

4.59.0

2026-02-22

Features

  • Throw when the generated bundle contains paths that would leave the output directory (#6276)

Pull Requests

4.58.0

2026-02-20

Features

  • Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#6272)

Pull Requests

4.57.1

2026-01-30

Bug Fixes

  • Fix heap corruption issue in Windows (#6251)
  • Ensure exports of a dynamic import are fully included when called from a try...catch (#6254)

Pull Requests

... (truncated)

Commits

Most Recent Ignore Conditions Applied to This Pull Request
Dependency Name Ignore Conditions
rollup [< 2.76, > 2.75.3]
rollup [< 2.78, > 2.77.1]
rollup [< 4.22, > 4.21.0]
rollup [< 4.23, > 4.22.4]
rollup [>= 4.23.a, < 4.24]
rollup [>= 4.24.a, < 4.25]
rollup [>= 4.26.a, < 4.27]
rollup [>= 4.27.a, < 4.28]
rollup [< 4.35, > 4.34.6]
rollup [< 4.42, > 4.41.0]
rollup [< 4.45, > 4.44.0]
rollup [>= 4.45.a, < 4.46]
rollup [< 4.47, > 4.46.1]
rollup [>= 4.47.a, < 4.48]
rollup [>= 4.49.a, < 4.50]
rollup [< 4.51, > 4.50.0]
rollup [< 4.53, > 4.52.0]
rollup [< 4.54, > 4.53.1]

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump rollup from 4.56.0 to 4.59.0
3d00593 
Bumps [rollup](https://github.com/rollup/rollup) from 4.56.0 to 4.59.0.
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.56.0...v4.59.0)

---
updated-dependencies:
- dependency-name: rollup
  dependency-version: 4.59.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Changes to the project's dependencies label Feb 26, 2026
@deepsource-io

This comment was marked as off-topic.

Sign in to view
@ericcornelissen

This comment was marked as resolved.

Sign in to view
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Feb 26, 2026

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash

# Check if package-lock.json exists and examine rollup dependencies
if [ -f package-lock.json ]; then
  echo "=== Checking rollup transitive dependencies ==="
  # Extract rollup's dependencies from package-lock.json
  jq '.packages["node_modules/rollup"]' package-lock.json 2>/dev/null || echo "Could not find rollup in package-lock.json"
  
  echo -e "\n=== Checking for other rollup-related packages ==="
  jq -r '.packages | keys[] | select(contains("rollup"))' package-lock.json 2>/dev/null | head -20
fi

# Check package.json for rollup
echo -e "\n=== Rollup in package.json ==="
jq '.devDependencies.rollup // .dependencies.rollup // "not found"' package.json 2>/dev/null

# Search for any security-related files or documentation
echo -e "\n=== Checking for SECURITY.md or similar files ==="
fd -t f "SECURITY|security" --max-depth 2 2>/dev/null || echo "No security files found"

Length of output: 2745

🏁 Script executed:

#!/bin/bash

# Check GitHub security advisories for rollup using gh CLI
echo "=== Checking GitHub Security Advisories for rollup ==="
gh api graphql -f query='
{
  securityVulnerabilities(first: 10, package: "rollup", ecosystem: NPM) {
    nodes {
      advisory {
        summary
        severity
        publishedAt
      }
      vulnerableVersionRange
      firstPatchedVersion {
        identifier
      }
    }
  }
}' 2>/dev/null || echo "Could not fetch security advisories"

# Also check npm audit for the package
echo -e "\n=== Checking for vulnerabilities in current dependencies ==="
npm audit --json 2>/dev/null | jq '.vulnerabilities.rollup // "No vulnerabilities found for rollup"' || echo "Could not run npm audit"

Length of output: 1601

🏁 Script executed:

#!/bin/bash

# Search for any CVEs or security issues related to rollup versions 4.56-4.59
echo "=== Searching for recent rollup security discussions ==="
gh api search/issues -X GET \
  -f q="repo:rollup/rollup is:issue security OR vulnerability OR CVE created:>2026-01-01" \
  --jq '.items[] | {title: .title, number: .number, state: .state, created_at: .created_at}' 2>/dev/null | head -20 || echo "Could not search issues"

Length of output: 172

@ericcornelissen I've reviewed this rollup dependency update. Here's what you need to know:

🚨 Critical Security Fix

This update patches a HIGH severity security vulnerability that affects your current version (4.56.0):

  • CVE/Advisory: Arbitrary File Write via Path Traversal in Rollup 4
  • Severity: HIGH
  • Published: February 25, 2026
  • Vulnerable versions: >= 4.0.0, < 4.59.0
  • Fixed in: 4.59.0 (this update)

The vulnerability allows arbitrary file writes through path traversal, which could lead to malicious code execution or data compromise during the build process.

Changes Across Versions

Version 4.59.0 (2026-02-22):

  • ✅ Security fix: Validates that generated bundles stay within the output directory (addresses the path traversal issue)

Version 4.58.0 (2026-02-20):

  • New feature: __NO_SIDE_EFFECTS__ annotation now supported for function expressions in variable declarations (improves tree-shaking)

Version 4.57.1 (2026-01-30):

  • Bug fix: Heap corruption issue on Windows
  • Bug fix: Ensures exports of dynamic imports are fully included when called from try...catch

Transitive Dependencies

All transitive dependencies are clean:

  • @types/estree: 1.0.8 (unchanged)
  • Platform-specific optional binaries updated to 4.59.0
  • No additional security concerns identified

Recommendation

✅ Strongly recommend merging this PR immediately due to the security vulnerability fix. There are no breaking changes, and the update includes useful bug fixes and features.

@ericcornelissen ericcornelissen merged commit 5f12be2 into main Feb 26, 2026
43 of 44 checks passed
@ericcornelissen ericcornelissen deleted the dependabot/npm_and_yarn/rollup-4.59.0 branch February 26, 2026 12:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Changes to the project's dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ericcornelissen