Skip to content

[Snyk] Upgrade rollup from 0.64.1 to 0.68.2 - #2

Merged
hashim21223445 merged 1 commit into
mainfrom
snyk-upgrade-18afe0a768d7b3720037de66c77a383c
Aug 7, 2024
Merged

[Snyk] Upgrade rollup from 0.64.1 to 0.68.2#2
hashim21223445 merged 1 commit into
mainfrom
snyk-upgrade-18afe0a768d7b3720037de66c77a383c

Conversation

@hashim21223445

Copy link
Copy Markdown
Owner

snyk-top-banner

Snyk has created this PR to upgrade rollup from 0.64.1 to 0.68.2.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


  • The recommended version is 18 versions ahead of your current version.

  • The recommended version was released on 6 years ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Remote Code Execution (RCE)
SNYK-JS-HANDLEBARS-1056767
219 Proof of Concept
high severity Prototype Pollution
SNYK-JS-HANDLEBARS-173692
219 No Known Exploit
high severity Prototype Poisoning
SNYK-JS-QS-3153490
219 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795
219 Proof of Concept
high severity Prototype Pollution
SNYK-JS-UNSETVALUE-2400660
219 No Known Exploit
high severity Prototype Pollution
SNYK-JS-Y18N-1021887
219 Proof of Concept
high severity Prototype Pollution
SNYK-JS-LODASH-6139239
219 Proof of Concept
high severity Inefficient Regular Expression Complexity
SNYK-JS-MICROMATCH-6838728
219 No Known Exploit
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795
219 Proof of Concept
high severity Prototype Pollution
SNYK-JS-SETVALUE-1540541
219 Proof of Concept
high severity Prototype Pollution
SNYK-JS-SETVALUE-450213
219 Proof of Concept
high severity Prototype Pollution
SNYK-JS-SETVALUE-1540541
219 Proof of Concept
high severity Prototype Pollution
SNYK-JS-SETVALUE-450213
219 Proof of Concept
high severity Prototype Pollution
SNYK-JS-MIXINDEEP-450212
219 Proof of Concept
high severity Prototype Pollution
SNYK-JS-HANDLEBARS-174183
219 No Known Exploit
high severity Prototype Pollution
SNYK-JS-HANDLEBARS-469063
219 No Known Exploit
high severity Denial of Service (DoS)
SNYK-JS-HANDLEBARS-480388
219 No Known Exploit
high severity Arbitrary Code Execution
SNYK-JS-HANDLEBARS-534478
219 Proof of Concept
high severity Prototype Pollution
SNYK-JS-JSONSCHEMA-1920922
219 No Known Exploit
high severity Arbitrary Code Execution
SNYK-JS-JSYAML-174129
219 No Known Exploit
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-ACORN-559469
219 No Known Exploit
high severity Prototype Pollution
SNYK-JS-AJV-584908
219 No Known Exploit
high severity Prototype Pollution
SNYK-JS-ASYNC-2441827
219 Proof of Concept
high severity Uncontrolled resource consumption
SNYK-JS-BRACES-6838727
219 Proof of Concept
high severity Denial of Service (DoS)
SNYK-JS-DECODEURICOMPONENT-3149970
219 Proof of Concept
high severity Arbitrary Code Execution
SNYK-JS-ESLINTUTILS-460220
219 No Known Exploit
high severity Code Injection
SNYK-JS-LODASH-1040724
219 Proof of Concept
high severity Prototype Pollution
SNYK-JS-LODASH-450202
219 Proof of Concept
high severity Prototype Pollution
SNYK-JS-LODASH-567746
219 Proof of Concept
high severity Prototype Pollution
SNYK-JS-LODASH-608086
219 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-HANDLEBARS-1279029
219 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-UGLIFYJS-1727251
219 No Known Exploit
medium severity Prototype Pollution
SNYK-JS-YARGSPARSER-560381
219 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-3050818
219 No Known Exploit
medium severity Prototype Pollution
SNYK-JS-MINIMIST-559764
219 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-MINIMIST-559764
219 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHPARSE-1077067
219 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-HANDLEBARS-567742
219 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-HOSTEDGITINFO-1088355
219 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905
219 Proof of Concept
low severity Prototype Pollution
SNYK-JS-MINIMIST-2429795
219 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
npm:debug:20170905
219 Proof of Concept
low severity Prototype Pollution
SNYK-JS-MINIMIST-2429795
219 Proof of Concept
low severity Prototype Pollution
SNYK-JS-MINIMIST-2429795
219 Proof of Concept
critical severity Prototype Pollution
SNYK-JS-HANDLEBARS-534988
219 No Known Exploit
low severity Validation Bypass
SNYK-JS-KINDOF-537849
219 Proof of Concept
critical severity Incomplete List of Disallowed Inputs
SNYK-JS-BABELTRAVERSE-5962462
219 Proof of Concept
Release notes
Package name: rollup
  • 0.68.2 - 2018-12-23

    2018-12-23

    Bug Fixes

    • Do not assume hoisted variables to have been initialized (#2607)

    Pull Requests

    • #2607: Fix an issues where hoisted variables were assumed to have been initialized (@ lye)
  • 0.68.1 - 2018-12-19

    2018-12-19

    Bug Fixes

    • Fix an issue with UMD wrappers where a variable is used without being defined (#2600)

    Pull Requests

    • #2600: Fix UMD and IIFE wrapper issues and add comprehensive functional wrapper tests (@ lukastaegert)
  • 0.68.0 - 2018-12-16

    2018-12-16

    Breaking Changes

    • optimizeChunks is renamed to experimentalOptimizeChunks to reflect this feature is not production-ready yet (#2575)

    Features

    • Plugins can iterate all module ids via this.moduleIds (#2565)
    • Plugins can get graph information about a module via this.getModuleInfo(id) (#2565)
    • Plugins and JS API users get more information about the generated chunks: dynamicImports, facadeModuleId, isDynamicEntry, name (#2575)
    • Tree-shaken dynamic imports will no longer create chunks or influence chunking in any way (#2575)
    • Dynamic imports will no longer follow the entryFileNames but the chunkFileNames property reflecting those are solely internally used (#2575)
    • If there are chunk naming conflicts, entry chunks will always take precedence (#2575)
    • If an entry facade is created, only the facade chunk is marked as isEntry (#2575)
    • Dynamic chunks will only be marked as isEntry if they are actually entry chunks as well; thus there is now a 1-to-1 correspondence between modules listed in input and chunks marked as isEntry (#2575)
    • Chunks no longer contain imports for variables that are tree-shaken in the chunk but used in other chunks (#2584)
    • Chunks will always import re-exported variables directly from the chunk where they are originally exported from (#2584)
    • Null characters will be pruned from chunk ids to allow for virtually created chunks and make rollup-plugin-multi-entry compatible with code-splitting and thus the upcoming 1.0 version (#2590)
    • Simplify the UMD wrapper code as much as possible, especially if there are no exports (#2594)
    • The UMD wrapper will now work in strict mode by checking for self before this when determining the global variable (#2594)

    Bug Fixes

    • If a facade is created for a dynamic entry point, this facade will be imported instead of the facaded chunk (#2575)
    • Manual chunks that include multiple entry points will have proper facades created for all entry points if necessary (#2575)
    • If missing exports are shimmed, the shim variable will not be global but created on a per-module basis and is deconflicted with variables having the same name (#2584)
    • Missing export shims work properly in SystemJS (#2584)
    • preserveModules now handles dynamic namespace imports (#2584)
    • Fix chunk execution order in certain scenarios (#2584)
    • Exports and assignments using destructuring syntax will properly update the exported variables when generating SystemJS output (#2587)
    • Hashes in chunk names will now also take dynamic imports into account (#2596)

    Pull Requests

    • #2565: Provide module graph information on the plugin context (@ samccone)
    • #2575: Extend bundle information, tree-shake dynamic imports, fix dynamic import facade creation, support manual chunks with multiple entry points, make optimizeImports experimental (@ lukastaegert)
    • #2577: Update dependencies (@ lukastaegert)
    • #2584: Prune tree-shaken chunk imports, fix missing export shimming, support dynamic namespaces when preserving modules, improve chunk execution order (@ lukastaegert)
    • #2587: Support exports using destructuring declarations and assignments in SystemJS (@ lukastaegert)
    • #2590: Make sure chunk ids do not contain invalid characters to allow for chunks to correspond to virtual modules (@ lukastaegert)
    • #2594: Simplify UMD wrapper code and make sure it works in strict mode (@ lukastaegert)
    • #2596: Take both static and dynamic dependencies into account when calculating hashes (@ lukastaegert)
  • 0.67.4 - 2018-12-03

    2018-12-03

    Bug Fixes

    • Prevent corrupt source maps for files with very long lines (#2571)

    Pull Requests

  • 0.67.3 - 2018-11-17

    2018-11-17

    Bug Fixes

    • Make sure the ESM browser build is actually published to npm (#2560)
    • Throw proper error when using inlineDynamicImports with experimentalPreserveModules (#2560)

    Pull Requests

    • #2552: Properly include ESM browser build in package (@ lukastaegert)
    • #2560: Show proper error when using inlineDynamicImports with experimentalPreserveModules (@ clarkdo)
  • 0.67.2 - 2018-11-17

    2018-11-17

    Bug Fixes

    • Prevent crash when not returning sourcemaps from renderChunk plugin hook (#2558)

    Pull Requests

    • #2558: Prevent crash when not returning sourcemaps from renderChunk (@ kyle1320)
  • 0.67.1 - 2018-11-11

    2018-11-11

    Bug Fixes

    • Deconflict CLI entry points with same name but on different paths if no explicit naming is used (#2548)

    Pull Requests

    • #2548: Deconflict CLI entry points with same name but on different paths if no explicit naming is used (@ lukastaegert)
  • 0.67.0 - 2018-11-04

    2018-11-04

    Breaking Changes

    none

    Features

    • Do not resolve external dynamic imports via plugins to match the logic for static external imports again (#2505)
    • Support virtual modules created by plugins when preserving modules (#2511)
    • Add new output.sourcemapExcludeSources option to exclude the actual sources from sourcemaps (#2531)

    Bug Fixes

    • Fix TypeScript type for sourcemaps (#2507)
    • Fix order of external and inter-chunk imports to match the proper execution order (#2508)
    • Do not tree-shake children of unknown nodes to e.g. properly handle do-expressions via acorn plugin (#2510)
    • Prevent memory leak when using the bundle as cache (#2522)
    • Fix mis-placed semicolons for certain SystemJS exports (#2529)

    Pull Requests

  • 0.66.6 - 2018-10-10

    0.66.6

  • 0.66.5 - 2018-10-09

    0.66.5

  • 0.66.4 - 2018-10-04
  • 0.66.3 - 2018-10-03
  • 0.66.2 - 2018-09-21
  • 0.66.1 - 2018-09-19
  • 0.66.0 - 2018-09-16
  • 0.65.2 - 2018-09-05
  • 0.65.1 - 2018-09-05
  • 0.65.0 - 2018-08-25
  • 0.64.1 - 2018-08-07
from rollup GitHub release notes

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

Snyk has created this PR to upgrade rollup from 0.64.1 to 0.68.2.

See this package in npm:
rollup

See this project in Snyk:
https://app.snyk.io/org/hashim21223445/project/9009f388-824c-44c5-a90a-2e4f32b5475c?utm_source=github&utm_medium=referral&page=upgrade-pr
@hashim21223445
hashim21223445 merged commit 26bfe70 into main Aug 7, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants