Skip to content

chore: Resolve rollup vuln #191

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 14 commits into from
Nov 15, 2024
Merged

chore: Resolve rollup vuln #191

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
e8e3707
chore: Resolve rollup vuln
suejung-sentry Nov 14, 2024
241d1c4
use range for 3.x
suejung-sentry Nov 14, 2024
61ec917
add changeset
suejung-sentry Nov 14, 2024
e8af074
fix rollup version
suejung-sentry Nov 14, 2024
2a1a2fa
restore range
suejung-sentry Nov 14, 2024
782a71f
Merge remote-tracking branch 'origin/main' into sshin/chore/vuln-rollup
suejung-sentry Nov 14, 2024
03fe13d
missed a spot
suejung-sentry Nov 14, 2024
b9714cd
fix build
suejung-sentry Nov 14, 2024
c9fc0d5
fix integration tests
suejung-sentry Nov 15, 2024
104f62f
fix integration test
suejung-sentry Nov 15, 2024
6043a75
fix integration test chunk names
suejung-sentry Nov 15, 2024
9a65472
one more wrong chunk name
suejung-sentry Nov 15, 2024
7228c30
Merge remote-tracking branch 'origin/main' into sshin/chore/vuln-rollup
suejung-sentry Nov 15, 2024
46ebcc7
Merge remote-tracking branch 'origin/main' into sshin/chore/vuln-rollup
suejung-sentry Nov 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions .changeset/brave-bikes-wait.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
---
"@codecov/rollup-plugin": patch
"@codecov/bundle-analyzer": patch
"@codecov/bundler-plugin-core": patch
"@codecov/nextjs-webpack-plugin": patch
"@codecov/nuxt-plugin": patch
"@codecov/remix-vite-plugin": patch
"@codecov/solidstart-plugin": patch
"@codecov/sveltekit-plugin": patch
"@codecov/vite-plugin": patch
"@codecov/webpack-plugin": patch
---

Bump rollup versions
2 changes: 1 addition & 1 deletion examples/bundle-analyzer-cli/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@
"@rollup/plugin-commonjs": "^25.0.7",
"@rollup/plugin-node-resolve": "^15.2.3",
"npm-run-all": "^4.1.5",
"rollup": "^4.9.6",
"rollup": "^4.22.4",
"serve": "^14.2.1"
},
"volta": {
Expand Down
2 changes: 1 addition & 1 deletion examples/oidc/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@
"eslint": "^8.56.0",
"eslint-plugin-react-hooks": "^4.6.0",
"eslint-plugin-react-refresh": "^0.4.5",
"rollup": "^4.9.6",
"rollup": "^4.22.4",
"typescript": "^5.3.3",
"vite": "^5.2.10"
},
Expand Down
2 changes: 1 addition & 1 deletion examples/rollup/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@
"@rollup/plugin-commonjs": "^25.0.7",
"@rollup/plugin-node-resolve": "^15.2.3",
"npm-run-all": "^4.1.5",
"rollup": "^4.9.6",
"rollup": "^4.22.4",
"serve": "^14.2.1"
},
"volta": {
Expand Down
2 changes: 1 addition & 1 deletion examples/tokenless/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@
"eslint": "^8.56.0",
"eslint-plugin-react-hooks": "^4.6.0",
"eslint-plugin-react-refresh": "^0.4.5",
"rollup": "^4.9.6",
"rollup": "^4.22.4",
"typescript": "^5.3.3",
"vite": "^5.2.10"
},
Expand Down
2 changes: 1 addition & 1 deletion examples/vite/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@
"eslint": "^8.56.0",
"eslint-plugin-react-hooks": "^4.6.0",
"eslint-plugin-react-refresh": "^0.4.5",
"rollup": "^4.9.6",
"rollup": "^4.22.4",
"typescript": "^5.3.3",
"vite": "^5.2.10"
},
Expand Down
36 changes: 18 additions & 18 deletions integration-tests/fixtures/generate-bundle-stats/nuxt/__snapshots__/nuxt-plugin.test.ts.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ exports[`Generating nuxt stats 3 {"format":"amd","expected":"amd"} matches the s
"bundleName": StringContaining "test-nuxt-v3-client-amd",
"bundler": {
"name": "rollup",
"version": "4.21.2",
"version": "4.22.4",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -28,7 +28,7 @@ exports[`Generating nuxt stats 3 {"format":"amd","expected":"amd"} matches the s
"bundleName": StringContaining "test-nuxt-v3-server-esm",
"bundler": {
"name": "rollup",
"version": "4.21.2",
"version": "4.22.4",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -49,7 +49,7 @@ exports[`Generating nuxt stats 3 {"format":"cjs","expected":"cjs"} matches the s
"bundleName": StringContaining "test-nuxt-v3-client-cjs",
"bundler": {
"name": "rollup",
"version": "4.21.2",
"version": "4.22.4",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -70,7 +70,7 @@ exports[`Generating nuxt stats 3 {"format":"cjs","expected":"cjs"} matches the s
"bundleName": StringContaining "test-nuxt-v3-server-esm",
"bundler": {
"name": "rollup",
"version": "4.21.2",
"version": "4.22.4",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -91,7 +91,7 @@ exports[`Generating nuxt stats 3 {"format":"es","expected":"esm"} matches the sn
"bundleName": StringContaining "test-nuxt-v3-client-esm",
"bundler": {
"name": "rollup",
"version": "4.21.2",
"version": "4.22.4",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -112,7 +112,7 @@ exports[`Generating nuxt stats 3 {"format":"es","expected":"esm"} matches the sn
"bundleName": StringContaining "test-nuxt-v3-server-esm",
"bundler": {
"name": "rollup",
"version": "4.21.2",
"version": "4.22.4",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -133,7 +133,7 @@ exports[`Generating nuxt stats 3 {"format":"esm","expected":"esm"} matches the s
"bundleName": StringContaining "test-nuxt-v3-client-esm",
"bundler": {
"name": "rollup",
"version": "4.21.2",
"version": "4.22.4",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -154,7 +154,7 @@ exports[`Generating nuxt stats 3 {"format":"esm","expected":"esm"} matches the s
"bundleName": StringContaining "test-nuxt-v3-server-esm",
"bundler": {
"name": "rollup",
"version": "4.21.2",
"version": "4.22.4",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -175,7 +175,7 @@ exports[`Generating nuxt stats 3 {"format":"module","expected":"esm"} matches th
"bundleName": StringContaining "test-nuxt-v3-client-esm",
"bundler": {
"name": "rollup",
"version": "4.21.2",
"version": "4.22.4",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -196,7 +196,7 @@ exports[`Generating nuxt stats 3 {"format":"module","expected":"esm"} matches th
"bundleName": StringContaining "test-nuxt-v3-server-esm",
"bundler": {
"name": "rollup",
"version": "4.21.2",
"version": "4.22.4",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -217,7 +217,7 @@ exports[`Generating nuxt stats 3 {"format":"iife","expected":"iife"} matches the
"bundleName": StringContaining "test-nuxt-v3-client-iife",
"bundler": {
"name": "rollup",
"version": "4.21.2",
"version": "4.22.4",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -238,7 +238,7 @@ exports[`Generating nuxt stats 3 {"format":"iife","expected":"iife"} matches the
"bundleName": StringContaining "test-nuxt-v3-server-esm",
"bundler": {
"name": "rollup",
"version": "4.21.2",
"version": "4.22.4",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -259,7 +259,7 @@ exports[`Generating nuxt stats 3 {"format":"umd","expected":"umd"} matches the s
"bundleName": StringContaining "test-nuxt-v3-client-umd",
"bundler": {
"name": "rollup",
"version": "4.21.2",
"version": "4.22.4",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -280,7 +280,7 @@ exports[`Generating nuxt stats 3 {"format":"umd","expected":"umd"} matches the s
"bundleName": StringContaining "test-nuxt-v3-server-esm",
"bundler": {
"name": "rollup",
"version": "4.21.2",
"version": "4.22.4",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -301,7 +301,7 @@ exports[`Generating nuxt stats 3 {"format":"system","expected":"system"} matches
"bundleName": StringContaining "test-nuxt-v3-client-system",
"bundler": {
"name": "rollup",
"version": "4.21.2",
"version": "4.22.4",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -322,7 +322,7 @@ exports[`Generating nuxt stats 3 {"format":"system","expected":"system"} matches
"bundleName": StringContaining "test-nuxt-v3-server-esm",
"bundler": {
"name": "rollup",
"version": "4.21.2",
"version": "4.22.4",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -343,7 +343,7 @@ exports[`Generating nuxt stats 3 {"format":"systemjs","expected":"system"} match
"bundleName": StringContaining "test-nuxt-v3-client-system",
"bundler": {
"name": "rollup",
"version": "4.21.2",
"version": "4.22.4",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -364,7 +364,7 @@ exports[`Generating nuxt stats 3 {"format":"systemjs","expected":"system"} match
"bundleName": StringContaining "test-nuxt-v3-server-esm",
"bundler": {
"name": "rollup",
"version": "4.21.2",
"version": "4.22.4",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand Down
4 changes: 2 additions & 2 deletions packages/rollup-plugin/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@
"@vitest/coverage-v8": "^1.5.0",
"codecovProdRollupPlugin": "npm:@codecov/[email protected]",
"msw": "^2.1.5",
"rollup": "4.9.6",
"rollup": "4.22.4",
"ts-node": "^10.9.2",
"typedoc": "^0.25.12",
"typescript": "^5.3.3",
Expand All @@ -63,7 +63,7 @@
"vitest": "^1.5.0"
},
"peerDependencies": {
"rollup": "3.x || 4.x"
"rollup": ">=3.29.5 <4.0.0 || >=4.22.4 <5.0.0"
Copy link

@nicholas-codecov nicholas-codecov Nov 14, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@suejung-sentry are we able to rollback to the prior implementation of peer deps declarations?

With these changes, we'd have to move from a patch to a major release as we're requiring users to update their version of rollup. If they don't, peer dep resolution would fail while they try to install the plugin.

Copy link
Contributor Author

@suejung-sentry suejung-sentry Nov 15, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good catch - fixed!

},
"volta": {
"extends": "../../package.json"
Expand Down
Loading
Loading