Skip to content

Commit

Permalink
deps: Update rollup to 3.x, from the last 2.x
Browse files Browse the repository at this point in the history
This is a library we use in tools/generate-webview-js , for
producing the generated JS code to go in the message-list webview
based on our several source files for it.

This upgrade gets us a large number of changes that don't matter to us
because they have no effect on the output JS.  One of those is to fix
an XSS vulnerability, CVE-2024-47068:
  GHSA-gcx4-mw62-g8wm
which we learned about from Dependabot:
  #5893

Even though the vulnerability doesn't affect us, it's good to upgrade
past the fix to avoid having to ever re-evaluate whether it affects us.
The fix is only in 3.x+, so go to the latest 3.x.

There's also one change affecting the output, which is that the
`__esModule` marker goes away.  Seems fine.  That happened in 3.0.0:
  https://github.com/rollup/rollup/blob/master/CHANGELOG.md#300
  • Loading branch information
gnprice authored and chrisbobbe committed Sep 24, 2024
1 parent 04a8646 commit a361394
Show file tree
Hide file tree
Showing 3 changed files with 5 additions and 7 deletions.
2 changes: 1 addition & 1 deletion package.json
Original file line number Diff line number Diff line change
Expand Up @@ -133,7 +133,7 @@
"react-test-renderer": "17.0.2",
"recast": "^0.22.0",
"redux-mock-store": "^1.5.1",
"rollup": "^2.26.5",
"rollup": "^3.29.5",
"sqlite3": "^5.0.2",
"tsflower": "^0.0.14",
"typescript": "~4.3.5",
Expand Down
2 changes: 0 additions & 2 deletions src/webview/js/generatedEs3.js
Original file line number Diff line number Diff line change
Expand Up @@ -876,8 +876,6 @@ var compiledWebviewJs = (function (exports) {
exports.handleInitialLoad = handleInitialLoad;
Object.defineProperty(exports, '__esModule', { value: true });
return exports;
})({});
Expand Down
8 changes: 4 additions & 4 deletions yarn.lock
Original file line number Diff line number Diff line change
Expand Up @@ -11358,10 +11358,10 @@ rn-fetch-blob@^0.11.0:
base-64 "0.1.0"
glob "7.0.6"

rollup@^2.26.5:
version "2.79.1"
resolved "https://registry.yarnpkg.com/rollup/-/rollup-2.79.1.tgz#bedee8faef7c9f93a2647ac0108748f497f081c7"
integrity sha512-uKxbd0IhMZOhjAiD5oAFp7BqvkA4Dv47qpOCtaNvng4HBwdbWtdOh8f5nZNuk2rp51PMGk3bzfWu5oayNEuYnw==
rollup@^3.29.5:
version "3.29.5"
resolved "https://registry.yarnpkg.com/rollup/-/rollup-3.29.5.tgz#8a2e477a758b520fb78daf04bca4c522c1da8a54"
integrity sha512-GVsDdsbJzzy4S/v3dqWPJ7EfvZJfCHiDqe80IyrF59LYuP+e6U1LJoUqeuqRbwAWoMNoXivMNeNAOf5E22VA1w==
optionalDependencies:
fsevents "~2.3.2"

Expand Down

0 comments on commit a361394

Please sign in to comment.