Commits on Sep 24, 2024

1. deps: Update rollup to 3.x, from the last 2.x …

   This is a library we use in tools/generate-webview-js , for
   producing the generated JS code to go in the message-list webview
   based on our several source files for it.
   
   This upgrade gets us a large number of changes that don't matter to us
   because they have no effect on the output JS.  One of those is to fix
   an XSS vulnerability, CVE-2024-47068:
     GHSA-gcx4-mw62-g8wm
   which we learned about from Dependabot:
     zulip#5893
   
   Even though the vulnerability doesn't affect us, it's good to upgrade
   past the fix to avoid having to ever re-evaluate whether it affects us.
   The fix is only in 3.x+, so go to the latest 3.x.
   
   There's also one change affecting the output, which is that the
   `__esModule` marker goes away.  Seems fine.  That happened in 3.0.0:
     https://github.com/rollup/rollup/blob/master/CHANGELOG.md#300

   

   gnprice committed Sep 24, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for b6a2e2c
   • Browse repository at this point

   Copy the full SHA

   b6a2e2c View commit details

   Browse the repository at this point in the history