Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Upgrade rollup from 1.26.5 to 1.32.1 #4

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Upgrade rollup from 1.26.5 to 1.32.1 #4

wants to merge 1 commit into from

Conversation

snyk-bot
Copy link

Snyk has created this PR to upgrade rollup from 1.26.5 to 1.32.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

  • The recommended version is 24 versions ahead of your current version.
  • The recommended version was released a year ago, on 2020-03-06.

The recommended version fixes:

Severity Issue PriorityScore (*) Exploit Maturity
Prototype Pollution
SNYK-JS-Y18N-1021887		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 Proof of Concept
Use After Free
SNYK-JS-NODESASS-535497		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 No Known Exploit
Prototype Pollution
SNYK-JS-LODASH-608086		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 Proof of Concept
Prototype Pollution
SNYK-JS-LODASH-590103		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 No Known Exploit
Command Injection
SNYK-JS-LODASH-1040724		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 Proof of Concept
Prototype Pollution
SNYK-JS-INI-1048974		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 Proof of Concept
Prototype Pollution
SNYK-JS-HANDLEBARS-534988		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 No Known Exploit
Arbitrary Code Execution
SNYK-JS-HANDLEBARS-534478		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 No Known Exploit
Remote Memory Exposure
SNYK-JS-BL-608877		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 No Known Exploit
Remote Memory Exposure
SNYK-JS-BL-608877		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 No Known Exploit
Regular Expression Denial of Service (ReDoS)
SNYK-JS-ACORN-559469		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 No Known Exploit
Prototype Pollution
SNYK-JS-UNDEFSAFE-548940		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 Proof of Concept
Denial of Service (DoS)
SNYK-JS-NODESASS-542662		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 No Known Exploit
Denial of Service
SNYK-JS-NODEFETCH-674311		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 No Known Exploit
Prototype Pollution
SNYK-JS-LODASH-567746		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 Proof of Concept
Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 Proof of Concept
Denial of Service (DoS)
SNYK-JS-HTTPPROXY-569139		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 Proof of Concept
Prototype Pollution
SNYK-JS-HANDLEBARS-567742		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 Proof of Concept
Remote Code Execution (RCE)
SNYK-JS-HANDLEBARS-1056767		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 Proof of Concept
Prototype Pollution
SNYK-JS-DOTPROP-543489		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 Proof of Concept
Arbitrary File Write via Archive Extraction (Zip Slip)
SNYK-JS-DECOMPRESS-557358		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 Proof of Concept
Server-Side Request Forgery (SSRF)
SNYK-JS-AXIOS-1038255		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 Proof of Concept
Validation Bypass
SNYK-JS-KINDOF-537849		 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes
Package name: rollup
  • 1.32.1 - 2020-03-06

    2020-03-06

    Bug Fixes

    • Handle default export detection for AMD and IIFE externals that do not have a prototype (#3420)
    • Handle missing whitespace when the else branch of an if-statement is simplified (#3421)
    • Mention the importing module when reporting errors for missing named exports (#3401)
    • Add code to warning for missing output.name of IIFE bundles (#3372)

    Pull Requests

    • #3372: Add warning code for missing output.name of IIFE bundle that has export (@ rail44)
    • #3401: Missing exports errors now print the importing module (@ timiyay)
    • #3418: Structure lifecycle hooks, add links to build time hooks (@ lukastaegert)
    • #3420: Update generated code of getInteropBlock() to work with null prototype objects (@ jdalton)
    • #3421: Avoid invalid code when "else" branch is simplified (@ lukastaegert)
  • 1.32.0 - 2020-02-28

    2020-02-28

    Features

    • Allow adding plugins on the command line via --plugin <plugin> (#3379)

    Pull Requests

  • 1.31.1 - 2020-02-14

    2020-02-14

    Bug Fixes

    • Make sure errored files are always re-evaluated in watch mode to avoid an issue in the typescript plugin (#3388)

    Pull Requests

  • 1.31.0 - 2020-01-31

    2020-01-31

    Features

    • Always disable tree-shaking for asm.js functions to maintain semantics (#3362)

    Pull Requests

  • 1.30.1 - 2020-01-27

    2020-01-27

    Bug Fixes

    • Do not mistreat static entgry points as dynamic ones when chunking (#3357)
    • Resolve a crash when chunking circular dynamic imports (#3357)

    Pull Requests

  • 1.30.0 - 2020-01-27

    2020-01-27

    Features

    • Do not split chunks when dynamically imported modules import modules that are already loaded by all dynamic importers (#3354)
    • Add hoistTransitiveImports option to disable hoisting imports of static dependencies into entry chunks (#3353)

    Bug Fixes

    • Make sure polyfills are always loaded first when each static entry point contains them as first import (#3354)

    Pull Requests

  • 1.29.1 - 2020-01-21

    2020-01-21

    Bug Fixes

    • Avoid crashes for circular reexports when named exports cannot be found (#3350)

    Pull Requests

  • 1.29.0 - 2020-01-08

    2020-01-08

    Features

    • Enable top-level await by default (#3089)
    • Add typings for watch events (#3302)

    Bug Fixes

    • Deconflict files that would conflict only on a case-insensitive OS (#3317)
    • Do not fail in certain scenarios where a logical expression inside a sequence expression was being directly included (#3327)

    Pull Requests

  • 1.28.0 - 2020-01-04
  • 1.27.14 - 2019-12-22
  • 1.27.13 - 2019-12-14
  • 1.27.12 - 2019-12-13
  • 1.27.11 - 2019-12-12
  • 1.27.10 - 2019-12-11
  • 1.27.9 - 2019-12-07
  • 1.27.8 - 2019-12-02
  • 1.27.7 - 2019-12-01
  • 1.27.6 - 2019-11-30
  • 1.27.5 - 2019-11-25
  • 1.27.4 - 2019-11-22
  • 1.27.3 - 2019-11-20
  • 1.27.2 - 2019-11-18
  • 1.27.1 - 2019-11-18
  • 1.27.0 - 2019-11-12
  • 1.26.5 - 2019-11-11
from rollup GitHub release notes
Commit messages
Package name: rollup

Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
1 participant
@snyk-bot