4.53.0 fails to install due to postinstall patch-package

[brandonocasey]

Rollup Version

4.53.0

Operating System (or Browser)

mac

Node Version (if applicable)

24

Link To Reproduction

npm install rollup

Expected Behaviour

It should install

Actual Behaviour

it does not presumably because patch-package is in devDependencies but there is a postinstall script using it.

npm error code 127
npm error path ./node_modules/rollup
npm error command failed
npm error command sh -c patch-package
npm error sh: patch-package: command not found
npm error A complete log of this run can be found in: 

[U-4-E-A]

Same issue here - Windows 10 Pro, node v23.3.0. Currently using this as a workaround while it gets fixed: -

  "resolutions": {
    "rollup": "4.26.0"
  },

[kyjus25]

Sooooo, I bet someone is frantically trying to fix this since it seems everyone's builds just broke. How y'all doin? XD

[ilya-raevskiy]

Just before the weekend...

[antoninkriz]

Hope this helps with triage 🙏

System

x86_64 GNU/Linux

Minimal Example

npm install rollup --verbose

Log

npm verbose cli /censored/bin/node /censored/bin/npm
npm info using npm@11.6.0
npm info using node@v24.9.0
npm verbose title npm install rollup
npm verbose argv "install" "rollup" "--loglevel" "verbose"
npm verbose logfile logs-max:10 dir:/home/antoninkriz/.npm-cache/_logs/2025-11-07T16_48_38_434Z-
npm verbose logfile /home/antoninkriz/.npm-cache/_logs/2025-11-07T16_48_38_434Z-debug-0.log
npm http fetch GET 200 https://registry.npmjs.org/npm 120ms
npm http fetch GET 200 https://registry.npmjs.org/rollup 130ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@types%2festree 195ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/fsevents 196ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@rollup%2frollup-linux-s390x-gnu 240ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@rollup%2frollup-linux-ppc64-gnu 243ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@rollup%2frollup-linux-riscv64-musl 264ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@rollup%2frollup-linux-arm-musleabihf 273ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@rollup%2frollup-linux-riscv64-gnu 274ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@rollup%2frollup-android-arm-eabi 276ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@rollup%2frollup-linux-loong64-gnu 282ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@rollup%2frollup-linux-arm64-gnu 284ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@rollup%2frollup-win32-arm64-msvc 286ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@rollup%2frollup-android-arm64 293ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@rollup%2frollup-linux-arm-gnueabihf 294ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@rollup%2frollup-win32-x64-gnu 295ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@rollup%2frollup-darwin-arm64 299ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@rollup%2frollup-darwin-x64 300ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@rollup%2frollup-freebsd-arm64 307ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@rollup%2frollup-win32-x64-msvc 311ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@rollup%2frollup-win32-ia32-msvc 313ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@rollup%2frollup-freebsd-x64 314ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@rollup%2frollup-linux-arm64-musl 316ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@rollup%2frollup-linux-x64-gnu 321ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@rollup%2frollup-linux-x64-musl 323ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@rollup%2frollup-openharmony-arm64 324ms (cache miss)
npm verbose reify failed optional dependency /home/antoninkriz/example/node_modules/fsevents
npm verbose reify failed optional dependency /home/antoninkriz/example/node_modules/@rollup/rollup-win32-x64-msvc
npm verbose reify failed optional dependency /home/antoninkriz/example/node_modules/@rollup/rollup-win32-x64-gnu
npm verbose reify failed optional dependency /home/antoninkriz/example/node_modules/@rollup/rollup-win32-ia32-msvc
npm verbose reify failed optional dependency /home/antoninkriz/example/node_modules/@rollup/rollup-win32-arm64-msvc
npm verbose reify failed optional dependency /home/antoninkriz/example/node_modules/@rollup/rollup-openharmony-arm64
npm verbose reify failed optional dependency /home/antoninkriz/example/node_modules/@rollup/rollup-linux-x64-musl
npm verbose reify failed optional dependency /home/antoninkriz/example/node_modules/@rollup/rollup-linux-s390x-gnu
npm verbose reify failed optional dependency /home/antoninkriz/example/node_modules/@rollup/rollup-linux-riscv64-musl
npm verbose reify failed optional dependency /home/antoninkriz/example/node_modules/@rollup/rollup-linux-riscv64-gnu
npm verbose reify failed optional dependency /home/antoninkriz/example/node_modules/@rollup/rollup-linux-ppc64-gnu
npm verbose reify failed optional dependency /home/antoninkriz/example/node_modules/@rollup/rollup-linux-loong64-gnu
npm verbose reify failed optional dependency /home/antoninkriz/example/node_modules/@rollup/rollup-linux-arm64-musl
npm verbose reify failed optional dependency /home/antoninkriz/example/node_modules/@rollup/rollup-linux-arm64-gnu
npm verbose reify failed optional dependency /home/antoninkriz/example/node_modules/@rollup/rollup-linux-arm-musleabihf
npm verbose reify failed optional dependency /home/antoninkriz/example/node_modules/@rollup/rollup-linux-arm-gnueabihf
npm verbose reify failed optional dependency /home/antoninkriz/example/node_modules/@rollup/rollup-freebsd-x64
npm verbose reify failed optional dependency /home/antoninkriz/example/node_modules/@rollup/rollup-freebsd-arm64
npm verbose reify failed optional dependency /home/antoninkriz/example/node_modules/@rollup/rollup-darwin-x64
npm verbose reify failed optional dependency /home/antoninkriz/example/node_modules/@rollup/rollup-darwin-arm64
npm verbose reify failed optional dependency /home/antoninkriz/example/node_modules/@rollup/rollup-android-arm64
npm verbose reify failed optional dependency /home/antoninkriz/example/node_modules/@rollup/rollup-android-arm-eabi
npm http cache @types/estree@https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz 0ms (cache hit)
npm http cache @rollup/rollup-linux-x64-gnu@https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.53.0.tgz 0ms (cache hit)
npm http cache rollup@https://registry.npmjs.org/rollup/-/rollup-4.53.0.tgz 0ms (cache hit)
npm http fetch GET 200 https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz 53ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/rollup/-/rollup-4.53.0.tgz 81ms (cache miss)
npm http fetch GET 200 https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.53.0.tgz 111ms (cache miss)
npm info run rollup@4.53.0 postinstall node_modules/rollup patch-package
npm info run rollup@4.53.0 postinstall { code: 127, signal: null }
npm verbose stack Error: command failed
npm verbose stack     at promiseSpawn (/censored/node_modules/npm/node_modules/@npmcli/promise-spawn/lib/index.js:22:22)
npm verbose stack     at spawnWithShell (/censored/node_modules/npm/node_modules/@npmcli/promise-spawn/lib/index.js:124:10)
npm verbose stack     at promiseSpawn (/censored/node_modules/npm/node_modules/@npmcli/promise-spawn/lib/index.js:12:12)
npm verbose stack     at runScriptPkg (/censored/node_modules/npm/node_modules/@npmcli/run-script/lib/run-script-pkg.js:79:13)
npm verbose stack     at runScript (/censored/node_modules/npm/node_modules/@npmcli/run-script/lib/run-script.js:9:12)
npm verbose stack     at /censored/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/rebuild.js:331:17
npm verbose stack     at run (/censored/node_modules/npm/node_modules/promise-call-limit/dist/commonjs/index.js:67:22)
npm verbose stack     at /censored/node_modules/npm/node_modules/promise-call-limit/dist/commonjs/index.js:84:9
npm verbose stack     at new Promise (<anonymous>)
npm verbose stack     at callLimit (/censored/node_modules/npm/node_modules/promise-call-limit/dist/commonjs/index.js:35:69)
npm verbose pkgid rollup@4.53.0
npm error code 127
npm error path /home/antoninkriz/example/node_modules/rollup
npm error command failed
npm error command sh -c patch-package
npm error sh: line 1: patch-package: command not found
npm verbose cwd /home/antoninkriz/example
npm verbose os Linux 5.14.0-503.23.2.el9_5.x86_64
npm verbose node v24.9.0
npm verbose npm  v11.6.0
npm notice
npm notice New patch version of npm available! 11.6.0 -> 11.6.2
npm notice Changelog: https://github.com/npm/cli/releases/tag/v11.6.2
npm notice To update run: npm install -g npm@11.6.2
npm notice
npm verbose exit 127
npm verbose code 127
npm error A complete log of this run can be found in: /home/antoninkriz/.npm-cache/_logs/2025-11-07T16_48_38_434Z-debug-0.log

[kyjus25]

@lukastaegert we're broke over here if you could assist, sir 👋 😅

[maximejofes]

We fixed the issue by updating our pnpm version from 8.7.5 to 10.20.0 in our CI !

[brandonocasey]

that's because pnpm stopped running install scripts in some version. I've added:

  "overrides": {
    "rollup": "4.52.5"
  }

to package.json as a work-around for now.

[Aristona]

@lukastaegert ༼ つ ◕_◕ ༽つ Lukas take my energy ༼ つ ◕_◕ ༽つ

[ezeamin]

Beautiful way of starting the weekend!

[SimonSiefke]

The issue seems to be that rollup 4.53.0 introduced a patch-package script to package json, but patch-package is a devdependency, not installed in production.

{
 "scripts": {
    "postinstall": "patch-package" 
  },
  "devDependencies": {
    "patch-package": "^8.0.1", // dev dependency, not installed in production
  }
}

Possibly a solution could be to remove the rollup postinstall script before publishing to npm

Related #6153

[antoninkriz]

As stated by @maximejofes and @brandonocasey PNPM disables postinstall scripts
https://pnpm.io/supply-chain-security
so this does not happen on PNPM v10 and newer.

NPM workaround

With NPM you might achieve the same by

npm install --ignore-scripts

which installs scucessfully ✅

Just be aware that some of your things may or may not break if they really depend on postinstall.
For NPM more can be found here https://blog.npmjs.org/post/141702881055/package-install-scripts-vulnerability

Source of issue

This commit 9a7abe9 (squashed) seems like the source of the issue produced by this commit 133cf7e in PR #6153

Good luck everyone 🫡