Skip to content

Commit

Permalink
upgrade rollup to 3.29.5
Browse files Browse the repository at this point in the history
Summary:
The most recent release of react scripts is pulling an older version of rollup, which has a bunch of vulnerabilities associated with it (see associated task).

Since this hasn't been fixed yet ([see this GitHub issue](facebook/create-react-app#13671)), let's just pin it to the first version that fixes this. We cannot add overrides because we are using yarn.

Reviewed By: quark-zju

Differential Revision: D63459489

fbshipit-source-id: b047610af75b89a38b8f5f4e212061114ba098d3
  • Loading branch information
sggutier authored and facebook-github-bot committed Sep 27, 2024
1 parent e828bc2 commit 15a0aea
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 4 deletions.
3 changes: 3 additions & 0 deletions eden/contrib/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -20,5 +20,8 @@
"prettier-check": "prettier --check .",
"prettier-fix": "prettier --write ."
},
"resolutions": {
"rollup": "3.29.5"
},
"dependencies": {}
}
8 changes: 4 additions & 4 deletions eden/contrib/yarn.lock
Original file line number Diff line number Diff line change
Expand Up @@ -9452,10 +9452,10 @@ rollup-plugin-terser@^7.0.0:
serialize-javascript "^4.0.0"
terser "^5.0.0"

rollup@^2.43.1:
version "2.77.1"
resolved "https://registry.npmjs.org/rollup/-/rollup-2.77.1.tgz"
integrity sha512-GhutNJrvTYD6s1moo+kyq7lD9DeR5HDyXo4bDFlDSkepC9kVKY+KK/NSZFzCmeXeia3kEzVuToQmHRdugyZHxw==
rollup@3.29.5, rollup@^2.43.1:
version "3.29.5"
resolved "https://registry.yarnpkg.com/rollup/-/rollup-3.29.5.tgz#8a2e477a758b520fb78daf04bca4c522c1da8a54"
integrity sha512-GVsDdsbJzzy4S/v3dqWPJ7EfvZJfCHiDqe80IyrF59LYuP+e6U1LJoUqeuqRbwAWoMNoXivMNeNAOf5E22VA1w==
optionalDependencies:
fsevents "~2.3.2"

Expand Down

0 comments on commit 15a0aea

Please sign in to comment.