Bump rollup from 3.20.6 to 3.30.0 by dependabot[bot] · Pull Request #6123 · EdgeApp/edge-react-gui

dependabot · 2026-07-27T23:40:44Z

Bumps rollup from 3.20.6 to 3.30.0.

Release notes

v3.30.0

3.30.0

2026-02-22

Features

Throw when the generated bundle contains paths that would leave the output directory (#6276)

Pull Requests

#6276: Validate bundle stays within output dir (@lukastaegert)

Changelog

Sourced from rollup's changelog.

3.30.0

2026-02-22

Features

Throw when the generated bundle contains paths that would leave the output directory (#6276)

Pull Requests

#6276: Validate bundle stays within output dir (@lukastaegert)

3.29.5

2024-09-21

Bug Fixes

Resolve CVE-2024-43788

3.29.4

2023-09-28

Bug Fixes

Fix static analysis when an exported function uses callbacks (#5158)

Pull Requests

#5158: Deoptimize all parameters when losing track of a function (@lukastaegert)

3.29.3

2023-09-24

Bug Fixes

Fix a bug where code was wrongly tree-shaken after mutating function parameters (#5153)

Pull Requests

#5145: docs: improve the docs repl appearance in the light mode (@TrickyPi)

#5148: chore(deps): update dependency @vue/eslint-config-typescript to v12 (@renovate[bot])

#5149: chore(deps): lock file maintenance minor/patch updates (@renovate[bot])

#5153: Fully deoptimize first level path when deoptimizing nested parameter paths (@lukastaegert)

3.29.2

2023-09-15

... (truncated)

Commits

d91d5e1 3.30.0
9677409 Update release script for backports
c8cf1f9 Validate bundle stays within output dir (#6276)
dfd233d 3.29.5
2ef77c0 Fix DOM Clobbering CVE
a6448b9 3.29.4
4e92d60 Deoptimize all parameters when losing track of a function (#5158)
801ffd1 3.29.3
353e462 Fully deoptimize first level path when deoptimizing nested parameter paths (#...
a1a89e7 chore(deps): update dependency @vue/eslint-config-typescript to v12 (#5148)
Additional commits viewable in compare view

Note

Low Risk
Dev-only bundler upgrade with no runtime or application code changes; main practical risk is a rollup build failing if output paths would escape the output directory.

Overview
Updates the devDependency rollup from 3.20.6 to ^3.30.0 in package.json, with the matching lockfile entry for node_modules/rollup.

This is a dependency-only change—no app or build config edits. The jump includes rollup fixes (tree-shaking, static analysis) and 3.29.5’s CVE-2024-43788 security fix, plus 3.30.0’s stricter check that bundle output paths stay inside the output directory.

^{Reviewed by Cursor Bugbot for commit d69c1a5. Bugbot is set up for automated code reviews on this repo. Configure here.}

socket-security · 2026-07-27T23:41:30Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	rollup@3.20.6 ⏵ 3.30.0	^-1	⁺²²		^-2

View full report

Bumps [rollup](https://github.com/rollup/rollup) from 3.20.6 to 3.30.0. - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/v3.30.0/CHANGELOG.md) - [Commits](rollup/rollup@v3.20.6...v3.30.0) --- updated-dependencies: - dependency-name: rollup dependency-version: 3.30.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-05T23:44:44Z