[PR #476] [MERGED] fix: pin Rollup to patched version for CVE-2026-27606 #599

New issue

Closed

opened 2026-05-06 13:09:00 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 13:09:00 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/476
Author: @Divkix
Created: 3/11/2026
Status: ✅ Merged
Merged: 3/11/2026
Merged by: @james-elicx

Base: main ← Head: fix/rollup-cve-2026-27606

📝 Commits (1)

e54fa55 fix: pin rollup to patched version

📊 Changes

2 files changed (+123 additions, -117 deletions)

View changed files

📝 package.json (+3 -0)
📝 pnpm-lock.yaml (+120 -117)

📄 Description

Closes #475.

Summary

This pins the workspace Rollup resolution to a patched version via a pnpm override and refreshes the lockfile.

Why

The repository was resolving rollup@4.57.1, which is affected by CVE-2026-27606 / GHSA-mw96-cpmx-2vgc. vite@7.3.1 accepts newer Rollup versions, so 4.59.0 is a semver-compatible fix.

Changes

add a root pnpm.overrides.rollup entry
refresh pnpm-lock.yaml to resolve rollup@4.59.0

Validation

pnpm why rollup
pnpm exec vite --version
pnpm run fmt:check

Notes

This looks like a build-time/tooling exposure rather than a vinext runtime server issue, but the repo should still stop resolving the vulnerable version.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/476 **Author:** [@Divkix](https://github.com/Divkix) **Created:** 3/11/2026 **Status:** ✅ Merged **Merged:** 3/11/2026 **Merged by:** [@james-elicx](https://github.com/james-elicx) **Base:** `main` ← **Head:** `fix/rollup-cve-2026-27606` --- ### 📝 Commits (1) - [`e54fa55`](https://github.com/cloudflare/vinext/commit/e54fa55e372ca7816cc8f749fbefffe7bcf608da) fix: pin rollup to patched version ### 📊 Changes **2 files changed** (+123 additions, -117 deletions) <details> <summary>View changed files</summary> 📝 `package.json` (+3 -0) 📝 `pnpm-lock.yaml` (+120 -117) </details> ### 📄 Description Closes #475. ## Summary This pins the workspace Rollup resolution to a patched version via a pnpm override and refreshes the lockfile. ## Why The repository was resolving `rollup@4.57.1`, which is affected by `CVE-2026-27606` / `GHSA-mw96-cpmx-2vgc`. `vite@7.3.1` accepts newer Rollup versions, so `4.59.0` is a semver-compatible fix. ## Changes - add a root `pnpm.overrides.rollup` entry - refresh `pnpm-lock.yaml` to resolve `rollup@4.59.0` ## Validation - `pnpm why rollup` - `pnpm exec vite --version` - `pnpm run fmt:check` ## Notes This looks like a build-time/tooling exposure rather than a vinext runtime server issue, but the repo should still stop resolving the vulnerable version. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>