Skip to content

security: remove unused rollup-plugin-serve (CVE-2020-7684)#1077

Merged
yogeshchoudhary147 merged 1 commit into
mainfrom
fix/remove-rollup-plugin-serve-cve
Apr 8, 2026
Merged

security: remove unused rollup-plugin-serve (CVE-2020-7684)#1077
yogeshchoudhary147 merged 1 commit into
mainfrom
fix/remove-rollup-plugin-serve-cve

Conversation

@yogeshchoudhary147
Copy link
Copy Markdown
Contributor

Summary

  • Removes rollup-plugin-serve from devDependencies — it was never used in the codebase (rollup-plugin-dev serves the same purpose)
  • Fixes SNYK-JS-ROLLUPPLUGINSERVE-585897 / CVE-2020-7684 (Directory Traversal, CVSS 9.8)
  • Also removes transitive dependencies mime@3.0.0 and opener@1.5.2 which were only pulled in by this package

No functional impact.

@yogeshchoudhary147 yogeshchoudhary147 requested a review from a team as a code owner April 8, 2026 11:28
@yogeshchoudhary147 yogeshchoudhary147 merged commit a2d89a5 into main Apr 8, 2026
12 checks passed
@yogeshchoudhary147 yogeshchoudhary147 deleted the fix/remove-rollup-plugin-serve-cve branch April 8, 2026 11:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants