chore(deps-dev): bump rollup from 4.57.1 to 4.61.0#584
Conversation
Bumps [rollup](https://github.com/rollup/rollup) from 4.57.1 to 4.61.0. - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.57.1...v4.61.0) --- updated-dependencies: - dependency-name: rollup dependency-version: 4.61.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 102f3e6. Configure here.
| }, | ||
| "devDependencies": { | ||
| "@testing-library/dom": "^10.4.1", | ||
| "@vitest/coverage-v8": "^4.0.18", |
There was a problem hiding this comment.
Lock file drops coverage dependency, breaking CI coverage step
High Severity
This lock file regeneration removes @vitest/coverage-v8 and all its transitive dependencies (e.g. istanbul-lib-coverage, istanbul-reports, magicast, etc.). The CI workflow (.github/workflows/test.yml) has a dashboard-coverage job that runs npx vitest run --config dashboard/vitest.config.ts --coverage, and dashboard/vitest.config.ts explicitly sets coverage.provider: "v8". After merging, npm ci will no longer install @vitest/coverage-v8, causing the CI coverage job to fail.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 102f3e6. Configure here.
Bumps rollup from 4.57.1 to 4.61.0.
Release notes
Sourced from rollup's releases.
... (truncated)
Changelog
Sourced from rollup's changelog.
... (truncated)
Commits
765167f4.61.00f547ebSort entry modules to make chunk hash names deterministic (#6391)5838787docs: fix broken links (#6400)cc0f51achore(deps): update react monorepo to v19 (#6395)dd30037fix(deps): update rust crate swc_compiler_base to v57 (#6396)cb86c3echore(deps): lock file maintenance (#6397)db2b6e0fix(deps): update minor/patch updates (#6394)c16e493chore(deps): lock file maintenance (#6389)65397f1chore(deps): update aws-actions/configure-aws-credentials action to v6 (#6387)6817778fix(deps): update minor/patch updates (#6386)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Dev-only lockfile dependency bump with no application source changes; main effect is test/bundler tooling and reproducible chunk hashes.
Overview
Updates
package-lock.jsonto pull Rollup4.61.0(from4.57.1), including all platform-specific@rollup/rollup-*optional packages and@types/estree1.0.9. Transitive packages tied to the removed@vitest/coverage-v8dev dependency (e.g. Istanbul,magicast, related Babel/jridgewell entries) are dropped from the lockfile.The lockfile root also records
shipwright-cli3.3.0, a newcctbin alias toscripts/sw, and no@vitest/coverage-v8under the root package—verify those match intentionalpackage.jsonchanges on this branch, not only the Rollup bump.Reviewer note: Upstream Rollup 4.60.x–4.61.x emphasizes more stable/deterministic chunk hashes; expect fewer flaky hash diffs in Vitest/Rollup-powered bundling, not runtime CLI behavior changes.
Reviewed by Cursor Bugbot for commit 102f3e6. Bugbot is set up for automated code reviews on this repo. Configure here.