Upgrading rollup 2 to 3
Breaking2.80.0 → 3.30.0Security2Platform1Deprecated2New109Changed59Fixed143Other111
SecurityHighRollup 4 has Arbitrary File Write via Path TraversalGHSA-mw96-cpmx-2vgc · CVE-2026-27606 ↗
BreakingUpgrade verdict
A platform requirement change and 2 security fixes.
In plain terms
- [v3.0] Deprecate Node 12.
- Rollup 4 has Arbitrary File Write via Path Traversal
- DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS
- [v3.0] Remove actively deprecated features, show warnings for other deprecated features.
Must act 5 items need code or config changes
Node.js requirement changed in 3.0.0-5: >=10.0.0 → >=14.18.0.
What you must change
Security2
Rollup 4 has Arbitrary File Write via Path Traversal
HighDOM Clobbering Gadget found in rollup bundled scripts that leads to XSS
High · CVSS 6.4Platform1
[v3.0] Deprecate Node 12.
Deprecations to plan for
Deprecated2
[v3.0] Remove actively deprecated features, show warnings for other deprecated features.
[v3.0] Show deprecation warning for maxParallelFileReads.
API changes
Generated by DepDelta from published .d.ts files. Not mixed with prose notes.
- added:
function getLogFilter(filters: string[]): (log: RollupLog) => boolean - added:
type GetLogFilter = typeof getLogFilter
- added:
function loadConfigFile(fileName: string, commandOptions: any, watchMode?: boolean): Promise<{ options: MergedRollupOptions[]; warnings: BatchWarnings }> - added:
interface BatchWarnings - added:
property BatchWarnings.add: (warning: RollupLog) => void - added:
property BatchWarnings.flush: () => void - added:
property BatchWarnings.log: LogHandler - added:
readonly property BatchWarnings.count: number - added:
readonly property BatchWarnings.warningOccurred: boolean - added:
type LoadConfigFile = typeof loadConfigFile
- removed:
interface RollupAwaitingEmitter<T extends { [event: string]: (...args: any) => any }> extends TypedEventEmitter<T> - removed:
interface RollupLogProps - removed:
interface RollupWarning extends RollupLogProps - removed:
method RollupAwaitingEmitter.close(): Promise<void> - removed:
method RollupAwaitingEmitter.emitAndAwait<K extends keyof T>(event: K, ...args: Parameters<T[K]>): Promise<ReturnType<T[K]>[]> - removed:
method RollupAwaitingEmitter.onCurrentAwaited<K extends keyof T>(event: K, listener: (...args: Parameters<T[K]>) => Promise<ReturnType<T[K]>>): this - removed:
method RollupAwaitingEmitter.removeAwaited(): this - removed:
property FunctionPluginHooks.resolveAssetUrl: ResolveAssetUrlHook - removed:
property OutputAsset.isAsset: true - removed:
property PluginContext.emitAsset: EmitAsset - removed:
property PluginContext.emitChunk: EmitChunk - removed:
property PluginContext.getAssetFileName: (assetReferenceId: string) => string - removed:
property PluginContext.getChunkFileName: (chunkReferenceId: string) => string - removed:
property PluginContext.isExternal: IsExternal - removed:
property PluginContext.resolveId: (source: string, importer?: string) => Promise<string | null> - removed:
property PreRenderedChunk.modules: { [id: string]: RenderedModule } - removed:
property RenderedChunk.code?: string - removed:
property RenderedChunk.map?: SourceMap - removed:
property RollupError.parserError?: Error - removed:
property RollupLogProps.code?: string - removed:
property RollupLogProps.frame?: string - removed:
property RollupLogProps.hook?: string - removed:
property RollupLogProps.id?: string - removed:
property RollupLogProps.loc?: { column: number; file?: string; line: number } - removed:
property RollupLogProps.message: string - removed:
property RollupLogProps.name?: string - removed:
property RollupLogProps.plugin?: string - removed:
property RollupLogProps.pluginCode?: string - removed:
property RollupLogProps.pos?: number - removed:
property RollupLogProps.url?: string - removed:
property RollupWarning.chunkName?: string - removed:
property RollupWarning.cycle?: string[] - removed:
property RollupWarning.exportName?: string - removed:
property RollupWarning.exporter?: string - removed:
property RollupWarning.guess?: string - removed:
property RollupWarning.importer?: string - removed:
property RollupWarning.missing?: string - removed:
property RollupWarning.modules?: string[] - removed:
property RollupWarning.names?: string[] - removed:
property RollupWarning.reexporter?: string - removed:
property RollupWarning.source?: string - removed:
property RollupWarning.sources?: string[] - removed:
property TreeshakingOptions.pureExternalModules?: PureModulesOption - removed:
type EmitAsset = (name: string, source?: string | Uint8Array) => string - removed:
type EmitChunk = (id: string, options?: { name?: string }) => string - removed:
type PureModulesOption = boolean | string[] | IsPureModule - removed:
type ResolveAssetUrlHook = (this: PluginContext, options: { assetFileName: string; chunkId: string; format: InternalModuleFormat; moduleId: string; relativeAssetPath: string }) => string… - removed:
type WarningHandler = (warning: RollupWarning) => void - changed:
interface MergedRollupOptions extends InputOptions → interface MergedRollupOptions extends InputOptionsWithPlugins - changed:
interface Plugin extends OutputPlugin, Partial<PluginHooks> → interface Plugin<A = any> extends OutputPlugin, Partial<PluginHooks> - changed:
interface RollupError extends RollupLogProps → interface RollupError extends RollupLog - changed:
property ExistingDecodedSourceMap.mappings: SourceMapSegment[][] → readonly property ExistingDecodedSourceMap.mappings: SourceMapSegment[][] - changed:
property ExistingDecodedSourceMap.sourcesContent?: string[] → property ExistingDecodedSourceMap.sourcesContent?: (string | null)[] - changed:
property ExistingRawSourceMap.sourcesContent?: string[] → property ExistingRawSourceMap.sourcesContent?: (string | null)[] - changed:
property FunctionPluginHooks.augmentChunkHash: (this: PluginContext, chunk: PreRenderedChunk) => string | void → property FunctionPluginHooks.augmentChunkHash: (this: PluginContext, chunk: RenderedChunk) => string | void - changed:
property FunctionPluginHooks.buildEnd: (this: PluginContext, err?: Error) => void → property FunctionPluginHooks.buildEnd: (this: PluginContext, error?: Error) => void - changed:
property FunctionPluginHooks.options: (this: MinimalPluginContext, options: InputOptions) => InputOptions | null | void → property FunctionPluginHooks.options: (this: MinimalPluginContext, options: InputOptions) => InputOptions | NullValue - changed:
property FunctionPluginHooks.outputOptions: (this: PluginContext, options: OutputOptions) => OutputOptions | null | void → property FunctionPluginHooks.outputOptions: (this: PluginContext, options: OutputOptions) => OutputOptions | NullValue - changed:
property FunctionPluginHooks.renderDynamicImport: (this: PluginContext, options: { customResolution: string | null; format: InternalModuleFormat; moduleId: string; targetModuleId: string | null }) => { left: string; right: string } | null | void → property FunctionPluginHooks.renderDynamicImport: (this: PluginContext, options: { customResolution: string | null; format: InternalModuleFormat; moduleId: string; targetModuleId: string | null }) => { left: string; right: string } | NullValue - changed:
property FunctionPluginHooks.renderError: (this: PluginContext, err?: Error) => void → property FunctionPluginHooks.renderError: (this: PluginContext, error?: Error) => void - changed:
property InputOptions.acornInjectPlugins?: (() => unknown)[] | (() => unknown) → property InputOptions.acornInjectPlugins?: ((...arguments_: any[]) => unknown)[] | ((...arguments_: any[]) => unknown) - changed:
property InputOptions.cache?: false | RollupCache → property InputOptions.cache?: boolean | RollupCache - changed:
property InputOptions.moduleContext?: ((id: string) => string | null | void) | { [id: string]: string } → property InputOptions.moduleContext?: ((id: string) => string | NullValue) | { [id: string]: string } - changed:
property InputOptions.plugins?: (Plugin | null | false | undefined)[] → property InputOptions.plugins?: InputPluginOption - changed:
property NormalizedInputOptions.onwarn: WarningHandler → property NormalizedInputOptions.onwarn: (warning: RollupLog) => void - changed:
property NormalizedOutputOptions.banner: () => string | Promise<string> → property NormalizedOutputOptions.banner: AddonFunction - changed:
property NormalizedOutputOptions.esModule: boolean → property NormalizedOutputOptions.esModule: boolean | 'if-default-prop' - changed:
property NormalizedOutputOptions.footer: () => string | Promise<string> → property NormalizedOutputOptions.footer: AddonFunction - changed:
property NormalizedOutputOptions.intro: () => string | Promise<string> → property NormalizedOutputOptions.intro: AddonFunction - changed:
property NormalizedOutputOptions.outro: () => string | Promise<string> → property NormalizedOutputOptions.outro: AddonFunction - changed:
property OutputOptions.banner?: string | (() => string | Promise<string>) → property OutputOptions.banner?: string | AddonFunction - changed:
property OutputOptions.esModule?: boolean → property OutputOptions.esModule?: boolean | 'if-default-prop' - changed:
property OutputOptions.footer?: string | (() => string | Promise<string>) → property OutputOptions.footer?: string | AddonFunction - changed:
property OutputOptions.intro?: string | (() => string | Promise<string>) → property OutputOptions.intro?: string | AddonFunction - changed:
property OutputOptions.outro?: string | (() => string | Promise<string>) → property OutputOptions.outro?: string | AddonFunction - changed:
property OutputOptions.plugins?: (OutputPlugin | null | false | undefined)[] → property OutputOptions.plugins?: OutputPluginOption - changed:
property Plugin.api?: any → property Plugin.api?: A - changed:
property PluginContext.error: (err: RollupError | string, pos?: number | { column: number; line: number }) => never → property PluginContext.error: (error: RollupError | string) => never - changed:
property PluginContext.resolve: (source: string, importer?: string, options?: { custom?: CustomPluginOptions; isEntry?: boolean; skipSelf?: boolean }) => Promise<ResolvedId | null> → property PluginContext.resolve: (source: string, importer?: string, options?: { assertions?: Record<string, string>; custom?: CustomPluginOptions; isEntry?: boolean; skipSelf?: boolean }) => Promise<ResolvedId | null> - changed:
property PluginContext.warn: (warning: RollupWarning | string, pos?: number | { column: number; line: number }) => void → property PluginContext.warn: LoggingFunction - changed:
property RenderedModule.code: string | null → readonly property RenderedModule.code: string | null - changed:
property SourceMap.sourcesContent: string[] → property SourceMap.sourcesContent: (string | null)[] - changed:
type AddonHookFunction = (this: PluginContext) => string | Promise<string> → type AddonHookFunction = (this: PluginContext, chunk: RenderedChunk) => string | Promise<string> - changed:
type DecodedSourceMapOrMissing = { mappings?: never; missing: true; plugin: string } | ExistingDecodedSourceMap → type DecodedSourceMapOrMissing = { missing: true; plugin: string } | (ExistingDecodedSourceMap & { missing?: false }) - changed:
type EmittedFile = EmittedAsset | EmittedChunk → type EmittedFile = EmittedAsset | EmittedChunk | EmittedPrebuiltChunk - changed:
type ExternalOption = (string | RegExp)[] | string | RegExp | ((source: string, importer: string | undefined, isResolved: boolean) => boolean | null | void) → type ExternalOption = (string | RegExp)[] | string | RegExp | ((source: string, importer: string | undefined, isResolved: boolean) => boolean | NullValue) - changed:
type FirstPluginHooks = 'load' | 'renderDynamicImport' | 'resolveAssetUrl' | 'resolveDynamicImport' | 'resolveFileUrl' | 'resolveId' | 'resolveImportMeta' | 'shouldTransformCachedModu… → type FirstPluginHooks = 'load' | 'renderDynamicImport' | 'resolveDynamicImport' | 'resolveFileUrl' | 'resolveId' | 'resolveImportMeta' | 'shouldTransformCachedModule' - changed:
type GetManualChunk = (id: string, api: GetManualChunkApi) => string | null | void → type GetManualChunk = (id: string, meta: ManualChunkMeta) => string | NullValue - changed:
type InteropType = boolean | 'auto' | 'esModule' | 'default' | 'defaultOnly' → type InteropType = 'compat' | 'auto' | 'esModule' | 'default' | 'defaultOnly' - changed:
type IsPureModule = (id: string) => boolean | null | void → type IsPureModule = (id: string) => boolean | NullValue - changed:
type LoadResult = SourceDescription | string | null | void → type LoadResult = SourceDescription | string | NullValue - changed:
type OutputPluginHooks = 'augmentChunkHash' | 'generateBundle' | 'outputOptions' | 'renderChunk' | 'renderDynamicImport' | 'renderError' | 'renderStart' | 'resolveAssetUrl' | 'resolveF… → type OutputPluginHooks = 'augmentChunkHash' | 'generateBundle' | 'outputOptions' | 'renderChunk' | 'renderDynamicImport' | 'renderError' | 'renderStart' | 'resolveFileUrl' | 'resolveIm… - changed:
type PluginImpl<O extends object = object> = (options?: O) => Plugin → type PluginImpl<O extends object = object, A = any> = (options?: O) => Plugin<A> - changed:
type RenderChunkHook = (this: PluginContext, code: string, chunk: RenderedChunk, options: NormalizedOutputOptions) => { code: string; map?: SourceMapInput } | string | null | undefin… → type RenderChunkHook = (this: PluginContext, code: string, chunk: RenderedChunk, options: NormalizedOutputOptions, meta: { chunks: Record<string, RenderedChunk> }) => { code: string;… - changed:
type ResolveDynamicImportHook = (this: PluginContext, specifier: string | AcornNode, importer: string) => ResolveIdResult → type ResolveDynamicImportHook = (this: PluginContext, specifier: string | AcornNode, importer: string, options: { assertions: Record<string, string> }) => ResolveIdResult - changed:
type ResolveFileUrlHook = (this: PluginContext, options: { assetReferenceId: string | null; chunkId: string; chunkReferenceId: string | null; fileName: string; format: InternalModuleFor… → type ResolveFileUrlHook = (this: PluginContext, options: { chunkId: string; fileName: string; format: InternalModuleFormat; moduleId: string; referenceId: string; relativePath: string }… - changed:
type ResolveIdHook = (this: PluginContext, source: string, importer: string | undefined, options: { custom?: CustomPluginOptions; isEntry: boolean }) => ResolveIdResult → type ResolveIdHook = (this: PluginContext, source: string, importer: string | undefined, options: { assertions: Record<string, string>; custom?: CustomPluginOptions; isEntry: boole… - changed:
type ResolveIdResult = string | false | null | void | PartialResolvedId → type ResolveIdResult = string | NullValue | false | PartialResolvedId - changed:
type ResolveImportMetaHook = (this: PluginContext, prop: string | null, options: { chunkId: string; format: InternalModuleFormat; moduleId: string }) => string | null | void → type ResolveImportMetaHook = (this: PluginContext, property: string | null, options: { chunkId: string; format: InternalModuleFormat; moduleId: string }) => string | NullValue - changed:
type RollupWatcher = RollupAwaitingEmitter<{ change: (id: string, change: { event: ChangeEvent }) => void; close: () => void; event: (event: RollupWatcherEvent) => void; restart: (… → type RollupWatcher = AwaitingEventEmitter<{ change: (id: string, change: { event: ChangeEvent }) => void; close: () => void; event: (event: RollupWatcherEvent) => void; restart: ()… - changed:
type SequentialPluginHooks = 'augmentChunkHash' | 'generateBundle' | 'options' | 'outputOptions' | 'renderChunk' | 'transform' → type SequentialPluginHooks = 'augmentChunkHash' | 'generateBundle' | 'onLog' | 'options' | 'outputOptions' | 'renderChunk' | 'transform' - changed:
type SyncPluginHooks = 'augmentChunkHash' | 'outputOptions' | 'renderDynamicImport' | 'resolveAssetUrl' | 'resolveFileUrl' | 'resolveImportMeta' → type SyncPluginHooks = 'augmentChunkHash' | 'onLog' | 'outputOptions' | 'renderDynamicImport' | 'resolveFileUrl' | 'resolveImportMeta' - changed:
type TransformResult = string | null | void | Partial<SourceDescription> → type TransformResult = string | NullValue | Partial<SourceDescription> - changed:
type WarningHandlerWithDefault = (warning: RollupWarning, defaultHandler: WarningHandler) => void → type WarningHandlerWithDefault = (warning: RollupLog, defaultHandler: LoggingFunction) => void - added:
function defineConfig(optionsFunction: RollupOptionsFunction): RollupOptionsFunction - added:
interface AwaitingEventEmitter<T extends { [event: string]: (...parameters: any) => any }> - added:
interface EmittedPrebuiltChunk - added:
interface InputOptionsWithPlugins extends InputOptions - added:
interface RollupLog - added:
method AwaitingEventEmitter.close(): Promise<void> - added:
method AwaitingEventEmitter.emit<K extends keyof T>(event: K, ...parameters: Parameters<T[K]>): Promise<unknown> - added:
method AwaitingEventEmitter.off<K extends keyof T>(event: K, listener: AwaitedEventListener<T, K>): this - added:
method AwaitingEventEmitter.on<K extends keyof T>(event: K, listener: AwaitedEventListener<T, K>): this - added:
method AwaitingEventEmitter.onCurrentRun<K extends keyof T>(event: K, listener: (...parameters: Parameters<T[K]>) => Promise<ReturnType<T[K]>>): this - added:
method AwaitingEventEmitter.removeAllListeners(): this - added:
method AwaitingEventEmitter.removeListenersForCurrentRun(): this - added:
property EmittedAsset.needsCodeReference?: boolean - added:
property EmittedPrebuiltChunk.code: string - added:
property EmittedPrebuiltChunk.exports?: string[] - added:
property EmittedPrebuiltChunk.fileName: string - added:
property EmittedPrebuiltChunk.map?: SourceMap - added:
property EmittedPrebuiltChunk.sourcemapFileName?: string - added:
property EmittedPrebuiltChunk.type: 'prebuilt-chunk' - added:
property ExistingDecodedSourceMap.x_google_ignoreList?: number[] - added:
property ExistingRawSourceMap.x_google_ignoreList?: number[] - added:
property FunctionPluginHooks.onLog: (this: MinimalPluginContext, level: LogLevel, log: RollupLog) => boolean | NullValue - added:
property InputOptions.experimentalLogSideEffects?: boolean - added:
property InputOptions.logLevel?: LogLevelOption - added:
property InputOptions.onLog?: LogHandlerWithDefault - added:
property InputOptionsWithPlugins.plugins: Plugin[] - added:
property MinimalPluginContext.debug: LoggingFunction - added:
property MinimalPluginContext.error: (error: RollupError | string) => never - added:
property MinimalPluginContext.info: LoggingFunction - added:
property MinimalPluginContext.warn: LoggingFunction - added:
property NormalizedInputOptions.experimentalLogSideEffects: boolean - added:
property NormalizedInputOptions.logLevel: LogLevelOption - added:
property NormalizedInputOptions.onLog: LogHandler - added:
property NormalizedOutputOptions.dynamicImportInCjs: boolean - added:
property NormalizedOutputOptions.experimentalDeepDynamicChunkOptimization: boolean - added:
property NormalizedOutputOptions.experimentalMinChunkSize: number - added:
property NormalizedOutputOptions.externalImportAssertions: boolean - added:
property NormalizedOutputOptions.sourcemapFileNames: string | ((chunkInfo: PreRenderedChunk) => string) | undefined - added:
property NormalizedOutputOptions.sourcemapIgnoreList: SourcemapIgnoreListOption - added:
property NormalizedTreeshakingOptions.manualPureFunctions: readonly string[] - added:
property OutputAsset.needsCodeReference: boolean - added:
property OutputChunk.map: SourceMap | null - added:
property OutputChunk.preliminaryFileName: string - added:
property OutputChunk.sourcemapFileName: string | null - added:
property OutputOptions.dynamicImportInCjs?: boolean - added:
property OutputOptions.experimentalDeepDynamicChunkOptimization?: boolean - added:
property OutputOptions.experimentalMinChunkSize?: number - added:
property OutputOptions.externalImportAssertions?: boolean - added:
property OutputOptions.sourcemapFileNames?: string | ((chunkInfo: PreRenderedChunk) => string) - added:
property OutputOptions.sourcemapIgnoreList?: boolean | SourcemapIgnoreListOption - added:
property OutputPlugin.version?: string - added:
property PluginContext.debug: LoggingFunction - added:
property PluginContext.info: LoggingFunction - added:
property PreRenderedChunk.moduleIds: string[] - added:
property RenderedChunk.modules: { [id: string]: RenderedModule } - added:
property ResolvedId.resolvedBy: string - added:
property RollupError.name?: string - added:
property RollupLog.binding?: string - added:
property RollupLog.cause?: unknown - added:
property RollupLog.code?: string - added:
property RollupLog.exporter?: string - added:
property RollupLog.frame?: string - added:
property RollupLog.hook?: string - added:
property RollupLog.id?: string - added:
property RollupLog.ids?: string[] - added:
property RollupLog.loc?: { column: number; file?: string; line: number } - added:
property RollupLog.message: string - added:
property RollupLog.meta?: any - added:
property RollupLog.names?: string[] - added:
property RollupLog.plugin?: string - added:
property RollupLog.pluginCode?: unknown - added:
property RollupLog.pos?: number - added:
property RollupLog.reexporter?: string - added:
property RollupLog.stack?: string - added:
property RollupLog.url?: string - added:
property TransformPluginContext.debug: LoggingFunctionWithPosition - added:
property TransformPluginContext.error: (error: RollupError | string, pos?: number | { column: number; line: number }) => never - added:
property TransformPluginContext.info: LoggingFunctionWithPosition - added:
property TransformPluginContext.warn: LoggingFunctionWithPosition - added:
type AwaitedEventListener<T extends { [event: string]: (...parameters: any) => any }, K extends keyof T> = (...parameters: Parameters<T[K]>) => void | Promise<void> - added:
type InputPluginOption = MaybePromise<Plugin | NullValue | false | InputPluginOption[]> - added:
type LogHandler = (level: LogLevel, log: RollupLog) => void - added:
type LogHandlerWithDefault = (level: LogLevel, log: RollupLog, defaultHandler: LogOrStringHandler) => void - added:
type LogLevel = 'warn' | 'info' | 'debug' - added:
type LogLevelOption = LogLevel | 'silent' - added:
type LogOrStringHandler = (level: LogLevel | 'error', log: RollupLog | string) => void - added:
type LoggingFunction = (log: RollupLog | string | (() => RollupLog | string)) => void - added:
type ResolveIdResultWithoutNullValue = string | false | PartialResolvedId - added:
type RollupOptionsFunction = (commandLineArguments: Record<string, any>) => MaybePromise<RollupOptions | RollupOptions[]> - added:
type RollupWarning = RollupLog - added:
type SourcemapIgnoreListOption = (relativeSourcePath: string, sourcemapPath: string) => boolean - added:
type TreeshakingPreset = 'smallest' | 'safest' | 'recommended'