fix: remediate vulnerabilities in rollup and fast-xml-parser

[pepol]

• fix: update fast-xml-parser
• fix: update rollup 3.x

Summary by CodeRabbit

• Chores
  • Updated internal dependency resolution to pin specific versions, improving build stability and reproducible installs.
  • Adjusted tooling dependency mappings to ensure compatibility across the build toolchain and avoid version conflicts.
  • No user-facing behavior changes; these updates reduce build and packaging issues developers encounter.

Checklist

• I have discussed my proposed changes in an issue and have received approval to proceed.
• I have followed the coding standards of the project.
• Tests or benchmarks have been added or updated.
• Documentation has been updated on https://github.com/wundergraph/docs-website.
• I have read the Contributors Guide.

Open Source AI Manifesto

This project follows the principles of the Open Source AI Manifesto. Please ensure your contribution aligns with its principles.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e1cf9226-c323-4e69-9d7d-da41663cc004

📥 Commits

Reviewing files that changed from the base of the PR and between f356e8c and c45906c.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• package.json

🚧 Files skipped from review as they are similar to previous changes (1)

• package.json

---

Walkthrough

Updated package.json pnpm.overrides to pin fast-xml-parser to 5.5.6, remap rollup@3.29.5 → 3.30.0, force @rollup/pluginutils's nested rollup to 4.59.0, and keep markdown-it pinned at 14.1.1.

Changes

Cohort / File(s)	Summary
Dependency Resolution Configuration package.json	Modified pnpm.overrides: set fast-xml-parser = 5.5.6, remapped rollup@3.29.5 → 3.30.0, forced @rollup/pluginutils@5.3.0's nested rollup to 4.59.0, retained markdown-it = 14.1.1.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

• feat: update packages to address high severity vulnerabilities #2757: Also updates pnpm.overrides to control Rollup resolution and force a specific nested rollup version.
• fix: remediate several vulnerabilities #2787: Also pins markdown-it to 14.1.1 in pnpm.overrides.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main purpose of the pull request: remediating vulnerabilities by updating rollup and fast-xml-parser versions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 47.53%. Comparing base (a6a6956) to head (c45906c).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2796      +/-   ##
==========================================
+ Coverage   41.70%   47.53%   +5.82%     
==========================================
  Files         791     1065     +274     
  Lines      113325   144278   +30953     
  Branches     8768     9767     +999     
==========================================
+ Hits        47266    68578   +21312     
- Misses      65695    73927    +8232     
- Partials      364     1773    +1409     

see 274 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Router-nonroot image scan passed

✅ No security vulnerabilities found in image:

ghcr.io/wundergraph/cosmo/router:sha-536e9d7904f15b0c2b87659a646e67203dd3bbf7-nonroot

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

package.json (1)

94-94: Optional: consider ^5.5.6 instead of a hard pin.

Switching from >=5.3.6 to an exact 5.5.6 cleanly enforces the fixed version, but it also blocks transitive consumers from picking up future 5.x patch/minor security fixes without another PR here. Since fast-xml-parser already follows semver, ^5.5.6 would still satisfy the remediation floor while letting future patches flow through. Take it or leave it.

♻️ Optional refactor

-      "fast-xml-parser": "5.5.6",
+      "fast-xml-parser": "^5.5.6",

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@package.json` at line 94, Dependency "fast-xml-parser": "5.5.6" is
hard-pinned which prevents receiving future compatible patches; change the
version specifier to a caret range by updating the dependency entry
"fast-xml-parser" to "^5.5.6" in package.json so semver-compatible patch/minor
fixes can be installed automatically while still enforcing the remediation
floor.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@package.json`:
- Line 107: The rollup dependency entry currently identifies a vulnerable
version mapping ("rollup@3.29.5": "3.30.0"); update the dependency to lock to
the patched release (3.30.0) where applicable in package.json and regenerate
your lockfile (npm/yarn/pnpm install) so the actual installed package is 3.30.0,
then run CI tests and a dependency audit (npm audit / yarn audit) to verify the
CVE-2026-27606 fix; ensure any shrinkwrap or lock artifacts are committed so the
upgrade is enforced in downstream installs.
- Around line 107-108: The overrides currently pin two rollup majors and use a
brittle nested selector: change the nested selector
"@rollup/pluginutils@5.3.0>rollup": "4.59.0" to a broader parent selector such
as "@rollup/pluginutils@5>rollup" so the override survives patch bumps, and
consolidate the workspace to a single rollup major (either force rollup to 3.x
everywhere or 4.x everywhere) by aligning the "rollup@3.29.5": "3.30.0" entry
and the nested "@rollup/pluginutils...>rollup" override to the same major to
remove duplicate rollup majors from the resolved tree.

---

Nitpick comments:
In `@package.json`:
- Line 94: Dependency "fast-xml-parser": "5.5.6" is hard-pinned which prevents
receiving future compatible patches; change the version specifier to a caret
range by updating the dependency entry "fast-xml-parser" to "^5.5.6" in
package.json so semver-compatible patch/minor fixes can be installed
automatically while still enforcing the remediation floor.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2d426713-0e79-423f-bf20-70092d0a0ee6

📥 Commits

Reviewing files that changed from the base of the PR and between a6a6956 and f356e8c.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• package.json

[comatory]

I'm thinking we should scope these. It seems like it's required by playground and it's not obvious why we have two/three bundlers (webpack, vite, rollup). I think rollup is used internally by vite.

I made a ticket to fix this eventually: https://linear.app/wundergraph/issue/ENG-9447/cosmoplayground