fix: remediate vulnerabilities in rollup and fast-xml-parser by pepol · Pull Request #2796 · wundergraph/cosmo

pepol · 2026-04-27T16:33:41Z

fix: update fast-xml-parser
fix: update rollup 3.x

Summary by CodeRabbit

Chores
- Updated internal dependency resolution to pin specific versions, improving build stability and reproducible installs.
- Adjusted tooling dependency mappings to ensure compatibility across the build toolchain and avoid version conflicts.
- No user-facing behavior changes; these updates reduce build and packaging issues developers encounter.

Checklist

I have discussed my proposed changes in an issue and have received approval to proceed.
I have followed the coding standards of the project.
Tests or benchmarks have been added or updated.
Documentation has been updated on https://github.com/wundergraph/docs-website.
I have read the Contributors Guide.

Open Source AI Manifesto

This project follows the principles of the Open Source AI Manifesto. Please ensure your contribution aligns with its principles.

claude

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

coderabbitai · 2026-04-27T16:33:59Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e1cf9226-c323-4e69-9d7d-da41663cc004

📥 Commits

Reviewing files that changed from the base of the PR and between f356e8c and c45906c.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

package.json

🚧 Files skipped from review as they are similar to previous changes (1)

package.json

Walkthrough

Updated package.json pnpm.overrides to pin fast-xml-parser to 5.5.6, remap rollup@3.29.5 → 3.30.0, force @rollup/pluginutils's nested rollup to 4.59.0, and keep markdown-it pinned at 14.1.1.

Changes

Cohort / File(s)	Summary
Dependency Resolution Configuration `package.json`	Modified `pnpm.overrides`: set `fast-xml-parser` = `5.5.6`, remapped `rollup@3.29.5` → `3.30.0`, forced `@rollup/pluginutils@5.3.0`'s nested `rollup` to `4.59.0`, retained `markdown-it` = `14.1.1`.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

feat: update packages to address high severity vulnerabilities #2757: Also updates pnpm.overrides to control Rollup resolution and force a specific nested rollup version.
fix: remediate several vulnerabilities #2787: Also pins markdown-it to 14.1.1 in pnpm.overrides.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main purpose of the pull request: remediating vulnerabilities by updating rollup and fast-xml-parser versions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

codecov · 2026-04-27T16:35:35Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 47.53%. Comparing base (a6a6956) to head (c45906c).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2796      +/-   ##
==========================================
+ Coverage   41.70%   47.53%   +5.82%     
==========================================
  Files         791     1065     +274     
  Lines      113325   144278   +30953     
  Branches     8768     9767     +999     
==========================================
+ Hits        47266    68578   +21312     
- Misses      65695    73927    +8232     
- Partials      364     1773    +1409

see 274 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-04-27T16:36:01Z

Router-nonroot image scan passed

✅ No security vulnerabilities found in image:

ghcr.io/wundergraph/cosmo/router:sha-536e9d7904f15b0c2b87659a646e67203dd3bbf7-nonroot

coderabbitai

Actionable comments posted: 2

🧹 Nitpick comments (1)

package.json (1)
94-94: Optional: consider ^5.5.6 instead of a hard pin.

Switching from >=5.3.6 to an exact 5.5.6 cleanly enforces the fixed version, but it also blocks transitive consumers from picking up future 5.x patch/minor security fixes without another PR here. Since fast-xml-parser already follows semver, ^5.5.6 would still satisfy the remediation floor while letting future patches flow through. Take it or leave it.
♻️ Optional refactor
-      "fast-xml-parser": "5.5.6",
+      "fast-xml-parser": "^5.5.6",
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@package.json` at line 94, Dependency "fast-xml-parser": "5.5.6" is
hard-pinned which prevents receiving future compatible patches; change the
version specifier to a caret range by updating the dependency entry
"fast-xml-parser" to "^5.5.6" in package.json so semver-compatible patch/minor
fixes can be installed automatically while still enforcing the remediation
floor.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@package.json`:
- Line 107: The rollup dependency entry currently identifies a vulnerable
version mapping ("rollup@3.29.5": "3.30.0"); update the dependency to lock to
the patched release (3.30.0) where applicable in package.json and regenerate
your lockfile (npm/yarn/pnpm install) so the actual installed package is 3.30.0,
then run CI tests and a dependency audit (npm audit / yarn audit) to verify the
CVE-2026-27606 fix; ensure any shrinkwrap or lock artifacts are committed so the
upgrade is enforced in downstream installs.
- Around line 107-108: The overrides currently pin two rollup majors and use a
brittle nested selector: change the nested selector
"@rollup/pluginutils@5.3.0>rollup": "4.59.0" to a broader parent selector such
as "@rollup/pluginutils@5>rollup" so the override survives patch bumps, and
consolidate the workspace to a single rollup major (either force rollup to 3.x
everywhere or 4.x everywhere) by aligning the "rollup@3.29.5": "3.30.0" entry
and the nested "@rollup/pluginutils...>rollup" override to the same major to
remove duplicate rollup majors from the resolved tree.

---

Nitpick comments:
In `@package.json`:
- Line 94: Dependency "fast-xml-parser": "5.5.6" is hard-pinned which prevents
receiving future compatible patches; change the version specifier to a caret
range by updating the dependency entry "fast-xml-parser" to "^5.5.6" in
package.json so semver-compatible patch/minor fixes can be installed
automatically while still enforcing the remediation floor.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2d426713-0e79-423f-bf20-70092d0a0ee6

📥 Commits

Reviewing files that changed from the base of the PR and between a6a6956 and f356e8c.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

package.json

comatory

I'm thinking we should scope these. It seems like it's required by playground and it's not obvious why we have two/three bundlers (webpack, vite, rollup). I think rollup is used internally by vite.

I made a ticket to fix this eventually: https://linear.app/wundergraph/issue/ENG-9447/cosmoplayground

pepol requested review from a team as code owners April 27, 2026 16:33

pepol requested review from JivusAyrus, StarpTech and endigma April 27, 2026 16:33

claude Bot reviewed Apr 27, 2026

View reviewed changes

github-actions Bot added the monorepo label Apr 27, 2026

coderabbitai Bot reviewed Apr 27, 2026

View reviewed changes

Comment thread package.json

Comment thread package.json

pepol enabled auto-merge (squash) April 28, 2026 11:23

pepol added 2 commits April 28, 2026 13:26

fix: update fast-xml-parser

558e2ae

fix: update rollup 3.x

c45906c

pepol force-pushed the peter/eng-9416-vanta-remediate-high-vulnerabilities-identified-in-packages branch from f356e8c to c45906c Compare April 28, 2026 11:26

comatory approved these changes Apr 28, 2026

View reviewed changes

endigma approved these changes Apr 28, 2026

View reviewed changes

pepol merged commit 403bd79 into main Apr 28, 2026
71 of 72 checks passed

pepol deleted the peter/eng-9416-vanta-remediate-high-vulnerabilities-identified-in-packages branch April 28, 2026 14:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: remediate vulnerabilities in rollup and fast-xml-parser#2796

fix: remediate vulnerabilities in rollup and fast-xml-parser#2796
pepol merged 2 commits intomainfrom
peter/eng-9416-vanta-remediate-high-vulnerabilities-identified-in-packages

pepol commented Apr 27, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

claude Bot left a comment

Uh oh!

coderabbitai Bot commented Apr 27, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Apr 27, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 27, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

comatory left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

pepol commented Apr 27, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Checklist

Open Source AI Manifesto

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Claude Code Review

Uh oh!

coderabbitai Bot commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Uh oh!

codecov Bot commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Router-nonroot image scan passed

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

comatory left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

pepol commented Apr 27, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Apr 27, 2026 •

edited

Loading

codecov Bot commented Apr 27, 2026 •

edited

Loading

github-actions Bot commented Apr 27, 2026 •

edited

Loading