Update dependencies by vio · Pull Request #456 · relative-ci/rollup-plugin-stats

vio · 2026-02-05T22:51:03Z

Summary by CodeRabbit

Chores
- Routine maintenance: several development dependencies were updated to newer stable releases to improve build tooling, type definitions, changelog generation, and bundling reliability. These are internal tooling updates only; there are no changes to application behavior, public APIs, or exported declarations. No end-user features were added or removed.

socket-security · 2026-02-05T22:51:26Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
globals@17.1.0 ⏵ 17.3.0	⁺¹	⁺¹	⁺²
rollup@4.56.0 ⏵ 4.57.1
@release-it/conventional-changelog@10.0.4 ⏵ 10.0.5	⁺¹		⁺⁵
@types/node@25.0.10 ⏵ 25.2.1	⁺¹	⁺²⁰	⁺⁵

View full report

coderabbitai · 2026-02-05T22:51:27Z

Walkthrough

This PR updates four devDependencies in package.json: @release-it/conventional-changelog 10.0.4 → 10.0.5, @types/node 25.0.10 → 25.2.1, globals 17.1.0 → 17.3.0, and rollup 4.56.0 → 4.57.1. No other fields, scripts, public exports, or API declarations were changed.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

Update dependencies #403: Bumps the same devDependencies (@release-it/conventional-changelog, @types/node, and rollup) in package.json.
Update dependencies #153: Similar devDependency updates with overlapping version changes for @release-it/conventional-changelog, @types/node, and rollup.
Update dependencies #321: Modifies the same package.json devDependencies including @types/node, globals, and rollup.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Update dependencies' accurately summarizes the main change—updating four devDependencies in package.json.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch update-dependencies

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

CLAassistant · 2026-02-05T22:52:27Z

All committers have signed the CLA.

Bumps [globals](https://github.com/sindresorhus/globals) from 17.1.0 to 17.3.0. - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.1.0...v17.3.0) --- updated-dependencies: - dependency-name: globals dependency-version: 17.3.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

Bumps [rollup](https://github.com/rollup/rollup) from 4.56.0 to 4.57.1. - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.56.0...v4.57.1) --- updated-dependencies: - dependency-name: rollup dependency-version: 4.57.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 25.0.10 to 25.2.0. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 25.2.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 25.2.0 to 25.2.1. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 25.2.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>

Bumps [@release-it/conventional-changelog](https://github.com/release-it/conventional-changelog) from 10.0.4 to 10.0.5. - [Release notes](https://github.com/release-it/conventional-changelog/releases) - [Commits](release-it/conventional-changelog@10.0.4...10.0.5) --- updated-dependencies: - dependency-name: "@release-it/conventional-changelog" dependency-version: 10.0.5 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>

coderabbitai

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@package.json`:
- Around line 65-78: The package.json devDependencies entry for "@types/node"
currently uses the unavailable version "25.2.1"; update the "@types/node" value
in the devDependencies object to "25.2.0" so the dependency resolves correctly
(leave other devDependencies like "rollup",
"@release-it/conventional-changelog", and "globals" unchanged).

coderabbitai · 2026-02-05T23:53:27Z

  "devDependencies": {
    "@eslint/js": "9.39.2",
-    "@release-it/conventional-changelog": "10.0.4",
+    "@release-it/conventional-changelog": "10.0.5",
    "@rollup/plugin-typescript": "12.3.0",
    "@tsconfig/node18": "18.2.6",
-    "@types/node": "25.0.10",
+    "@types/node": "25.2.1",
    "deep-freeze-strict": "1.1.1",
    "eslint": "9.39.2",
-    "globals": "17.1.0",
+    "globals": "17.3.0",
    "husky": "8.0.3",
    "memfs": "4.56.10",
    "prettier": "3.8.1",
    "release-it": "19.2.4",
-    "rollup": "4.56.0",
+    "rollup": "4.57.1",


⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

rollup 4.57.1 release notes

💡 Result:

Rollup v4.57.1 — release notes (2026-01-30)

Bug fixes

Fixed a heap corruption issue on Windows (#6251). [1]

Ensured exports of a dynamic import are fully included when the import is called from a try...catch (#6254). [1]

Merged PRs

#6251: Isolate and cache process.report.getReport() calls in a child process for robust environment detection.

#6252: Update dependency lru-cache to v11.

#6253: Lock file maintenance (minor/patch updates).

#6254: Fully include dynamic imports in a try-catch.

#6255: Lock file maintenance. [1]

Source: Rollup changelog entry for 4.57.1. [1]

References

[1] Rollup changelog (v4.57.1) (classic.yarnpkg.com)

Citations:

1: https://classic.yarnpkg.com/en/package/rollup?utm_source=openai

🌐 Web query:

@types/node 25.2.1 changelog breaking changes

💡 Result:

There is no @types/[email protected] release on npm. The 25.x line shows @types/[email protected] published Feb 1, 2026, and no 25.2.1 entry. [1]

If you meant Node.js runtime v25.2.1 (not @types/node), its release notes (Nov 17, 2025) say it reverts a behavior change where localStorage access could sometimes throw; this was deemed too breaking for a semver-minor and deferred to Node 26.0.0. [2]

Changelog / breaking-changes list: DefinitelyTyped generally does not provide a per-version changelog for @types/node; the practical approach is to diff the published versions (e.g., 25.2.0 vs the version you’re upgrading from). This is a recurring question in DefinitelyTyped. [3]

Sources: [1] (releasealert.dev) [2] (nodejs.org) [3] (github.com)

Citations:

1: https://releasealert.dev/npmjs/%40types/node?utm_source=openai

2: https://nodejs.org/id/blog/release/v25.2.1?utm_source=openai

3: Where do I find a changelog for this @types/node? DefinitelyTyped/DefinitelyTyped#52998

🌐 Web query:

@release-it/conventional-changelog 10.0.5 release notes

💡 Result:

@release-it/conventional-changelog 10.0.5 release notes (released Feb 5, 2026)

Tests: add coverage for generating a changelog with remote origin URLs (PR build(deps): bump actions/download-artifact from 4.1.9 to 4.2.1 #132)

Fix: pass parserOpts to both Bumper and ConventionalChangelog (PR build(deps-dev): bump @types/node from 22.13.10 to 22.13.11 #135)

Contributors: Maxel01, aarond-sp [1]

🌐 Web query:

globals 17.3.0 changelog

💡 Result:

globals v17.3.0 changelog (2026-02-01)

Update globals dataset (automated update dated 2026-02-01) via PR #336. [1]

Data changes: adds 2 new entries to the browser globals list and 4 new entries to the denoBuiltin globals list (reflected in globals.json as 6 additions total). [2]

Dev dependency bump: puppeteer ^24.36.0 → ^24.36.1. [2]

Sources: GitHub release notes for v17.3.0 and the #336 diff. [1][2]

[1] (github.com)
[2] (github.com)

Citations:

1: https://github.com/sindresorhus/globals/releases

2: https://github.com/sindresorhus/globals/pull/336/files

Use @types/node@25.2.0 instead of 25.2.1, which does not exist on npm.

The version @types/[email protected] is not available in the npm registry; the latest in the 25.x line is @types/[email protected] (published Feb 1, 2026). Update line 72 to use 25.2.0. The other dependency bumps ([email protected], @release-it/[email protected], [email protected]) contain no breaking changes and are safe.

🤖 Prompt for AI Agents

In `@package.json` around lines 65 - 78, The package.json devDependencies entry for "@types/node" currently uses the unavailable version "25.2.1"; update the "@types/node" value in the devDependencies object to "25.2.0" so the dependency resolves correctly (leave other devDependencies like "rollup", "@release-it/conventional-changelog", and "globals" unchanged).

dependabot Bot added 5 commits February 6, 2026 00:48

vio force-pushed the update-dependencies branch from 3ab73fe to a75158d Compare February 5, 2026 23:49

coderabbitai Bot reviewed Feb 5, 2026

View reviewed changes

vio merged commit 6df76ae into master Feb 5, 2026
35 checks passed

vio deleted the update-dependencies branch February 5, 2026 23:58

This was referenced Feb 10, 2026

Update dependencies #463

Closed

Update dependencies #468

Merged

coderabbitai Bot mentioned this pull request Mar 30, 2026

Update dependencies #517

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update dependencies#456

Update dependencies#456
vio merged 5 commits into
masterfrom
update-dependencies

vio commented Feb 5, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

socket-security Bot commented Feb 5, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Feb 5, 2026 •

edited

Loading

Uh oh!

CLAassistant commented Feb 5, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot Feb 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

vio commented Feb 5, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

socket-security Bot commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Estimated code review effort

Possibly related PRs

Uh oh!

CLAassistant commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Feb 5, 2026

Choose a reason for hiding this comment

Rollup v4.57.1 — release notes (2026-01-30)

@release-it/conventional-changelog 10.0.5 release notes (released Feb 5, 2026)

globals v17.3.0 changelog (2026-02-01)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vio commented Feb 5, 2026 •

edited by coderabbitai Bot

Loading

socket-security Bot commented Feb 5, 2026 •

edited

Loading

coderabbitai Bot commented Feb 5, 2026 •

edited

Loading

CLAassistant commented Feb 5, 2026 •

edited

Loading

`@release-it/conventional-changelog` 10.0.5 release notes (released Feb 5, 2026)

`globals` v17.3.0 changelog (2026-02-01)