rollup 5.0.0-1

Source: https://github.com/rollup/rollup
Artifact scanned: rollup-5.0.0-1.tgz (npm tarball · 22.0 MB · SHA-256 93751fb23806…)
Compared with: rollup-5.0.0-0.tgz (1 signals introduced since)
Files: 28 scanned, 25 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 33 info
Scan time: 13.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 13 of 13 warn and critical signals; 13 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 23:48

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review long-line dist/es/shared/node-entry.js:10:1 new in this release

line length 4155 characters (raw pass, confidence 0.65)
```
import { EMPTY_OBJECT, ArrowFunctionExpression as ArrowFunctionExpression$1, FunctionExpression as FunctionExpression$1, Identifier as Identifier$1, ObjectExpression as ObjectExpression$1, ExportDefaultDeclaration as ExportDefaultDeclaration$1, CallExpression as CallExpression$1, EMPTY_ARRAY, Program as Program$1, logR
```
dismissed LLM, confidence 0.95 Bundled ES import statement with many re-exported AST helper names.
Reasoning
A long import statement listing many named bindings from the bundled internal modules. This is ordinary minified or bundled output that the raw pass flags only on line length.
info ~~warn~~ → info by review long-line README.md:124:1

line length 2244 characters (raw pass, confidence 0.65)
```
<a href="https://opencollective.com/rollup/sponsor/0/website" target="_blank"><img src="https://opencollective.com/rollup/sponsor/0/avatar.svg"></a> <a href="https://opencollective.com/rollup/sponsor/1/website" target="_blank"><img src="https://opencollective.com/rollup/sponsor/1/avatar.svg"></a> <a href="https://openc
```
dismissed LLM, confidence 0.95 Markdown README line containing sponsor badge HTML links.
Reasoning
The flagged line is a long run of HTML anchor and image tags for sponsor avatars in a README. The raw long-line signal is a formatting artifact with no execution or obfuscation.
info whitespace-anomaly dist/bin/rollup:3:1

file mixes tab and space indentation (330 tab-indented and 1364 space-indented lines) (raw pass, confidence 0.40)
```
/*
  @license
	Rollup.js v5.0.0-1
	Sun, 18 Oct 2026 06:06:25 GMT - commit ed75a6895d5bc62fdbff91b9d48e22e6e281e3bc
```
info ~~warn~~ → info by review dynamic-import dist/bin/rollup:1216:108

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('bin/rollup', document.baseURI).href))) : undefined;
```
likely benign LLM, confidence 0.80 Bundled CLI shim that builds a file URL for createRequire from __filename or the document base URI.
Reasoning
This is the standard ESM-to-CJS shim that resolves the module's own path via require('url').pathToFileURL(__filename) or document.baseURI for createRequire. Splitting 'url' into 'u'+'rl' is an unusual choice that could hide the module name from bundlers, but it appears in rollup's own generated bin and only computes a file URL locally, with no network or exec.
info whitespace-anomaly dist/es/getLogFilter.js:2:1

file mixes tab and space indentation (4 tab-indented and 51 space-indented lines) (raw pass, confidence 0.40)
```
/*
  @license
	Rollup.js v5.0.0-1
	Sun, 18 Oct 2026 06:06:25 GMT - commit ed75a6895d5bc62fdbff91b9d48e22e6e281e3bc
```
info whitespace-anomaly dist/es/parseAst.js:2:1

file mixes tab and space indentation (4 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
```
/*
  @license
	Rollup.js v5.0.0-1
	Sun, 18 Oct 2026 06:06:25 GMT - commit ed75a6895d5bc62fdbff91b9d48e22e6e281e3bc
```
info whitespace-anomaly dist/es/rollup.js:2:1

file mixes tab and space indentation (4 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
```
/*
  @license
	Rollup.js v5.0.0-1
	Sun, 18 Oct 2026 06:06:25 GMT - commit ed75a6895d5bc62fdbff91b9d48e22e6e281e3bc
```
info whitespace-anomaly dist/es/shared/node-entry.js:2:1

file mixes tab and space indentation (3580 tab-indented and 18412 space-indented lines) (raw pass, confidence 0.40)
```
/*
  @license
	Rollup.js v5.0.0-1
	Sun, 18 Oct 2026 06:06:25 GMT - commit ed75a6895d5bc62fdbff91b9d48e22e6e281e3bc
```
info dynamic-execution dist/es/shared/node-entry.js:425:56

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
	toUrl() {
		return `data:application/json;charset=utf-8;base64,${btoa(this.toString())}`;
	}
};
```
info whitespace-anomaly dist/es/shared/parseAst.js:2:1

file mixes tab and space indentation (37 tab-indented and 4934 space-indented lines) (raw pass, confidence 0.40)
```
/*
  @license
	Rollup.js v5.0.0-1
	Sun, 18 Oct 2026 06:06:25 GMT - commit ed75a6895d5bc62fdbff91b9d48e22e6e281e3bc
```
info ~~warn~~ → info by review long-line dist/es/shared/parseAst.js:363:1

line length 3696 characters (raw pass, confidence 0.65)
```
const ADDON_ERROR = 'ADDON_ERROR', ALREADY_CLOSED = 'ALREADY_CLOSED', AMBIGUOUS_EXTERNAL_NAMESPACES = 'AMBIGUOUS_EXTERNAL_NAMESPACES', AMBIGUOUS_GLOBAL_NAME = 'AMBIGUOUS_GLOBAL_NAME', ANONYMOUS_PLUGIN_CACHE = 'ANONYMOUS_PLUGIN_CACHE', ASSET_NOT_FINALISED = 'ASSET_NOT_FINALISED', ASSET_NOT_FOUND = 'ASSET_NOT_FOUND', ASS
```
dismissed LLM, confidence 0.95 Long line defining rollup error code string constants.
Reasoning
A long const declaration of string constants for rollup error codes. This is a generated constant table, and the flag comes from line length alone.
info ~~warn~~ → info by review long-line dist/es/shared/parseAst.js:5476:1

line length 3757 characters (raw pass, confidence 0.65)
```
export { ArrowFunctionExpression, AwaitExpression, BLANK, BlockStatement, CallExpression, CatchClause, EMPTY_ARRAY, EMPTY_OBJECT, EMPTY_SET, ExportDefaultDeclaration, ExpressionStatement, FIXED_STRINGS, FunctionDeclaration, FunctionExpression, Identifier, IfStatement$1 as IfStatement, LOGLEVEL_DEBUG, LOGLEVEL_ERROR, LO
```
dismissed LLM, confidence 0.95 Long export statement re-exporting AST helpers from a bundled module.
Reasoning
A long export list of AST node names and helpers in a bundled module. It is routine bundler output with no hidden behavior.
info whitespace-anomaly dist/es/shared/watch.js:2:1

file mixes tab and space indentation (4 tab-indented and 1834 space-indented lines) (raw pass, confidence 0.40)
```
/*
  @license
	Rollup.js v5.0.0-1
	Sun, 18 Oct 2026 06:06:25 GMT - commit ed75a6895d5bc62fdbff91b9d48e22e6e281e3bc
```
info whitespace-anomaly dist/getLogFilter.js:2:1

file mixes tab and space indentation (4 tab-indented and 51 space-indented lines) (raw pass, confidence 0.40)
```
/*
  @license
	Rollup.js v5.0.0-1
	Sun, 18 Oct 2026 06:06:25 GMT - commit ed75a6895d5bc62fdbff91b9d48e22e6e281e3bc
```
info whitespace-anomaly dist/loadConfigFile.js:2:1

file mixes tab and space indentation (4 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
```
/*
  @license
	Rollup.js v5.0.0-1
	Sun, 18 Oct 2026 06:06:25 GMT - commit ed75a6895d5bc62fdbff91b9d48e22e6e281e3bc
```
info ~~warn~~ → info by review dynamic-import dist/native.js:103:10

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
	try {
		return require(id);
	} catch (error) {
		if (
```
likely benign LLM, confidence 0.85 Dynamic require of a native module id inside a try/catch fallback loader.
Reasoning
This is a try/catch wrapper around require(id) in the native-module loader, which loads a package of Rollup's own native bindings and falls back when the load fails. The dynamic id is expected in this loader pattern and nothing in the snippet is malicious.
info whitespace-anomaly dist/parseAst.js:2:1

file mixes tab and space indentation (4 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
```
/*
  @license
	Rollup.js v5.0.0-1
	Sun, 18 Oct 2026 06:06:25 GMT - commit ed75a6895d5bc62fdbff91b9d48e22e6e281e3bc
```
info whitespace-anomaly dist/rollup.js:2:1

file mixes tab and space indentation (4 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
```
/*
  @license
	Rollup.js v5.0.0-1
	Sun, 18 Oct 2026 06:06:25 GMT - commit ed75a6895d5bc62fdbff91b9d48e22e6e281e3bc
```
info whitespace-anomaly dist/shared/index.js:2:1

file mixes tab and space indentation (4 tab-indented and 1500 space-indented lines) (raw pass, confidence 0.40)
```
/*
  @license
	Rollup.js v5.0.0-1
	Sun, 18 Oct 2026 06:06:25 GMT - commit ed75a6895d5bc62fdbff91b9d48e22e6e281e3bc
```
info whitespace-anomaly dist/shared/loadConfigFile.js:2:1

file mixes tab and space indentation (4 tab-indented and 492 space-indented lines) (raw pass, confidence 0.40)
```
/*
  @license
	Rollup.js v5.0.0-1
	Sun, 18 Oct 2026 06:06:25 GMT - commit ed75a6895d5bc62fdbff91b9d48e22e6e281e3bc
```
info ~~critical~~ → info by review dynamic-execution dist/shared/loadConfigFile.js:358:18

`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
```
        // -p "{transform(c,i){...}}"
        plugin = new Function('return ' + pluginText);
    }
    else {
```
likely benign LLM, confidence 0.80 Builds a function from user-supplied inline plugin text given on the rollup CLI.
Reasoning
This code is the CLI handling of inline plugin specifications passed via -p, such as '{transform(c,i){...}}'. The text comes from the user's own command-line argument on a local tool, so the new Function call is a documented feature and not a supply-chain payload, though it does execute dynamic code.
info ~~critical~~ → info by review dynamic-execution dist/shared/loadConfigFile.js:366:30

`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
```
            pluginText = match[1];
            pluginArgument = new Function('return ' + match[3])();
        }
        else {
```
likely benign LLM, confidence 0.80 Evaluates the argument of an inline -p plugin expression from the CLI.
Reasoning
The same CLI -p inline-plugin path, where match[3] is an argument the user typed to rollup. It evaluates user-provided code by design, and the snippet shows no network access, decoding, or persistence.
info ~~warn~~ → info by review dynamic-import dist/shared/loadConfigFile.js:422:16

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
        // eslint-disable-next-line @typescript-eslint/no-require-imports
        return require(pluginPath);
    }
    catch {
```
likely benign LLM, confidence 0.88 Fallback require of a configured plugin path inside a try/catch.
Reasoning
This is a fallback that loads a plugin or config module from a resolved path with require, which is how Rollup loads user-configured plugins and config files. The path comes from the project's own configuration.
info ~~warn~~ → info by review dynamic-import dist/shared/loadConfigFile.js:425:16

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    catch {
        return import(pluginPath);
    }
}
```
likely benign LLM, confidence 0.88 Fallback dynamic import of a configured plugin path.
Reasoning
This is the ESM fallback for loading a configured plugin path with import(), which is the expected mechanism for rollup plugins. The specifier comes from the project's configuration, and no hidden behavior appears in the snippet.
info ~~warn~~ → info by review dynamic-import dist/shared/loadConfigFile.js:472:23

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
        }
        return (await import(fileUrl.href)).default;
    }
    catch (error_) {
```
likely benign LLM, confidence 0.88 Dynamic import of a bundled config file via its file URL.
Reasoning
This imports a bundled rollup config file from a file URL and reads its default export, which is the standard way Rollup loads rollup.config.mjs. The target is the project's own config file.
info ~~warn~~ → info by review dynamic-import dist/shared/loadConfigFile.js:552:23

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    try {
        return (await import(node_url.pathToFileURL(bundledFileName).href)).default;
    }
    finally {
```
likely benign LLM, confidence 0.88 Imports a temporarily bundled config file by file URL and cleans up afterward.
Reasoning
This imports a temporarily bundled config file via pathToFileURL and removes it in a finally block. That is the standard Rollup config-loading flow, and nothing in the snippet shows network or exec behavior beyond loading the config.
info whitespace-anomaly dist/shared/node-entry.js:2:1

file mixes tab and space indentation (4 tab-indented and 112 space-indented lines) (raw pass, confidence 0.40)
```
/*
  @license
	Rollup.js v5.0.0-1
	Sun, 18 Oct 2026 06:06:25 GMT - commit ed75a6895d5bc62fdbff91b9d48e22e6e281e3bc
```
info whitespace-anomaly dist/shared/parseAst.js:2:1

file mixes tab and space indentation (37 tab-indented and 4976 space-indented lines) (raw pass, confidence 0.40)
```
/*
  @license
	Rollup.js v5.0.0-1
	Sun, 18 Oct 2026 06:06:25 GMT - commit ed75a6895d5bc62fdbff91b9d48e22e6e281e3bc
```
info ~~warn~~ → info by review long-line dist/shared/parseAst.js:368:1

line length 3998 characters (raw pass, confidence 0.65)
```
const ADDON_ERROR = 'ADDON_ERROR', ALREADY_CLOSED = 'ALREADY_CLOSED', AMBIGUOUS_EXTERNAL_NAMESPACES = 'AMBIGUOUS_EXTERNAL_NAMESPACES', AMBIGUOUS_GLOBAL_NAME = 'AMBIGUOUS_GLOBAL_NAME', ANONYMOUS_PLUGIN_CACHE = 'ANONYMOUS_PLUGIN_CACHE', ASSET_NOT_FINALISED = 'ASSET_NOT_FINALISED', ASSET_NOT_FOUND = 'ASSET_NOT_FOUND', ASS
```
dismissed LLM, confidence 0.95 Long line defining rollup error code string constants.
Reasoning
A long constant declaration of rollup error code strings, the same generated table as the other parseAst finding. The flag is based only on line length.
info whitespace-anomaly dist/shared/rollup.js:2:1

file mixes tab and space indentation (3580 tab-indented and 18313 space-indented lines) (raw pass, confidence 0.40)
```
/*
  @license
	Rollup.js v5.0.0-1
	Sun, 18 Oct 2026 06:06:25 GMT - commit ed75a6895d5bc62fdbff91b9d48e22e6e281e3bc
```
info dynamic-execution dist/shared/rollup.js:4651:56

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
	toUrl() {
		return `data:application/json;charset=utf-8;base64,${btoa(this.toString())}`;
	}
};
```
info whitespace-anomaly dist/shared/watch-cli.js:2:1

file mixes tab and space indentation (31 tab-indented and 396 space-indented lines) (raw pass, confidence 0.40)
```
/*
  @license
	Rollup.js v5.0.0-1
	Sun, 18 Oct 2026 06:06:25 GMT - commit ed75a6895d5bc62fdbff91b9d48e22e6e281e3bc
```
info whitespace-anomaly dist/shared/watch.js:2:1

file mixes tab and space indentation (4 tab-indented and 343 space-indented lines) (raw pass, confidence 0.40)
```
/*
  @license
	Rollup.js v5.0.0-1
	Sun, 18 Oct 2026 06:06:25 GMT - commit ed75a6895d5bc62fdbff91b9d48e22e6e281e3bc
```

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o rollup-5.0.0-1.tgz https://registry.npmjs.org/rollup/-/rollup-5.0.0-1.tgz
printf '%s  %s\n' 93751fb23806dc5d9b108be6309f831b5173b514bd291bc695974594f6f270ca rollup-5.0.0-1.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf rollup-5.0.0-1.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg