Bump the npm_and_yarn group across 1 directory with 2 updates

[dependabot]

Bumps the npm_and_yarn group with 2 updates in the / directory: json and rollup.

Updates json from 9.0.6 to 11.0.0

Changelog

Sourced from json's changelog.

11.0.0

• Backward incompatible and security-related change to parsing the -d DELIM option. (#148)

  The -d DELIM option allows specifying the field delimiter in output:

    % echo '{"name":"trent","age":38}' | json -a name age
    trent 38
    % echo '{"name":"trent","age":38}' | json -a name age -d,
    trent,38
  

  The given "DELIM" string is parsed to allow escapes. For example:

    % echo '{"name":"trent","age":38}' | json -a name age -d'\t'
    trent	38
    % echo '{"name":"trent","age":38}' | json -a name age -d'\n'
    trent
    38
  

  Before this change, that parsing used eval(), which allowed for unintended code execution if an untrusted argument to -d was provided. The fix for this vulnerability changes to use JSON.parse() to support escapes. However that results in a backward incompatible change, because the set of JSON escapes is a subset of JavaScript escapes.

  The only escape I expect that would affect any current user would be the null byte escape (\0) which can be useful for processing values that may have spaces or other likely delimiter characters. For example:

    # BEFORE
    % echo '{"title":"Monsters, Inc.","year":"2001"}' \
      | json -a title year -d'\0' \
      | xargs -0 node -e 'console.log(process.argv)'
    [ 'node', 'Monsters, Inc.', '2001\n' ]
  AFTER
  % echo '{"title":"Monsters, Inc.","year":"2001"}' | json -a title year -d'\0'
  json: error: Unexpected number in JSON at position 2
  

  One must now use the JSON unicode escape syntax, '\u0000':

    % echo '{"title":"Monsters, Inc.","year":"2001"}' \
      | json -a title year -d'\u0000' \
      | xargs -0 node -e 'console.log(process.argv)'
    [ 'node', 'Monsters, Inc.', '2001\n' ]
  

10.0.0

... (truncated)

Commits

• e08c868 11.0.0
• 0672aad fix test suite for new '-d DELIM' tests for node >=12
• 4a69ea3 doc, fix tests, and improve errors for '-d DELIM' change in #150
• 4114e32 Fix Code injection in -d DELIM through use of eval (#150)
• 27e1ad7 update devDeps to latest version; regen 'json_parse' with latest uglify-js ve...
• ffeaab4 bump semver (#137) and fix tools/perf.js
• cc47981 BREAKING CHANGE: limit syntax for bracketed lookup strings to fix vuln (#145)
• 8d3cf25 Update README.md
• See full diff in compare view

Updates rollup from 0.36.4 to 4.59.0

Release notes

Sourced from rollup's releases.

v4.59.0

4.59.0

2026-02-22

Features

• Throw when the generated bundle contains paths that would leave the output directory (#6276)

Pull Requests

• #6275: Validate bundle stays within output dir (@​lukastaegert)

v4.58.0

4.58.0

2026-02-20

Features

• Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#6272)

Pull Requests

• #6256: docs: document PreRenderedChunk properties including isDynamicEntry and isImplicitEntry (@​njg7194, @​lukastaegert)
• #6259: docs: Correct typo and improve sentence structure in docs for output.experimentalMinChunkSize (@​millerick, @​lukastaegert)
• #6260: fix(deps): update rust crate swc_compiler_base to v47 (@​renovate[bot], @​lukastaegert)
• #6261: fix(deps): lock file maintenance minor/patch updates (@​renovate[bot], @​lukastaegert)
• #6262: Avoid unnecessary cloning of the code string (@​lukastaegert)
• #6263: fix(deps): update minor/patch updates (@​renovate[bot], @​lukastaegert)
• #6265: chore(deps): lock file maintenance (@​renovate[bot])
• #6267: fix(deps): update minor/patch updates (@​renovate[bot])
• #6268: chore(deps): update dependency eslint-plugin-unicorn to v63 (@​renovate[bot], @​lukastaegert)
• #6269: chore(deps): update dependency lru-cache to v11 (@​renovate[bot])
• #6270: chore(deps): lock file maintenance (@​renovate[bot])
• #6272: forward NO_SIDE_EFFECTS annotations to function expressions in variable declarations (@​lukastaegert)

v4.57.1

4.57.1

2026-01-30

Bug Fixes

• Fix heap corruption issue in Windows (#6251)
• Ensure exports of a dynamic import are fully included when called from a try...catch (#6254)

Pull Requests

• #6251: fix: Isolate and cache process.report.getReport() calls in a child process for robust environment detection (@​alan-agius4, @​lukastaegert)

... (truncated)

Changelog

Sourced from rollup's changelog.

rollup changelog

0.68.2

2018-12-23

Bug Fixes

• Do not assume hoisted variables to have been initialized (#2607)

Pull Requests

• #2607: Fix an issues where hoisted variables were assumed to have been initialized (@​lye)

0.68.1

2018-12-19

Bug Fixes

• Fix an issue with UMD wrappers where a variable is used without being defined (#2600)

Pull Requests

• #2600: Fix UMD and IIFE wrapper issues and add comprehensive functional wrapper tests (@​lukastaegert)

0.68.0

2018-12-16

Breaking Changes

• optimizeChunks is renamed to experimentalOptimizeChunks to reflect this feature is not production-ready yet ( #2575)

Features

• Plugins can iterate all module ids via this.moduleIds (#2565)
• Plugins can get graph information about a module via this.getModuleInfo(id) (#2565)
• Plugins and JS API users get more information about the generated chunks: dynamicImports, facadeModuleId, isDynamicEntry, name (#2575)
• Tree-shaken dynamic imports will no longer create chunks or influence chunking in any way (#2575)
• Dynamic imports will no longer follow the entryFileNames but the chunkFileNames property reflecting those are solely internally used (#2575)
• If there are chunk naming conflicts, entry chunks will always take precedence (#2575)
• If an entry facade is created, only the facade chunk is marked as isEntry (#2575)
• Dynamic chunks will only be marked as isEntry if they are actually entry chunks as well; thus there is now a 1-to-1 correspondence between modules listed in input and chunks marked as isEntry (#2575)
• Chunks no longer contain imports for variables that are tree-shaken in the chunk but used in other chunks (#2584)
• Chunks will always import re-exported variables directly from the chunk where they are originally exported from ( #2584)
• Null characters will be pruned from chunk ids to allow for virtually created chunks and make rollup-plugin-multi-entry compatible with code-splitting and thus the upcoming 1.0 version (#2590)
• Simplify the UMD wrapper code as much as possible, especially if there are no exports (#2594)
• The UMD wrapper will now work in strict mode by checking for self before this when determining the global variable (#2594)

... (truncated)

Commits

• ae84695 4.59.0
• b39616e Update audit-resolve
• c60770d Validate bundle stays within output dir (#6275)
• 33f39c1 4.58.0
• b61c408 forward NO_SIDE_EFFECTS annotations to function expressions in variable decla...
• 7f00689 Extend agent instructions
• e7b2b85 chore(deps): lock file maintenance (#6270)
• 2aa5da9 fix(deps): update minor/patch updates (#6267)
• 4319837 chore(deps): update dependency lru-cache to v11 (#6269)
• c3b6b4b chore(deps): update dependency eslint-plugin-unicorn to v63 (#6268)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for rollup since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.