From 7490e2c4ae558ac32e8b77b4295fc3d9962e2e72 Mon Sep 17 00:00:00 2001 From: Gwynne Raskind Date: Wed, 28 Oct 2026 09:47:16 -0500 Subject: [PATCH 1/3] fix(node-resolve): remove use of deepmerge dependency due to npm audit noise --- packages/node-resolve/package.json | 1 - packages/node-resolve/src/index.js | 16 ++++++++++++++-- pnpm-lock.yaml | 11 ----------- 3 files changed, 14 insertions(+), 14 deletions(-) diff --git a/packages/node-resolve/package.json b/packages/node-resolve/package.json index f06f248d0..36edd99e0 100644 --- a/packages/node-resolve/package.json +++ b/packages/node-resolve/package.json @@ -64,7 +64,6 @@ "dependencies": { "@rollup/pluginutils": "^5.0.1", "@types/resolve": "1.20.2", - "deepmerge": "^4.2.2", "is-module": "^1.0.0", "resolve": "^1.22.1" }, diff --git a/packages/node-resolve/src/index.js b/packages/node-resolve/src/index.js index 1ed3989e4..aea29e779 100644 --- a/packages/node-resolve/src/index.js +++ b/packages/node-resolve/src/index.js @@ -3,7 +3,6 @@ import { dirname, normalize, resolve, sep } from 'path'; import { builtinModules } from 'module'; -import deepMerge from 'deepmerge'; import isModule from 'is-module'; import { version, peerDependencies } from '../package.json'; @@ -27,6 +26,19 @@ const deepFreeze = (object) => { return object; }; +const deepClone = (object) => { + const result = Object.assign({}, object); + + for (const [key, value] of Object.entries(result)) { + if (Array.isArray(value)) { + result[key] = Array.from(value); + } else if (typeof value === 'object') { + result[key] = deepClone(value); + } + } + + return result; +}; const baseConditions = ['default', 'module']; const baseConditionsEsm = [...baseConditions, 'import']; @@ -45,7 +57,7 @@ const defaults = { }; const nodeImportPrefix = /^node:/; -export const DEFAULTS = deepFreeze(deepMerge({}, defaults)); +export const DEFAULTS = deepFreeze(deepClone(defaults)); export function nodeResolve(opts = {}) { const { warnings } = handleDeprecatedOptions(opts); diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 8cbba389d..3da67d310 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -511,9 +511,6 @@ importers: '@types/resolve': specifier: 1.20.2 version: 1.20.2 - deepmerge: - specifier: ^4.2.2 - version: 4.2.2 is-module: specifier: ^1.0.0 version: 1.0.0 @@ -2887,10 +2884,6 @@ packages: deep-is@0.1.4: resolution: {integrity: sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==} - deepmerge@4.2.2: - resolution: {integrity: sha512-FJ3UgI4gIl+PHZm53knsuSFpE+nESMr7M4v9QcgB7S63Kj/6WqMiFQJpBBYz1Pt+66bZpP3Q7Lye0Oo9MPKEdg==} - engines: {node: '>=0.10.0'} - default-require-extensions@3.0.1: resolution: {integrity: sha512-eXTJmRbm2TIt9MgWTsOH1wEuhew6XGZcMeGKCtLedIg/NCsg1iBePXkceTdK4Fii7pzmN9tGsZhKzZ4h7O/fxw==} engines: {node: '>=8'} @@ -6467,7 +6460,6 @@ snapshots: dependencies: '@rollup/pluginutils': 4.2.1 '@types/resolve': 1.20.2 - deepmerge: 4.2.2 is-builtin-module: 3.2.0 is-module: 1.0.0 resolve: 1.22.1 @@ -6478,7 +6470,6 @@ snapshots: dependencies: '@rollup/pluginutils': 4.2.1 '@types/resolve': 1.20.2 - deepmerge: 4.2.2 is-builtin-module: 3.2.0 is-module: 1.0.0 resolve: 1.22.1 @@ -7615,8 +7606,6 @@ snapshots: deep-is@0.1.4: {} - deepmerge@4.2.2: {} - default-require-extensions@3.0.1: dependencies: strip-bom: 4.0.0 From a88d386ea04ed89a54952b9a34e14e57d65e7efa Mon Sep 17 00:00:00 2001 From: Gwynne Raskind Date: Wed, 28 Oct 2026 10:12:35 -0500 Subject: [PATCH 2/3] Revert removal from pnpm-lock.yaml --- pnpm-lock.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 3da67d310..8cbba389d 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -511,6 +511,9 @@ importers: '@types/resolve': specifier: 1.20.2 version: 1.20.2 + deepmerge: + specifier: ^4.2.2 + version: 4.2.2 is-module: specifier: ^1.0.0 version: 1.0.0 @@ -2884,6 +2887,10 @@ packages: deep-is@0.1.4: resolution: {integrity: sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==} + deepmerge@4.2.2: + resolution: {integrity: sha512-FJ3UgI4gIl+PHZm53knsuSFpE+nESMr7M4v9QcgB7S63Kj/6WqMiFQJpBBYz1Pt+66bZpP3Q7Lye0Oo9MPKEdg==} + engines: {node: '>=0.10.0'} + default-require-extensions@3.0.1: resolution: {integrity: sha512-eXTJmRbm2TIt9MgWTsOH1wEuhew6XGZcMeGKCtLedIg/NCsg1iBePXkceTdK4Fii7pzmN9tGsZhKzZ4h7O/fxw==} engines: {node: '>=8'} @@ -6460,6 +6467,7 @@ snapshots: dependencies: '@rollup/pluginutils': 4.2.1 '@types/resolve': 1.20.2 + deepmerge: 4.2.2 is-builtin-module: 3.2.0 is-module: 1.0.0 resolve: 1.22.1 @@ -6470,6 +6478,7 @@ snapshots: dependencies: '@rollup/pluginutils': 4.2.1 '@types/resolve': 1.20.2 + deepmerge: 4.2.2 is-builtin-module: 3.2.0 is-module: 1.0.0 resolve: 1.22.1 @@ -7606,6 +7615,8 @@ snapshots: deep-is@0.1.4: {} + deepmerge@4.2.2: {} + default-require-extensions@3.0.1: dependencies: strip-bom: 4.0.0 From db3b273a164bf042b62b1d1bb79d2f672eeeda59 Mon Sep 17 00:00:00 2001 From: Gwynne Raskind Date: Wed, 28 Oct 2026 10:17:57 -0500 Subject: [PATCH 3/3] update pnpm-lock.yaml hopefully correctly --- pnpm-lock.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 8cbba389d..d8145b011 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -511,9 +511,6 @@ importers: '@types/resolve': specifier: 1.20.2 version: 1.20.2 - deepmerge: - specifier: ^4.2.2 - version: 4.2.2 is-module: specifier: ^1.0.0 version: 1.0.0