Bump @rollup/plugin-node-resolve from 15.2.1 to 16.0.3

[dependabot]

Bumps @rollup/plugin-node-resolve from 15.2.1 to 16.0.3.

Changelog

Sourced from @​rollup/plugin-node-resolve's changelog.

v16.0.3

2025-10-13

Bugfixes

• fix: resolve bare targets of package "imports" using export maps; avoid fileURLToPath(null) (#1908)

v16.0.2

2025-10-04

Bugfixes

• fix: error thrown with empty entry (#1893)

v16.0.1

2025-03-11

Bugfixes

• fix: add ignoreSideEffectsForRoot to exported interface (#1841)

v16.0.0

2024-12-15

Breaking Changes

• feat!: set development or production condition (#1823)

v15.3.1

2024-12-15

Updates

• refactor: replace test with includes (#1787)

v15.3.0

2024-09-23

Features

• feat: allow preferBuiltins to be a function (#1694)

v15.2.4

... (truncated)

Commits

• 764910a chore(release): node-resolve v16.0.3
• 3569720 fix(node-resolve): resolve bare targets of package "imports" using export map...
• 516ed1d chore(release): node-resolve v16.0.2
• 7ad5057 fix(node-resolve): error thrown with empty entry (#1893)
• e1a5ef9 chore(release): node-resolve v16.0.1
• d455fff fix(node-resolve): add ignoreSideEffectsForRoot to exported interface (#1841)
• d64f8d6 chore(release): node-resolve v16.0.0
• ebd0969 feat(node-resolve)!: set development or production condition (#1823)
• f89ca92 chore(release): node-resolve v15.3.1
• 4cfc1c3 refactor(pluginutils,node-resolve): replace test with includes (#1787)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Medium Risk
Major bump to build-time module resolution; v16’s default export conditions could change bundle output if dependencies rely on conditional exports, though existing Rollup 4 setups align with the new peer range.

Overview
Bumps @rollup/plugin-node-resolve from 15.2.1 to 16.0.3 in api, api-react, core, icons, and wallets, with matching package-lock.json updates (including Rollup 4 peer support and removal of the transitive is-builtin-module dependency).

Rollup configs still call nodeResolve({ extensions }) only—no config changes. v16 is a major release: it applies development/production conditions when resolving package exports/imports, which can change which files get bundled compared to v15. The lockfile also pins some validator / @types/validator entries to exact versions alongside this bump.

^{Reviewed by Cursor Bugbot for commit ffeabdd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​rollup/​plugin-node-resolve@​15.2.1 ⏵ 16.0.3

View full report

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

I'll review the upstream package diff, lockfile/integrity, and the malware-scan findings against the supply-chain checklist.Verdict: benign

@rollup/plugin-node-resolve 15.2.1 → 16.0.3 looks like a normal Rollup plugins monorepo release, not a compromised package.

Scanner vs this review: Status was warn (warn-only). Unicode, confusable, and IOC findings were zero. The two heuristics do not hold up as compromise:

• ghost_version_or_missing_tag for 16.0.3 is a false positive. Tags exist as node-resolve-v16.0.0 through node-resolve-v16.0.3 (monorepo naming, not a bare 16.0.3 tag).
• version_jump_anomaly (15.2.1→16.0.3) is the documented major plus patch releases (v16.0.0 breaking change: auto development/production export conditions), not a skipped ghost version.

Evidence it is clean:

• Changed files are changelog, types, tests/fixtures, and resolver/pluginutils source—no node_modules/vendor payloads, no workflow files, no extra lockfile-only deps.
• package.json has no preinstall/install/postinstall. Scripts are build/test/prepare/prepublishOnly as expected. Runtime deps are unchanged (pluginutils, resolve, deepmerge, is-module, @types/resolve).
• Source diffs match the changelog: NODE_ENV conditions, preferBuiltins as a function, empty-entry guard, "imports" + export-map resolution, test→includes. No eval/encoded payloads, unexpected hosts, persistence, or process spawn.
• Lockfile points at registry.npmjs.org with a normal sha512 integrity hash. Authors are known Rollup contributors plus Release Workflow <release-workflow@rollup.dev>.

Note (compat, not malware): v16 always injects development or production unless you already pass those in exportConditions. That can change which files get bundled. Confirm a production GUI build still resolves the intended package entry points.

Compatibility Analysis

I'll inspect local usage of @rollup/plugin-node-resolve and the upstream v16 breaking change so the compatibility recommendation is based on how this repo actually builds.Recommendation: merge-with-caveats

Build-only bump. Call sites stay valid; the v16 default export-condition behavior is the real change, and this repo does not opt out of it.

1) Where it is used

DevDependency on five library packages, all wired the same way: nodeResolve({ extensions }) in Rollup configs.

Package	Config
@chia-network/api	packages/api/rollup.config.mjs
@chia-network/api-react	packages/api-react/rollup.config.mjs
@chia-network/core	packages/core/rollup.config.mjs
@chia-network/icons	packages/icons/rollup.config.mjs
@chia-network/wallets	packages/wallets/rollup.config.mjs

No other options (exportConditions, browser, preferBuiltins, ignoreSideEffectsForRoot). Each config runs rollup-plugin-node-externals with deps: true before nodeResolve, then Babel. @chia-network/gui uses Webpack, not this plugin.

Peer range is rollup@^2.78 \|\| ^3 \|\| ^4. These packages pin rollup@4.62.4. Node engine here is >=20; plugin wants >=14.

2) Intersection with changed APIs

Upstream change	Hits this repo?
v16.0.0 auto development / production export condition (#1823)	Yes, by default. Configs do not set exportConditions. Plugin then injects production, or development if NODE_ENV is set and not 'production'.
v15.3.0 preferBuiltins as a function	No — option unused.
v16.0.1 ignoreSideEffectsForRoot types	No — option unused.
v16.0.2 empty-entry crash, v16.0.3 package "imports" / fileURLToPath(null)	Bugfixes only; named import { nodeResolve } is unchanged.

No deprecated options (customResolveOptions) are used.

3) Risks / unknowns

• Export maps: If a resolved package has exports conditions development / production, the chosen file can change vs 15.2.1. Impact is limited because npm deps are marked external, so most third-party entry points are not bundled. Residual risk is anything still resolved (non-deps, workspace internals, "imports").
• NODE_ENV: Library scripts are rollup -c with no NODE_ENV. Unset → production. A local/CI shell with NODE_ENV=development (or test) would switch conditions. GUI Webpack already sets NODE_ENV explicitly; these Rollup packages do not.
• Not a runtime dep. Failures show up as Rollup/CI library builds, not Electron runtime.
• Scanner ghost_version / major-jump heuristics are not compatibility issues.

4) What to do

Merge after CI library builds (packages/{api,api-react,core,icons,wallets} build / build:ci) pass.

Optional hardening (not required for merge): pass exportConditions: ['production'] in those five configs so library output does not depend on the ambient NODE_ENV.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 19
• Resolution strategy: commit_list
• Changed node/vendor paths: 0
• Changed lockfiles: 0
• Resolved refs: from=n/a to=n/a
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 2

Top findings

• @rollup/plugin-node-resolve:0 ghost_version_or_missing_tag :: 16.0.3
• @rollup/plugin-node-resolve:0 version_jump_anomaly :: 15.2.1->16.0.3