fix(deps): update dependency rollbar to v2.26.5 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
rollbar	2.26.0 -> 2.26.5

GitHub Vulnerability Alerts

CVE-2025-57325

Impact

Prototype pollution potential with the utility function rollbar/src/utility.set(). No impact when using the published public interface.

If application code directly imports set from rollbar/src/utility and then calls set with untrusted input in the second argument, it is vulnerable to prototype pollution.

POC:

const obj = {};
require("rollbar/src/utility").set(obj, "__proto__.polluted", "vulnerable");
console.log({}.polluted !== undefined ? '[POLLUTION_TRIGGERED]':'');

Patches

Fixed in version 2.26.5 and 3.0.0-beta5.

Workarounds

If application code directly imports set from rollbar/src/utility, ensure that the second argument does not receive untrusted input.

References

https://github.com/rollbar/rollbar.js/issues/1333#issuecomment-3353720946

CVE-2025-62517

Impact

Prototype pollution vulnerability in merge(). If application code calls rollbar.configure() with untrusted input, prototype pollution is possible.

Patches

Fixed in 2.26.5 and 3.0.0-beta5.

Workarounds

Ensure that values passed to rollbar.configure() do not contain untrusted input.

References

Fixed in https://github.com/rollbar/rollbar.js/pull/1394 (2.26.x) and https://github.com/rollbar/rollbar.js/pull/1390 (3.x)

---

Release Notes

rollbar/rollbar.js (rollbar)

v2.26.5

Compare Source

Prototype pollution prevention, #​1394

v2.26.4

Compare Source

• Fix server autoinstrument mergeOptions behavior in node v20+, #​1136
  • Fixes compatibility with got package, #​1103

v2.26.3

Compare Source

• Security fix: remove is_js dependency, #​1121
• Remove Node 8 from CI, #​1119
• feat: Support URL object in fetch / XHR telemetry, #​1118

v2.26.2

Compare Source

• Fixed telemetry queue truncation, #​1105
• Better rollbar-react-native compatibility, #​1109

v2.26.1

Compare Source

Fixes

• IE11 compat: Remove arrow functions, #​1073
• Typescript: make type for person.id nullable, #​1074
• Typescript: add retryInterval to Configuration definition, #​1075
• Typescript: Replace object type defs with dictionary type, #​1079
• Angular: provide this to closure, #​1081
• Add default payload keys before the custom transform runs, #​1078

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	rollbar@​2.26.0 ⏵ 2.26.5	+1	+13	+4

View full report