chore(deps): update dependency rollbar to v2.26.5 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
rollbar	2.19.4 → 2.26.5

---

rollbar vulnerable to prototype pollution

CVE-2025-57325 / GHSA-r8c2-2qwq-94p6

More information

Details

Impact

Prototype pollution potential with the utility function rollbar/src/utility.set(). No impact when using the published public interface.

If application code directly imports set from rollbar/src/utility and then calls set with untrusted input in the second argument, it is vulnerable to prototype pollution.

POC:

const obj = {};
require("rollbar/src/utility").set(obj, "__proto__.polluted", "vulnerable");
console.log({}.polluted !== undefined ? '[POLLUTION_TRIGGERED]':'');

Patches

Fixed in version 2.26.5 and 3.0.0-beta5.

Workarounds

If application code directly imports set from rollbar/src/utility, ensure that the second argument does not receive untrusted input.

References

https://github.com/rollbar/rollbar.js/issues/1333#issuecomment-3353720946

Severity

• CVSS Score: 2.9 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References

• https://github.com/rollbar/rollbar.js/security/advisories/GHSA-r8c2-2qwq-94p6
• https://nvd.nist.gov/vuln/detail/CVE-2025-57325
• https://github.com/rollbar/rollbar.js/issues/1333
• https://github.com/rollbar/rollbar.js/commit/d717def8b68f4a947975d0aebb729869cdb2d343
• https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/rollbar%402.26.4/index.js
• https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57325
• https://github.com/advisories/GHSA-r8c2-2qwq-94p6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

rollbar vulnerable to Prototype Pollution in merge()

CVE-2025-62517 / GHSA-xcg2-9pp4-j82x

More information

Details

Impact

Prototype pollution vulnerability in merge(). If application code calls rollbar.configure() with untrusted input, prototype pollution is possible.

Patches

Fixed in 2.26.5 and 3.0.0-beta5.

Workarounds

Ensure that values passed to rollbar.configure() do not contain untrusted input.

References

Fixed in https://github.com/rollbar/rollbar.js/pull/1394 (2.26.x) and https://github.com/rollbar/rollbar.js/pull/1390 (3.x)

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/rollbar/rollbar.js/security/advisories/GHSA-xcg2-9pp4-j82x
• https://github.com/rollbar/rollbar.js/pull/1390
• https://github.com/rollbar/rollbar.js/pull/1394
• https://github.com/rollbar/rollbar.js/commit/61032fe6c208b71e249514800808a54bcb8cb8bb
• https://github.com/rollbar/rollbar.js/commit/d717def8b68f4a947975d0aebb729869cdb2d343
• https://nvd.nist.gov/vuln/detail/CVE-2025-62517
• https://github.com/advisories/GHSA-xcg2-9pp4-j82x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

rollbar/rollbar.js (rollbar)

v2.26.5

Compare Source

Prototype pollution prevention, #​1394

v2.26.4

Compare Source

• Fix server autoinstrument mergeOptions behavior in node v20+, #​1136
  • Fixes compatibility with got package, #​1103

v2.26.3

Compare Source

• Security fix: remove is_js dependency, #​1121
• Remove Node 8 from CI, #​1119
• feat: Support URL object in fetch / XHR telemetry, #​1118

v2.26.2

Compare Source

• Fixed telemetry queue truncation, #​1105
• Better rollbar-react-native compatibility, #​1109

v2.26.1

Compare Source

Fixes

• IE11 compat: Remove arrow functions, #​1073
• Typescript: make type for person.id nullable, #​1074
• Typescript: add retryInterval to Configuration definition, #​1075
• Typescript: Replace object type defs with dictionary type, #​1079
• Angular: provide this to closure, #​1081
• Add default payload keys before the custom transform runs, #​1078

v2.26.0

Compare Source

• Enables compatibility with Service Workers and manifest v3 browser extensions, #​1056
• Updates ignoredMessages type definition to include RegExp, #​1028

v2.25.2

Compare Source

Fixes:

• Polyfill the fetch Headers object if needed, #​1014
• Allow captureIp without a window object, #​1008

v2.25.1

Compare Source

Updates

• Make occurrence write requests async. (HTTP response is already async.), #​1037

v2.25.0

Compare Source

Highlights

• Security update, addresses GHSA-fwr7-v2mv-hh25
• Improved Typescript types
• Improved CSP error detection compatibility
• Improved network telemetry
• Support new Error Cause standard (https://github.com/tc39/proposal-error-cause)

Pull requests

• remove uuid dependency, #​998
• Typescript definition improvement: Added types for payload property, #​997
• Fix LocalsSettings type, #​1004
• Telemetry: don't fail when fetch request body is empty, #​1005
• Add CSP listener on document, not window, #​1007
• Support error cause, #​1012
• Refactor to use current (3.x) async package, #​1018

v2.24.1

Compare Source

• Fix transform declaration (Typescript), #​981
• Handle circular references in custom data, #​990

v2.24.0

Compare Source

Node.js: Supports capturing code context from sourcesContent in the source map file, #​959

v2.23.0

Compare Source

Added ability to use async transform function, #​953

v2.22.0

Compare Source

Highlights

• Typescript type updates for config options: CSP errors, local variables
• Enable basic telemetry for Node.js
• Enable ignoredMessages for trace chain payloads
• Enable net timeout and max retries when sending to the Rollbar API

Pull requests

Remove console.log, #​939
Add TypeScript definitions for CSP error reporting, #​942
Node.js telemetry - logging and http(s) request, #​943
Add node 14, 16 to ci, #​949
Apply ignoredMessages filter to trace_chain occurrences, #​945
Update ts types for locals, #​950
Read timeout from options and pass it to the XMLHttpRequest, #​947

v2.21.1

Compare Source

Highlights

Enables uncaught error capture for Web Workers.

Pull Requests

Enable uncaught error capture for web workers, #​929

v2.21.0

Compare Source

Revised options for Node.js local variables capture:

• Load the locals module separately
• Add options for enable/disable, and uncaughtOnly

v2.20.0

Compare Source

Highlights

• Capture local variables for Node.js
• Enable reporting Content Security Policy (CSP) errors
• Fix wait behavior in async Lambda handler
• Fix scrubbing of objects that are referenced twice in the payload
• Update tracer properties
• Add safelist/blocklist config options and deprecate whitelist/blacklist
• Update/fix assorted Typescript definitions

Pull requests

Add item and occurrence URL as tags to tracer, #​889
Improve error callback handling, #​900
Adds 'scrubPaths' to Configuration interface, #​899
TypeScript allow undefined LogArgument, #​907
Enable reporting for CSP errors, #​903
Wait in async lambda handler, #​910
Deprecate whitelist/blacklist in favor of safelist/blocklist, #​911
Enable node.js stack locals capture, #​902
Enable depth of traversal for node local vars, #​914
Update type definition, #​917
Scrub all occurrences of objects seen twice, #​913

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.