rollup-plugin-typescript2

Getting rollup-plugin-typescript2 working initially takes some trial and error. The plugin respects your tsconfig.json settings, which is good for consistency, but cryptic errors arise when configurations conflict between Rollup and TypeScript. The error messages around path resolution and declaration file generation can be frustratingly vague. You'll often find yourself comparing working configurations from GitHub repos rather than relying on documentation.

The plugin's caching mechanism speeds up rebuilds significantly, but can cause confusing issues when type definitions change. I've had to regularly clear the .rts2_cache folder when debugging strange type errors. The plugin does surface TypeScript errors during bundling, which is its main selling point over alternatives, though this sometimes results in double error reporting that clutters the console.

Community support is adequate but fragmented—many Stack Overflow answers are outdated given changes in both Rollup and TypeScript ecosystems. GitHub issues show the maintainer is responsive but the project hasn't seen major updates recently. For straightforward library bundling it works fine, but complex monorepo setups or custom path mappings require significant troubleshooting.

This plugin does what it advertises - compiles TypeScript in Rollup builds with better error reporting than the original rollup-plugin-typescript. The caching mechanism can speed up incremental builds, though cache invalidation occasionally causes stale output issues that require manual cache clearing.

From a security perspective, the plugin introduces dependencies on multiple TypeScript compiler APIs and file system operations that expand your supply chain attack surface. The error messages can be verbose and occasionally expose full file paths in build logs, which may leak project structure information in CI/CD environments. The plugin doesn't validate tsconfig paths thoroughly, which can lead to unexpected file access patterns.

Maintenance has stalled since late 2023, and the dependency tree includes packages with known CVEs that haven't been addressed. For greenfield projects, @rollup/plugin-typescript is now the better-maintained official alternative with a smaller dependency footprint and active security updates.

In practice, this plugin does what it promises—compiles TypeScript through Rollup with better error reporting than the original plugin. The caching mechanism speeds up rebuilds noticeably, and the tsconfig resolution works as expected. However, from a security perspective, there are concerns worth noting.

The plugin hasn't seen updates since September 2023, which is worrying given the fast-moving nature of both TypeScript and the build tool ecosystem. While it doesn't directly handle user input or perform network operations, its role in the build pipeline means vulnerabilities in dependencies could affect your supply chain. The error messages are verbose but sometimes leak absolute file paths, which could expose internal directory structures in CI logs.

Dependency-wise, it pulls in TypeScript as a peer dependency, but the pinning strategy and version compatibility aren't always clear. I've encountered situations where TypeScript minor version bumps caused subtle issues that weren't immediately obvious. The plugin itself doesn't follow modern secure-by-default patterns—configuration is permissive and doesn't warn about potentially unsafe settings like preserving symlinks or custom transformer paths.