rollup-watch

This package has been abandoned since 2017 and should not be used in new projects. The last release was over 6 years ago, and Rollup itself has moved watch functionality into the core package. From a security perspective, this is a significant red flag - no CVE response capability, no dependency updates, and no maintenance for modern Node.js versions.

When I used this in legacy projects, the watch implementation was basic but functional. However, the error handling is minimal and doesn't provide useful context when file watching fails. There's no input validation on watch paths, which could potentially be exploited if user input reaches the configuration. The library doesn't handle symlinks securely and can follow them unexpectedly.

The biggest practical issue is dependency rot. Running npm audit shows transitive dependencies with known vulnerabilities that will never be patched. Modern Rollup projects should use the built-in watch mode (rollup -w) or rollup-plugin-serve, which are actively maintained and have proper security support.

This package is effectively deprecated and shouldn't be used for new projects. The last release was in 2017, and its functionality has been integrated directly into Rollup core since version 0.50. If you try to use rollup-watch today, you'll encounter dependency conflicts and compatibility issues with modern Rollup versions.

When I initially tried this package before realizing it was deprecated, the setup was confusing because the documentation doesn't clearly indicate its obsolete status. The API itself was straightforward - you'd pass your Rollup config and get file watching - but error messages when things went wrong were minimal. The package would silently fail or throw cryptic errors when module resolution failed.

The migration path is simple: just use Rollup's native watch API (`rollup.watch()`) which has better error handling, active maintenance, and clearer documentation. The built-in watch mode provides the same functionality with better performance and integration.

This package hasn't been updated since 2017 and is effectively deprecated. In modern Rollup (v0.60+), watch functionality is built directly into the core package, making rollup-watch unnecessary. If you're still using this, you're likely working with a legacy codebase that needs upgrading.

The API itself was straightforward when it was relevant - you'd import the watcher, pass your Rollup config, and listen for events. However, the lack of TypeScript definitions, outdated dependencies, and absence of modern JavaScript features make it painful to work with today. Error messages are basic and don't provide the helpful context you'd expect from current tooling.

The migration path is clear: remove this package and use Rollup's native `rollup.watch()` API instead. The modern API is better documented, actively maintained, and provides superior type safety. There's simply no reason to use rollup-watch in any new or actively maintained project.