diff --git a/packages/analytics/package.json b/packages/analytics/package.json
index 5d4c4d06735..033fb6cf6ba 100644
--- a/packages/analytics/package.json
+++ b/packages/analytics/package.json
@@ -50,7 +50,7 @@
     "@firebase/app": "0.13.1",
     "rollup": "2.79.2",
     "rollup-plugin-dts": "5.3.1",
-    "@rollup/plugin-commonjs": "21.1.0",
+    "@rollup/plugin-commonjs": "28.0.6",
     "@rollup/plugin-json": "6.1.0",
     "@rollup/plugin-node-resolve": "16.0.0",
     "rollup-plugin-typescript2": "0.36.0",
diff --git a/packages/app-check-compat/package.json b/packages/app-check-compat/package.json
index 29ed9977205..992e6c8d97b 100644
--- a/packages/app-check-compat/package.json
+++ b/packages/app-check-compat/package.json
@@ -45,7 +45,7 @@
   "devDependencies": {
     "@firebase/app-compat": "0.4.1",
     "rollup": "2.79.2",
-    "@rollup/plugin-commonjs": "21.1.0",
+    "@rollup/plugin-commonjs": "28.0.6",
     "@rollup/plugin-json": "6.1.0",
     "@rollup/plugin-node-resolve": "16.0.0",
     "rollup-plugin-typescript2": "0.36.0",
diff --git a/packages/app-check/package.json b/packages/app-check/package.json
index e52ff90dbc7..541b5c83c14 100644
--- a/packages/app-check/package.json
+++ b/packages/app-check/package.json
@@ -46,7 +46,7 @@
   "devDependencies": {
     "@firebase/app": "0.13.1",
     "rollup": "2.79.2",
-    "@rollup/plugin-commonjs": "21.1.0",
+    "@rollup/plugin-commonjs": "28.0.6",
     "@rollup/plugin-json": "6.1.0",
     "@rollup/plugin-node-resolve": "16.0.0",
     "rollup-plugin-typescript2": "0.36.0",
diff --git a/packages/firebase/package.json b/packages/firebase/package.json
index 4f785d15c8c..b16caf5f66e 100644
--- a/packages/firebase/package.json
+++ b/packages/firebase/package.json
@@ -442,7 +442,7 @@
   },
   "devDependencies": {
     "rollup": "2.79.2",
-    "@rollup/plugin-commonjs": "21.1.0",
+    "@rollup/plugin-commonjs": "28.0.6",
     "@rollup/plugin-node-resolve": "16.0.0",
     "rollup-plugin-sourcemaps": "0.6.3",
     "@rollup/plugin-terser": "0.4.4",
diff --git a/packages/installations-compat/package.json b/packages/installations-compat/package.json
index cb5f6f730a6..fe3476be754 100644
--- a/packages/installations-compat/package.json
+++ b/packages/installations-compat/package.json
@@ -46,7 +46,7 @@
   "devDependencies": {
     "@firebase/app-compat": "0.4.1",
     "rollup": "2.79.2",
-    "@rollup/plugin-commonjs": "21.1.0",
+    "@rollup/plugin-commonjs": "28.0.6",
     "@rollup/plugin-json": "6.1.0",
     "@rollup/plugin-node-resolve": "16.0.0",
     "rollup-plugin-typescript2": "0.36.0",
diff --git a/packages/installations/package.json b/packages/installations/package.json
index a1d89e48321..e4d343ba0f1 100644
--- a/packages/installations/package.json
+++ b/packages/installations/package.json
@@ -51,7 +51,7 @@
   "devDependencies": {
     "@firebase/app": "0.13.1",
     "rollup": "2.79.2",
-    "@rollup/plugin-commonjs": "21.1.0",
+    "@rollup/plugin-commonjs": "28.0.6",
     "@rollup/plugin-json": "6.1.0",
     "@rollup/plugin-node-resolve": "16.0.0",
     "rollup-plugin-typescript2": "0.36.0",
diff --git a/packages/webchannel-wrapper/package.json b/packages/webchannel-wrapper/package.json
index 07b6385ed07..0169b530d29 100644
--- a/packages/webchannel-wrapper/package.json
+++ b/packages/webchannel-wrapper/package.json
@@ -32,7 +32,7 @@
   "license": "Apache-2.0",
   "devDependencies": {
     "closure-net": "git+https://github.com/google/closure-net.git#0412666",
-    "@rollup/plugin-commonjs": "21.1.0",
+    "@rollup/plugin-commonjs": "28.0.6",
     "rollup": "2.79.2",
     "rollup-plugin-copy": "3.5.0",
     "rollup-plugin-sourcemaps": "0.6.3",
diff --git a/repo-scripts/size-analysis/package.json b/repo-scripts/size-analysis/package.json
index 5084ee78d04..b64f6668fdc 100644
--- a/repo-scripts/size-analysis/package.json
+++ b/repo-scripts/size-analysis/package.json
@@ -23,7 +23,7 @@
     "@firebase/app": "0.13.1",
     "@firebase/logger": "0.4.4",
     "@firebase/util": "1.12.0",
-    "@rollup/plugin-commonjs": "21.1.0",
+    "@rollup/plugin-commonjs": "28.0.6",
     "@rollup/plugin-json": "6.1.0",
     "@rollup/plugin-node-resolve": "16.0.0",
     "@rollup/plugin-virtual": "2.1.0",
diff --git a/yarn.lock b/yarn.lock
index 51ede769d03..43d1573c6c9 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2602,18 +2602,18 @@
   resolved "https://registry.npmjs.org/@rollup/plugin-alias/-/plugin-alias-5.1.1.tgz#53601d88cda8b1577aa130b4a6e452283605bf26"
   integrity sha512-PR9zDb+rOzkRb2VD+EuKB7UC41vU5DIwZ5qqCpk0KJudcWAyi8rvYOhS7+L5aZCspw1stTViLgN5v6FF1p5cgQ==
 
-"@rollup/plugin-commonjs@21.1.0":
-  version "21.1.0"
-  resolved "https://registry.npmjs.org/@rollup/plugin-commonjs/-/plugin-commonjs-21.1.0.tgz#45576d7b47609af2db87f55a6d4b46e44fc3a553"
-  integrity sha512-6ZtHx3VHIp2ReNNDxHjuUml6ur+WcQ28N1yHgCQwsbNkQg2suhxGMDQGJOn/KuDxKtd1xuZP5xSTwBA4GQ8hbA==
+"@rollup/plugin-commonjs@28.0.6":
+  version "28.0.6"
+  resolved "https://registry.npmjs.org/@rollup/plugin-commonjs/-/plugin-commonjs-28.0.6.tgz#32425f28832a1831c4388b71541ef229ef34cd4c"
+  integrity sha512-XSQB1K7FUU5QP+3lOQmVCE3I0FcbbNvmNT4VJSj93iUjayaARrTQeoRdiYQoftAJBLrR9t2agwAd3ekaTgHNlw==
   dependencies:
-    "@rollup/pluginutils" "^3.1.0"
+    "@rollup/pluginutils" "^5.0.1"
     commondir "^1.0.1"
-    estree-walker "^2.0.1"
-    glob "^7.1.6"
-    is-reference "^1.2.1"
-    magic-string "^0.25.7"
-    resolve "^1.17.0"
+    estree-walker "^2.0.2"
+    fdir "^6.2.0"
+    is-reference "1.2.1"
+    magic-string "^0.30.3"
+    picomatch "^4.0.2"
 
 "@rollup/plugin-json@6.1.0":
   version "6.1.0"
@@ -7502,6 +7502,11 @@ fdir@6.3.0:
   resolved "https://registry.npmjs.org/fdir/-/fdir-6.3.0.tgz#fcca5a23ea20e767b15e081ee13b3e6488ee0bb0"
   integrity sha512-QOnuT+BOtivR77wYvCWHfGt9s4Pz1VIMbD463vegT5MLqNXy8rYFT/lPVEqf/bhYeT6qmqrNHhsX+rWwe3rOCQ==
 
+fdir@^6.2.0:
+  version "6.4.6"
+  resolved "https://registry.npmjs.org/fdir/-/fdir-6.4.6.tgz#2b268c0232697063111bbf3f64810a2a741ba281"
+  integrity sha512-hiFoqpyZcfNm1yc4u8oWCf9A2c4D3QjCrks3zmoVKVxpQRzmPNar1hUJcBG2RQHvEVGDN+Jm81ZheVLAQMK6+w==
+
 fecha@^4.2.0:
   version "4.2.3"
   resolved "https://registry.npmjs.org/fecha/-/fecha-4.2.3.tgz#4d9ccdbc61e8629b259fdca67e65891448d569fd"
@@ -9627,7 +9632,7 @@ is-promise@^2.1.0, is-promise@^2.2.2:
   resolved "https://registry.npmjs.org/is-promise/-/is-promise-2.2.2.tgz#39ab959ccbf9a774cf079f7b40c7a26f763135f1"
   integrity sha512-+lP4/6lKUBfQjZ2pdxThZvLUAafmZb8OAxFb8XXtiQmS35INgr85hdOGoEs124ez1FCnZJt6jau/T+alh58QFQ==
 
-is-reference@^1.2.1:
+is-reference@1.2.1:
   version "1.2.1"
   resolved "https://registry.npmjs.org/is-reference/-/is-reference-1.2.1.tgz#8b2dac0b371f4bc994fdeaba9eb542d03002d0b7"
   integrity sha512-U82MsXXiFIrjCK4otLT+o2NA2Cd2g5MLoOVXUZjIOhLurrRxpEXzI8O0KZHr3IjLvlAH1kTPYSuqer5T9ZVBKQ==
@@ -14155,7 +14160,7 @@ resolve.exports@^2.0.0:
   resolved "https://registry.npmjs.org/resolve.exports/-/resolve.exports-2.0.3.tgz#41955e6f1b4013b7586f873749a635dea07ebe3f"
   integrity sha512-OcXjMsGdhL4XnbShKpAcSqPMzQoYkYyhbEaeSko47MjRP9NfEQMhZkXL1DoFlt9LWQn4YttrdnV6X2OiyzBi+A==
 
-resolve@^1.1.6, resolve@^1.1.7, resolve@^1.10.0, resolve@^1.14.2, resolve@^1.17.0, resolve@^1.20.0, resolve@^1.22.1, resolve@^1.22.4, resolve@^1.3.2, resolve@^1.3.3, resolve@^1.4.0, resolve@~1.22.0, resolve@~1.22.1:
+resolve@^1.1.6, resolve@^1.1.7, resolve@^1.10.0, resolve@^1.14.2, resolve@^1.20.0, resolve@^1.22.1, resolve@^1.22.4, resolve@^1.3.2, resolve@^1.3.3, resolve@^1.4.0, resolve@~1.22.0, resolve@~1.22.1:
   version "1.22.10"
   resolved "https://registry.npmjs.org/resolve/-/resolve-1.22.10.tgz#b663e83ffb09bbf2386944736baae803029b8b39"
   integrity sha512-NPRy+/ncIMeDlTAsuqwKIiferiawhefFJtkNSW0qZJEqMEb+qBt/77B/jGeeek+F0uOeN05CDa6HXbbIgtVX4w==