chore(deps): update rolldown-related dependencies by renovate[bot] · Pull Request #167 · rolldown/plugins

renovate · 2026-11-09T00:38:57Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@oxc-project/types (source)	`^0.156.0` → `^0.158.0`
oxc-parser (source)	`^0.156.0` → `^0.158.0`
rolldown (source)	`^1.2.16` → `^1.3.1`
tsdown (source)	`^0.23.4` → `^0.23.7`
vite (source)	`^8.3.5` → `^8.3.7`

Release Notes

oxc-project/oxc (oxc-parser)

`v0.158.0`

📚 Documentation

6448a54 napi/parser: Correct parser options and usage guidance (#29065) (camc314)
6989796 parser: Update TS-ESTree import differences (#29061) (camc314)

`v0.157.0`

🐛 Bug Fixes

3421516 parser: Preserve default import names in reexports (#28442) (Boshen)
ed7df7d ast/estree: Include comments in TS Program span (#28326) (camc314)

rolldown/rolldown (rolldown)

`v1.3.1`

Compare Source

🚀 Features

inline-common-chunks: inline chunks using import.meta.ROLLDOWN_FILE_URL_* (#11543) by @mattlewis92

🐛 Bug Fixes

cli: apply --environment before loading the binding (#11553) by @Brooooooklyn
rolldown_plugin_vite_resolve: escape module names in generated error stubs (#11584) by @sapphi-red
add the code location to transform logs and errors at position 0 (#11568) by @chinmayajha
match sticky regexes only at the start of the string (#11569) by @chinmayajha
iife/umd: skip namespace markers when the entry has no exports (#11567) by @lazerg
keep a declaration's name when it clashes with an external import (#11052) by @Nic-Polumeyv
drop top-level statements made dead by imported constants before chunk linking (#11053) by @elliott-with-the-longest-name-on-github
keep this.resolve custom options apart for overlapping calls (#11505) by @wan9chi
transform: reuse TsconfigCache's answer when no tsconfig owns the file (#11265) by @sarankumar1325
treat top-level this of a required module without module syntax as its exports (#11271) by @sarankumar1325
keep side effects of a module whose exported constant is inlined (#11440) by @hyfdev
leave same-chunk dynamic imports out of dynamicImports (#11156) by @kkkhs

🚜 Refactor

prepend transferred imports as AST fragments (#11464) by @Dunqing

📚 Documentation

show vp first in setup commands (#11503) by @IWANABETHATGUY

⚡ Performance

incremental: reuse link-time facade symbols across rebuilds (#11542) by @mattlewis92
incremental: share module sourcemap chains across cache clones (#11540) by @mattlewis92
chunk_optimizer: answer runtime-merge reachability from one chunk-level graph (#11541) by @mattlewis92
send only changed chunk properties back to Rust from output hooks (#11488) by @anonrig

🧪 Testing

remove review fixtures committed by mistake in #11052 (#11574) by @hyfdev
wasi: cover raw context destruction (#11561) by @Brooooooklyn

⚙️ Miscellaneous Tasks

deps: update rust crates (#11573) by @renovate[bot]
deps: update mimalloc-safe to 0.1.70 (#11589) by @shulaoda
renovate: update GitHub Actions that are pinned to a commit (#11583) by @hyfdev
skip Playwright browser downloads in Prepare Release (#11579) by @shulaoda
pin the rolldown crates to exact versions of each other on release (#11577) by @shulaoda
update CodSpeedHQ/action to v5.6.3 for Ubuntu 26.04 (#11575) by @hyfdev
remove stale entries from .typos.toml (#11571) by @iiio2
pick the Prepare Release target branch from the version (#11525) by @shulaoda
run every OS on pushes to maintenance branches (#11520) by @shulaoda
rebase maintenance Vite branches onto their Vite minor (#11515) by @shulaoda
run CI on pushes to maintenance branches (#11516) by @shulaoda
support patch releases from maintenance branches (#11393) by @shulaoda

❤️ New Contributors

@chinmayajha made their first contribution in #11568
@lazerg made their first contribution in #11567
@elliott-with-the-longest-name-on-github made their first contribution in #11053
@sarankumar1325 made their first contribution in #11265
@anonrig made their first contribution in #11488
@kkkhs made their first contribution in #11156

`v1.3.0`

Compare Source

💥 BREAKING CHANGES

cli: reject --input together with positional entries like Rollup (#11445) by @IWANABETHATGUY

🚀 Features

perf-kit: measure the deployed site and replay it for local builds (#11215) by @IWANABETHATGUY
perf-kit: diagnose chunk loading before FCP and LCP (#11214) by @IWANABETHATGUY
import-attributes: keep import attributes away from plugins without the option (#11476) by @shulaoda
import-attributes: let a type import attribute beat moduleTypes in the asset and copy plugins (#11309) by @shulaoda
import-attributes: pass import attributes to the transform hook (#11308) by @shulaoda
import-attributes: pass import attributes to the load hook (#11307) by @shulaoda
import-attributes: accept import attributes in this.resolve and this.load (#11306) by @shulaoda
import-attributes: pass import attributes to the resolveId and resolveDynamicImport hooks (#11305) by @shulaoda
import-attributes: expose experimental.importAttributes and the module id helpers to JS (#11304) by @shulaoda
import-attributes: render the import attributes of externals from their module identity (#11303) by @shulaoda
import-attributes: make import attributes part of module identity (#11302) by @shulaoda
import-attributes: model import attributes and keep them on the import record (#11301) by @shulaoda
expose notify APIs (#11380) by @sapphi-red
devtools: list the hooks that did no work in the report (#11388) by @IWANABETHATGUY

🐛 Bug Fixes

respect NO_COLOR in error and warning diagnostics (#11499) by @shulaoda
rolldown_plugin_vite_import_glob: match negated ** globs from the walk root (#11495) by @shulaoda
lazy-barrel: report used lazy barrel uncertain bindings with a dedicated error (#11493) by @shulaoda
avoid following output directory symlinks with output.cleanDir (#11494) by @sapphi-red
rolldown_plugin_vite_dynamic_import_vars: handle CRLF line breaks in the static import prefix (#11492) by @shulaoda
rolldown_plugin_vite_build_import_analysis: ensure unique preload markers (#11157) by @sapphi-red
watch: match Rollup for BUNDLE_END output and multi-config watch options (#10348) by @Brooooooklyn
rolldown_plugin_vite_dynamic_import_vars: escape import specifier (#11483) by @sapphi-red
error: add id, plugin, and frame to native errors (#9979) by @raminjafary
treeshaking: run a CommonJS module that is reached only through export * (#11423) by @magurotuna
escape URL in sourceMappingURL (#11482) by @sapphi-red
rolldown_plugin_vite_import_glob: escape import names (#11486) by @sapphi-red
rolldown_plugin_esm_external_require: escape import specifiers (#11487) by @sapphi-red
tree-shaking: drop unused imports of side-effect-free externals in ESM output (#11470) by @hyfdev
lazy-barrel: treat bindings behind skipped lazy barrel records as unknown (#11448) by @shulaoda
rolldown_plugin_vite_react_refresh_wrapper: escape import specifier (#11485) by @sapphi-red
devtools: count only hook calls that ran in the report (#11468) by @IWANABETHATGUY
rust: harden bundle close lifecycle (#11371) by @Brooooooklyn
strict-execution-order: name shared CJS re-export bindings independently of load order (#11206) by @natew
dev/lazy: don't proxy plugin-resolved externals (#11295) by @cestercian
rolldown_plugin_vite_transform: report oxc transformer warnings as warnings (#11459) by @Dunqing
dev: report a lazy-compile failure as diagnostics, not a formatted string (#10490) by @tbvjaos510
binding: stop mishandling per-call data at the callable builtin plugin boundary (#10482) by @hyfdev
dev/lazy: resolve import() of a CommonJS module to its ESM view (#11020) by @h-a-n-a
dev/lazy: load a lazy route in one request and only as factories (#11000) by @h-a-n-a
error when one module id resolves as both external and non-external (#11421) by @IWANABETHATGUY
sourcemap: keep only traced sources and names in module sourcemaps (#11270) by @IWANABETHATGUY
give module namespace objects a null prototype and make them non-extensible (#11428) by @IWANABETHATGUY
watch: reset JS load promises before rebuilding (#11316) by @owjs3901
new-url: keep the query and fragment when rewriting new URL() (#11420) by @theRizwan
dev: don't panic when buildStart emits a chunk during a partial rebuild (#11322) by @RagedPanda
treeshaking: drop an unused top-level import() of a side-effect-free module that exports then (#11409) by @hyfdev
derive reference ids from stable seeds for deterministic builds (#10797) by @MarshallOfSound
rolldown_plugin_vite_import_glob: resolve aliased globs without blocking a runtime worker (#11385) by @shulaoda
preserve-modules: read the extension after sanitizeFileName like Rollup (#11413) by @IWANABETHATGUY
rolldown_plugin_vite_dynamic_import_vars: await the resolver instead of blocking a runtime worker (#11386) by @shulaoda
cli: preserve entry arguments after double dash (#11438) by @shuvroroy
treeshaking: invalidate constants when exports is reassigned (#11430) by @shuvroroy
plugin: queue onLog callbacks eagerly (#11374) by @Brooooooklyn
avoid inferring constants from compound CommonJS exports (#11429) by @shuvroroy
json: avoid shadowing JSON.parse with named exports (#11432) by @shuvroroy
watcher: prioritize queued input during debounce (#11369) by @Brooooooklyn
replace: preserve declarations after Unicode text (#11435) by @shuvroroy
treeshaking: don't drop side effects that follow an exports.x write in the same CommonJS statement (#11408) by @hyfdev
don't inline a CommonJS export that is assigned conditionally or also through module.exports (#11404) by @hyfdev
json: preserve proto as an own data property (#11367) by @shuvroroy
tree-shaking: preserve dynamic import exports read through callback arguments (#11366) by @shuvroroy
respect externalLiveBindings for star re-exports from externals in cjs (#11328) by @logaretm
preserve-modules: keep non-JS extensions in [name] (#11410) by @cestercian
treeshaking: don't tree-shake a statement that holds a CommonJS top-level return (#11402) by @hyfdev
don't export JSON keys that the finalizer inlines away from a shared chunk (#11396) by @IWANABETHATGUY
sourcemap: support toUrl without Buffer (#11370) by @Brooooooklyn
handle nullish thrown values in error summary (#11373) by @Brooooooklyn
don't inline a var that module-level code reads before its declaration (#11379) by @hyfdev
treat a repeated var declaration as a reassignment (#11378) by @hyfdev

🚜 Refactor

remove dead concatenated wrapped module code (#11453) by @Dunqing
align watch options for the util function to dev mode (#11474) by @sapphi-red
simplify splitting oxc diagnostics by severity (#11458) by @Dunqing
rolldown: run deferred drops on a dedicated thread instead of rayon (#11372) by @Brooooooklyn
align watch options for dev mode and build (#11446) by @sapphi-red

📚 Documentation

add build report and perf-kit in-depth pages (#11480) by @IWANABETHATGUY
rolldown_plugin_vite_import_glob: describe how import.meta.glob follows file changes (#10573) by @shulaoda
import-attributes: add an in-depth guide for import attributes (#11310) by @shulaoda
import-attributes: correct comments and docs about import attributes (#11477) by @shulaoda
rolldown: explain why drops are deferred and why drain waits for every bundler's drops (#11455) by @hyfdev

⚡ Performance

rolldown_plugin_vite_dynamic_import_vars: avoid string allocation for first_quasi (#11484) by @sapphi-red
node: read each rendered chunk's binding fields once (#11364) by @mattlewis92

🧪 Testing

import-attributes: run the esbuild import attributes tests with the option on (#11472) by @shulaoda
import-attributes: port the Rollup 5 import attributes tests (#11381) by @shulaoda
rolldown_plugin_vite_import_glob: cover the glob matcher (#10572) by @shulaoda
rolldown_plugin_vite_import_glob: cover import.meta.glob file creation and deletion (#10551) by @shulaoda

⚙️ Miscellaneous Tasks

ai: harden rolldown REPL decode skill (#11491) by @sapphi-red
deps: update rust crate testing_macros to v2 (#11439) by @renovate[bot]
deps: update dependency @napi-rs/cli to v3.10.12 (#11463) by @renovate[bot]
deps: update dependency vite-plus to v1.5.0 (#11475) by @renovate[bot]
deps: update dependency glob to v14 [security] (#11462) by @renovate[bot]
deps: upgrade oxc to 0.157.0 (#11460) by @camc314
deps: update dependency @napi-rs/cli to v3.10.11 (#11461) by @renovate[bot]
deps: update dependency @napi-rs/cli to v3.10.10 (#11454) by @renovate[bot]
deps: update rollup submodule for tests to v4.67.4 (#11451) by @rolldown-guard[bot]
deps: update test262 submodule for tests (#11452) by @rolldown-guard[bot]
deps: update dependency rolldown-plugin-dts to ^0.29.0 (#11427) by @renovate[bot]
deps: update rust crates (#11426) by @renovate[bot]
deps: update npm packages (#11425) by @renovate[bot]
deps: update rust crate napi to v3.16.1 (#11401) by @renovate[bot]
release @rolldown/perf-kit independently (#11394) by @shulaoda
deps: update napi to v3.16.0 (#11389) by @renovate[bot]
drop outdated CLAUDE.md symlink note from AGENTS.md (#11384) by @iiio2

❤️ New Contributors

@raminjafary made their first contribution in #9979
@natew made their first contribution in #11206
@cestercian made their first contribution in #11295
@owjs3901 made their first contribution in #11316
@theRizwan made their first contribution in #11420
@RagedPanda made their first contribution in #11322

`v1.2.19`

Compare Source

[1.2.19] - 2026-11-11

🐛 Bug Fixes

update @napi-rs/cli to 3.10.12 so linux-x64-gnu runs on older CPUs (#11617)

Co-authored-by: shulaoda 165626830+shulaoda@users.noreply.github.com

`v1.2.18`

Compare Source

[1.2.18] - 2026-11-09

[!TIP]
v1.2.17 was published to crates.io only. Its changes are released to
npm in this version.

🐛 Bug Fixes

rolldown_plugin_vite_resolve: escape module names in generated error
stubs (#11585)
sourcemap: keep only traced sources and names in module sourcemaps
(#11270) (#11587)

⚙️ Miscellaneous Tasks

deps: update mimalloc-safe to 0.1.70 (#11593)
pick the Prepare Release target branch from the version (#11528)
run every OS on pushes to maintenance branches (#11523)
run CI on pushes to maintenance branches (#11519)
support patch releases from maintenance branches (#11514)

Co-authored-by: sapphi-red 49056869+sapphi-red@users.noreply.github.com

rolldown/tsdown (tsdown)

`v0.23.7`

Compare Source

[!NOTE]
v0.23.6 was skipped on purpose: its release failed, so this release follows v0.23.5 directly.

Notes

rolldown-plugin-dts is now v0.30. Full details are in the rolldown-plugin-dts v0.30.0 release notes.

Migration

dts.entry only filters entries. Only entries that match get declaration files. A matching file that is not an entry no longer gets its own declaration file. To emit declarations for such a file, add it to entry. The filter now applies to .d.cts as well as .d.mts.

dts.entry is resolved from cwd. Patterns are relative to tsdown's cwd, the same as the top-level entry, instead of process.cwd(). This only matters when the two differ, e.g. in workspace builds. Set dts.cwd to override it.

dts.emitDtsOnly and dts.dtsInput are deprecated. Use dts.dtsOnly instead. The old names still work but log a warning.

Highlights

dts: An entry's file-level doc comment is kept in its declaration file.
dts: Declaration files no longer contain a dangling sourceMappingURL.
dts: CJS declaration builds no longer emit a throwaway JS chunk. With the tsc generator, they build one program for all entries.
tsgo (experimental): Diagnostics show code context in color terminals, and packages from project references and files outside the tsconfig directory now get declarations.
Agent skill: The npm package now ships a small tsdown skill. pnpm 12.11+ can link it into agent skill directories, and it points agents to the full skill on GitHub for the installed version.

🚀 Features

Ship a skill facade in the npm package - by @sxzzbot in #1122 (6ad05)
dts: Upgrade rolldown-plugin-dts to v0.30 - by @sxzzbot in #1123 (d351b)

View changes on GitHub

`v0.23.5`

Compare Source

Notes

rolldown-plugin-dts is now v0.29. tsdown passes dts options through to it unchanged, so its deprecations show up in your config too. Full details are in the rolldown-plugin-dts v0.29.0 release notes.

Migration

tsc-only dts options move under dts.tsc. The top-level build, incremental, parallel, eager, newContext and vue options still work but log a deprecation warning. Setting the same option at both levels throws an error. emitJs stays at the top level.

 export default defineConfig({
   dts: {
-    vue: true,
+    tsc: { vue: true },
   },
 })

tsgo (experimental, not covered by semver):

@typescript/native-preview is no longer supported. Install TypeScript 7.1+ (typescript@7.1.0-beta), or point tsgo.moduleUrl at another build.
On TypeScript 7.1+, tsgo.path is the API server executable, not the tsgo CLI. You usually don't need to set it.
Declaration maps come only from compilerOptions.declarationMap: true in tsconfig; the sourcemap option no longer enables them.
TypeScript 7.0 still works with a deprecation warning, but that backend will be removed soon.

🚀 Features

css: Support css: false to disable built-in CSS handling - by @sxzzbot in #1113 (181af)
dts: Upgrade rolldown-plugin-dts to v0.29, upgrade deps - by @sxzzbot in #1121 (e12ab)

🐞 Bug Fixes

css: Remove dangling requires and handle CSS extensions in chunk names - by @sxzzbot in #1114 (c8ca3)

🏎 Performance

deps: Read each package.json once when resolving dep subpaths - by @Cherry and @sxzzbot in #1093 (4435a)

View changes on GitHub

vitejs/vite (vite)

`v8.3.7`

Compare Source

Bug Fixes

deps: update Rolldown to v1.2.18 (#24038) (517affb)

Miscellaneous Chores

enable more lint rules (#24035) (72f86e5)

Tests

use onTestFinished for tear downs (#24003) (a579e35)

Build System

generate sourcemaps in shim-deps plugin (#24023) (c02138c)

`v8.3.6`

Compare Source

Bug Fixes

await overlapping plugin container close calls (#23935) (175bbeb)
build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
deps: update all non-major dependencies (#23896) (46b91c5)
deps: update all non-major dependencies (#23966) (b3cb057)
deps: update rolldown-related dependencies (#23868) (a63eb87)
deps: update rolldown-related dependencies (#23967) (0105733)
dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)
html: remove adjacent module tags on the first line (#23823) (eab1dc2)
ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)
optimizer: detect cache dir precisely (#23912) (cc9bc21)
optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)
respect build.sourcemap from environment (#23879) (82e7aa0)
server: escape HTML attributes (#23995) (a270391)
server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)
ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)
use top-level input for SSR build when build.ssr: true (#23898) (90bc034)
wasm: reject .wasm outside server.fs (#23914) (64e2467)
watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)
worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

build: remove preload link listeners on settle (fix #23920) (#23922) (8109efd)
css: index rendered modules once per output for cssScopeTo ([#23889

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

socket-security · 2026-11-09T00:39:15Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@oxc-project/types@0.158.0
rolldown@1.2.16 ⏵ 1.3.1		⁺¹
vite@8.3.5 ⏵ 8.3.7
tsdown@0.23.4 ⏵ 0.23.7	⁺¹	⁺¹	⁺¹
oxc-parser@0.156.0 ⏵ 0.158.0			⁺¹

View full report

renovate Bot added the dependencies label Nov 9, 2026

github-actions Bot added the package: oxc-unshadowed-visitor label Nov 9, 2026

renovate Bot force-pushed the renovate/rolldown-related-dependencies branch 5 times, most recently from 01d147c to 4f7b2e4 Compare November 10, 2026 19:00

chore(deps): update rolldown-related dependencies

7088b59

renovate Bot force-pushed the renovate/rolldown-related-dependencies branch from 4f7b2e4 to 7088b59 Compare November 11, 2026 11:52

Navigation Menu

Repository navigation

chore(deps): update rolldown-related dependencies - #167

chore(deps): update rolldown-related dependencies#167
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/rolldown-related-dependencies

renovate Bot commented Nov 9, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Nov 9, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Nov 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

📚 Documentation

🐛 Bug Fixes

🚀 Features

🐛 Bug Fixes

🚜 Refactor

📚 Documentation

⚡ Performance

🧪 Testing

⚙️ Miscellaneous Tasks

❤️ New Contributors

💥 BREAKING CHANGES

🚀 Features

🐛 Bug Fixes

🚜 Refactor

📚 Documentation

⚡ Performance

🧪 Testing

⚙️ Miscellaneous Tasks

❤️ New Contributors

[1.2.19] - 2026-11-11

🐛 Bug Fixes

[1.2.18] - 2026-11-09

🐛 Bug Fixes

⚙️ Miscellaneous Tasks

Notes

Migration

Highlights

🚀 Features

Notes

Migration

🚀 Features

🐞 Bug Fixes

🏎 Performance

Bug Fixes

Miscellaneous Chores

Tests

Build System

Bug Fixes

Performance Improvements

Configuration

Uh oh!

socket-security Bot commented Nov 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Nov 9, 2026 •

edited

Loading

socket-security Bot commented Nov 9, 2026 •

edited

Loading