chore(deps): update rolldown-related dependencies by renovate[bot] · Pull Request #167 · rolldown/plugins

renovate · 2026-11-09T00:38:57Z

This PR contains the following updates:

Package	Change	Age	Confidence
@oxc-project/types (source)	`^0.156.0` → `^0.157.0`
oxc-parser (source)	`^0.156.0` → `^0.157.0`
rolldown (source)	`^1.2.16` → `^1.3.0`
tsdown (source)	`^0.23.4` → `^0.23.7`
vite (source)	`^8.3.5` → `^8.3.6`

Release Notes

oxc-project/oxc (oxc-parser)

`v0.157.0`

🐛 Bug Fixes

3421516 parser: Preserve default import names in reexports (#28442) (Boshen)
ed7df7d ast/estree: Include comments in TS Program span (#28326) (camc314)

rolldown/rolldown (rolldown)

`v1.3.0`

Compare Source

💥 BREAKING CHANGES

cli: reject --input together with positional entries like Rollup (#11445) by @IWANABETHATGUY

🚀 Features

perf-kit: measure the deployed site and replay it for local builds (#11215) by @IWANABETHATGUY
perf-kit: diagnose chunk loading before FCP and LCP (#11214) by @IWANABETHATGUY
import-attributes: keep import attributes away from plugins without the option (#11476) by @shulaoda
import-attributes: let a type import attribute beat moduleTypes in the asset and copy plugins (#11309) by @shulaoda
import-attributes: pass import attributes to the transform hook (#11308) by @shulaoda
import-attributes: pass import attributes to the load hook (#11307) by @shulaoda
import-attributes: accept import attributes in this.resolve and this.load (#11306) by @shulaoda
import-attributes: pass import attributes to the resolveId and resolveDynamicImport hooks (#11305) by @shulaoda
import-attributes: expose experimental.importAttributes and the module id helpers to JS (#11304) by @shulaoda
import-attributes: render the import attributes of externals from their module identity (#11303) by @shulaoda
import-attributes: make import attributes part of module identity (#11302) by @shulaoda
import-attributes: model import attributes and keep them on the import record (#11301) by @shulaoda
expose notify APIs (#11380) by @sapphi-red
devtools: list the hooks that did no work in the report (#11388) by @IWANABETHATGUY

🐛 Bug Fixes

respect NO_COLOR in error and warning diagnostics (#11499) by @shulaoda
rolldown_plugin_vite_import_glob: match negated ** globs from the walk root (#11495) by @shulaoda
lazy-barrel: report used lazy barrel uncertain bindings with a dedicated error (#11493) by @shulaoda
avoid following output directory symlinks with output.cleanDir (#11494) by @sapphi-red
rolldown_plugin_vite_dynamic_import_vars: handle CRLF line breaks in the static import prefix (#11492) by @shulaoda
rolldown_plugin_vite_build_import_analysis: ensure unique preload markers (#11157) by @sapphi-red
watch: match Rollup for BUNDLE_END output and multi-config watch options (#10348) by @Brooooooklyn
rolldown_plugin_vite_dynamic_import_vars: escape import specifier (#11483) by @sapphi-red
error: add id, plugin, and frame to native errors (#9979) by @raminjafary
treeshaking: run a CommonJS module that is reached only through export * (#11423) by @magurotuna
escape URL in sourceMappingURL (#11482) by @sapphi-red
rolldown_plugin_vite_import_glob: escape import names (#11486) by @sapphi-red
rolldown_plugin_esm_external_require: escape import specifiers (#11487) by @sapphi-red
tree-shaking: drop unused imports of side-effect-free externals in ESM output (#11470) by @hyfdev
lazy-barrel: treat bindings behind skipped lazy barrel records as unknown (#11448) by @shulaoda
rolldown_plugin_vite_react_refresh_wrapper: escape import specifier (#11485) by @sapphi-red
devtools: count only hook calls that ran in the report (#11468) by @IWANABETHATGUY
rust: harden bundle close lifecycle (#11371) by @Brooooooklyn
strict-execution-order: name shared CJS re-export bindings independently of load order (#11206) by @natew
dev/lazy: don't proxy plugin-resolved externals (#11295) by @cestercian
rolldown_plugin_vite_transform: report oxc transformer warnings as warnings (#11459) by @Dunqing
dev: report a lazy-compile failure as diagnostics, not a formatted string (#10490) by @tbvjaos510
binding: stop mishandling per-call data at the callable builtin plugin boundary (#10482) by @hyfdev
dev/lazy: resolve import() of a CommonJS module to its ESM view (#11020) by @h-a-n-a
dev/lazy: load a lazy route in one request and only as factories (#11000) by @h-a-n-a
error when one module id resolves as both external and non-external (#11421) by @IWANABETHATGUY
sourcemap: keep only traced sources and names in module sourcemaps (#11270) by @IWANABETHATGUY
give module namespace objects a null prototype and make them non-extensible (#11428) by @IWANABETHATGUY
watch: reset JS load promises before rebuilding (#11316) by @owjs3901
new-url: keep the query and fragment when rewriting new URL() (#11420) by @theRizwan
dev: don't panic when buildStart emits a chunk during a partial rebuild (#11322) by @RagedPanda
treeshaking: drop an unused top-level import() of a side-effect-free module that exports then (#11409) by @hyfdev
derive reference ids from stable seeds for deterministic builds (#10797) by @MarshallOfSound
rolldown_plugin_vite_import_glob: resolve aliased globs without blocking a runtime worker (#11385) by @shulaoda
preserve-modules: read the extension after sanitizeFileName like Rollup (#11413) by @IWANABETHATGUY
rolldown_plugin_vite_dynamic_import_vars: await the resolver instead of blocking a runtime worker (#11386) by @shulaoda
cli: preserve entry arguments after double dash (#11438) by @shuvroroy
treeshaking: invalidate constants when exports is reassigned (#11430) by @shuvroroy
plugin: queue onLog callbacks eagerly (#11374) by @Brooooooklyn
avoid inferring constants from compound CommonJS exports (#11429) by @shuvroroy
json: avoid shadowing JSON.parse with named exports (#11432) by @shuvroroy
watcher: prioritize queued input during debounce (#11369) by @Brooooooklyn
replace: preserve declarations after Unicode text (#11435) by @shuvroroy
treeshaking: don't drop side effects that follow an exports.x write in the same CommonJS statement (#11408) by @hyfdev
don't inline a CommonJS export that is assigned conditionally or also through module.exports (#11404) by @hyfdev
json: preserve proto as an own data property (#11367) by @shuvroroy
tree-shaking: preserve dynamic import exports read through callback arguments (#11366) by @shuvroroy
respect externalLiveBindings for star re-exports from externals in cjs (#11328) by @logaretm
preserve-modules: keep non-JS extensions in [name] (#11410) by @cestercian
treeshaking: don't tree-shake a statement that holds a CommonJS top-level return (#11402) by @hyfdev
don't export JSON keys that the finalizer inlines away from a shared chunk (#11396) by @IWANABETHATGUY
sourcemap: support toUrl without Buffer (#11370) by @Brooooooklyn
handle nullish thrown values in error summary (#11373) by @Brooooooklyn
don't inline a var that module-level code reads before its declaration (#11379) by @hyfdev
treat a repeated var declaration as a reassignment (#11378) by @hyfdev

🚜 Refactor

remove dead concatenated wrapped module code (#11453) by @Dunqing
align watch options for the util function to dev mode (#11474) by @sapphi-red
simplify splitting oxc diagnostics by severity (#11458) by @Dunqing
rolldown: run deferred drops on a dedicated thread instead of rayon (#11372) by @Brooooooklyn
align watch options for dev mode and build (#11446) by @sapphi-red

📚 Documentation

add build report and perf-kit in-depth pages (#11480) by @IWANABETHATGUY
rolldown_plugin_vite_import_glob: describe how import.meta.glob follows file changes (#10573) by @shulaoda
import-attributes: add an in-depth guide for import attributes (#11310) by @shulaoda
import-attributes: correct comments and docs about import attributes (#11477) by @shulaoda
rolldown: explain why drops are deferred and why drain waits for every bundler's drops (#11455) by @hyfdev

⚡ Performance

rolldown_plugin_vite_dynamic_import_vars: avoid string allocation for first_quasi (#11484) by @sapphi-red
node: read each rendered chunk's binding fields once (#11364) by @mattlewis92

🧪 Testing

import-attributes: run the esbuild import attributes tests with the option on (#11472) by @shulaoda
import-attributes: port the Rollup 5 import attributes tests (#11381) by @shulaoda
rolldown_plugin_vite_import_glob: cover the glob matcher (#10572) by @shulaoda
rolldown_plugin_vite_import_glob: cover import.meta.glob file creation and deletion (#10551) by @shulaoda

⚙️ Miscellaneous Tasks

ai: harden rolldown REPL decode skill (#11491) by @sapphi-red
deps: update rust crate testing_macros to v2 (#11439) by @renovate[bot]
deps: update dependency @napi-rs/cli to v3.10.12 (#11463) by @renovate[bot]
deps: update dependency vite-plus to v1.5.0 (#11475) by @renovate[bot]
deps: update dependency glob to v14 [security] (#11462) by @renovate[bot]
deps: upgrade oxc to 0.157.0 (#11460) by @camc314
deps: update dependency @napi-rs/cli to v3.10.11 (#11461) by @renovate[bot]
deps: update dependency @napi-rs/cli to v3.10.10 (#11454) by @renovate[bot]
deps: update rollup submodule for tests to v4.67.4 (#11451) by @rolldown-guard[bot]
deps: update test262 submodule for tests (#11452) by @rolldown-guard[bot]
deps: update dependency rolldown-plugin-dts to ^0.29.0 (#11427) by @renovate[bot]
deps: update rust crates (#11426) by @renovate[bot]
deps: update npm packages (#11425) by @renovate[bot]
deps: update rust crate napi to v3.16.1 (#11401) by @renovate[bot]
release @rolldown/perf-kit independently (#11394) by @shulaoda
deps: update napi to v3.16.0 (#11389) by @renovate[bot]
drop outdated CLAUDE.md symlink note from AGENTS.md (#11384) by @iiio2

❤️ New Contributors

@raminjafary made their first contribution in #9979
@natew made their first contribution in #11206
@cestercian made their first contribution in #11295
@owjs3901 made their first contribution in #11316
@theRizwan made their first contribution in #11420
@RagedPanda made their first contribution in #11322

rolldown/tsdown (tsdown)

`v0.23.7`

Compare Source

[!NOTE]
v0.23.6 was skipped on purpose: its release failed, so this release follows v0.23.5 directly.

Notes

rolldown-plugin-dts is now v0.30. Full details are in the rolldown-plugin-dts v0.30.0 release notes.

Migration

dts.entry only filters entries. Only entries that match get declaration files. A matching file that is not an entry no longer gets its own declaration file. To emit declarations for such a file, add it to entry. The filter now applies to .d.cts as well as .d.mts.

dts.entry is resolved from cwd. Patterns are relative to tsdown's cwd, the same as the top-level entry, instead of process.cwd(). This only matters when the two differ, e.g. in workspace builds. Set dts.cwd to override it.

dts.emitDtsOnly and dts.dtsInput are deprecated. Use dts.dtsOnly instead. The old names still work but log a warning.

Highlights

dts: An entry's file-level doc comment is kept in its declaration file.
dts: Declaration files no longer contain a dangling sourceMappingURL.
dts: CJS declaration builds no longer emit a throwaway JS chunk. With the tsc generator, they build one program for all entries.
tsgo (experimental): Diagnostics show code context in color terminals, and packages from project references and files outside the tsconfig directory now get declarations.
Agent skill: The npm package now ships a small tsdown skill. pnpm 12.11+ can link it into agent skill directories, and it points agents to the full skill on GitHub for the installed version.

🚀 Features

Ship a skill facade in the npm package - by @sxzzbot in #1122 (6ad05)
dts: Upgrade rolldown-plugin-dts to v0.30 - by @sxzzbot in #1123 (d351b)

View changes on GitHub

`v0.23.5`

Compare Source

Notes

rolldown-plugin-dts is now v0.29. tsdown passes dts options through to it unchanged, so its deprecations show up in your config too. Full details are in the rolldown-plugin-dts v0.29.0 release notes.

Migration

tsc-only dts options move under dts.tsc. The top-level build, incremental, parallel, eager, newContext and vue options still work but log a deprecation warning. Setting the same option at both levels throws an error. emitJs stays at the top level.

 export default defineConfig({
   dts: {
-    vue: true,
+    tsc: { vue: true },
   },
 })

tsgo (experimental, not covered by semver):

@typescript/native-preview is no longer supported. Install TypeScript 7.1+ (typescript@7.1.0-beta), or point tsgo.moduleUrl at another build.
On TypeScript 7.1+, tsgo.path is the API server executable, not the tsgo CLI. You usually don't need to set it.
Declaration maps come only from compilerOptions.declarationMap: true in tsconfig; the sourcemap option no longer enables them.
TypeScript 7.0 still works with a deprecation warning, but that backend will be removed soon.

🚀 Features

css: Support css: false to disable built-in CSS handling - by @sxzzbot in #1113 (181af)
dts: Upgrade rolldown-plugin-dts to v0.29, upgrade deps - by @sxzzbot in #1121 (e12ab)

🐞 Bug Fixes

css: Remove dangling requires and handle CSS extensions in chunk names - by @sxzzbot in #1114 (c8ca3)

🏎 Performance

deps: Read each package.json once when resolving dep subpaths - by @Cherry and @sxzzbot in #1093 (4435a)

View changes on GitHub

vitejs/vite (vite)

`v8.3.6`

Compare Source

Bug Fixes

await overlapping plugin container close calls (#23935) (175bbeb)
build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
deps: update all non-major dependencies (#23896) (46b91c5)
deps: update all non-major dependencies (#23966) (b3cb057)
deps: update rolldown-related dependencies (#23868) (a63eb87)
deps: update rolldown-related dependencies (#23967) (0105733)
dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)
html: remove adjacent module tags on the first line (#23823) (eab1dc2)
ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)
optimizer: detect cache dir precisely (#23912) (cc9bc21)
optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)
respect build.sourcemap from environment (#23879) (82e7aa0)
server: escape HTML attributes (#23995) (a270391)
server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)
ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)
use top-level input for SSR build when build.ssr: true (#23898) (90bc034)
wasm: reject .wasm outside server.fs (#23914) (64e2467)
watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)
worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

build: remove preload link listeners on settle (fix #23920) (#23922) (8109efd)
css: index rendered modules once per output for cssScopeTo (#23889) (1b905e5)

Miscellaneous Chores

align charset case (#23863) (a976df3)

Build System

generate sourcemaps in import-meta-current-dirname plugin (#23904) (20d355a)

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

socket-security · 2026-11-09T00:39:15Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@oxc-project/types@0.157.0
rolldown@1.3.0
vite@8.3.5 ⏵ 8.3.6			⁺¹
tsdown@0.23.4 ⏵ 0.23.7	⁺¹	⁺¹	⁺¹
oxc-parser@0.156.0 ⏵ 0.157.0

View full report

renovate Bot added the dependencies label Nov 9, 2026

github-actions Bot added the package: oxc-unshadowed-visitor label Nov 9, 2026

renovate Bot force-pushed the renovate/rolldown-related-dependencies branch 2 times, most recently from ab6c0dc to 8788c94 Compare November 9, 2026 02:12

chore(deps): update rolldown-related dependencies

8af717c

renovate Bot force-pushed the renovate/rolldown-related-dependencies branch from 8788c94 to 8af717c Compare November 9, 2026 04:42

Navigation Menu

Repository navigation

chore(deps): update rolldown-related dependencies - #167

chore(deps): update rolldown-related dependencies#167
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/rolldown-related-dependencies

renovate Bot commented Nov 9, 2026

Uh oh!

socket-security Bot commented Nov 9, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Nov 9, 2026

Release Notes

v0.157.0

🐛 Bug Fixes

v1.3.0

💥 BREAKING CHANGES

🚀 Features

🐛 Bug Fixes

🚜 Refactor

📚 Documentation

⚡ Performance

🧪 Testing

⚙️ Miscellaneous Tasks

❤️ New Contributors

v0.23.7

Notes

Migration

Highlights

🚀 Features

View changes on GitHub

v0.23.5

Notes

Migration

🚀 Features

🐞 Bug Fixes

🏎 Performance

View changes on GitHub

v8.3.6

Bug Fixes

Performance Improvements

Miscellaneous Chores

Build System

Configuration

Uh oh!

socket-security Bot commented Nov 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v0.157.0`

`v1.3.0`

`v0.23.7`

`v0.23.5`

`v8.3.6`

socket-security Bot commented Nov 9, 2026 •

edited

Loading