chore(deps): update npm packages by renovate[bot] · Pull Request #10142 · rolldown/rolldown

renovate · 2026-07-05T16:48:03Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@oxlint/plugins (source)	`1.71.0` → `1.72.0`
fs-extra	`11.3.5` → `11.3.6`
knip (source)	`6.20.0` → `6.24.0`
tsx (source)	`4.22.4` → `4.22.5`
valibot (source)	`1.4.1` → `1.4.2`
vite (source)	`8.1.0` → `8.1.3`
void (source)	`^0.9.2` → `^0.10.0`
web-tree-sitter (source)	`0.26.9` → `0.26.10`

Release Notes

jprichardson/node-fs-extra (fs-extra)

`v11.3.6`

Compare Source

Fix handling of symlinked destination ancestors in copy/move methods (#1071, #1073)
Docs typo fixed (#1074)

webpro-nl/knip (knip)

`v6.24.0`: Release 6.24.0

Compare Source

chore: update year in license (#1833) (32bc844) - thanks @trueberryless!
ci: pin github actions (#1835) (82a8d09) - thanks @trueberryless!
Assume Node 24+/Bun and remove compilation step (d9ef038)
Don't report working-directory scripts as unlisted binaries (resolve #1834) (aea7923)
Add pnpm run lint to CI workflow (ec9aa1c)
feat: add settings for Zed editor to use oxlint and oxfmt (#1836) (111f2e0) - thanks @trueberryless!
fix: remove format_on_save: true settings from Zed settings to respect user settings (#1838) (dc2a640) - thanks @trueberryless!
feat: add Renovate for GitHub actions only (#1839) (ffce88c) - thanks @trueberryless!
Ignore import() in JSDoc examples (#1844) (6f090f9) - thanks @cyphercodes!
Don't report types used only in module augmentations as unused (resolve #1843) (7901abd)
Restore CI intent (0d739be)
feat: add less, stylus compilers and astro, svelte, vue import resolution (#1845) (5525759) - thanks @trueberryless!
Don't report built-in compiler dependencies as unused (3c9d4ad)
feat: add scss handling to stencil plugin (#1846) (acba6b8) - thanks @johnjenkins!
fix(reporters): always print the issue-type title for a single group (#1848) (cf997b2) - thanks @morgan-coded!
Export Issue, IssueRecords and IssueType types (resolve #1840) (260f192)
Squeeze every bit of perf out around compilers (bb0eeb6)

`v6.23.0`: Release 6.23.0

Compare Source

feat: add customCss to Starlight plugin (#1828) (f85d96f) - thanks @trueberryless!
fix: enable vite and vitest plugins when vite-plus is found (#1830) (62e9753) - thanks @ghostdevv!
feat: add support for @astrojs/markdoc (#1829) (94e2863) - thanks @trueberryless!
Support nub (resolve #1831) (8a6050e)
Don't report optimizeDeps and dedupe deps as unlisted (resolve #1832) (849b5ac)

`v6.22.0`: Release 6.22.0

Compare Source

Support XO v1+ (#1819) (1dffe36) - thanks @patrik-csak!
feat: detect execaNode scripts in execa visitor (#1824) (5095ae1) - thanks @gwagjiug!
Skip optional peerDeps referenced only via a host (resolve #1823) (7759a98)
docs: update npmjs.com links to npmx.dev (#1826) (11fe8bd) - thanks @serhalp!
docs: fix semi-broken link to DEVELOPMENT.md in CONTRIBUTING.md (#1827) (a5302b2) - thanks @serhalp!
feat: add support for Lunaria (#1825) (3e1b821) - thanks @trueberryless!
Fix lint issues (76c92e2)

`v6.21.0`: Release 6.21.0

Compare Source

Detect Vite config dependencies (resolve #1721) (8754c43)
fix: Update timerifyMethods to include resolveFromAST (#1814) (3c8deac) - thanks @gwagjiug!
Fix crash on null root export in package.json (resolve #1815) (9b8af2b)
Fix unresolved subpath imports with a colon prefix (resolve #1816) (f89db41)
Detect Next.js entry files in subdirectory (resolve #1817) (f32c6ea)

privatenumber/tsx (tsx)

`v4.22.5`

Compare Source

Bug Fixes

isolate hook state per async module.register() registration (a305f36)

This release is also available on:

npm package (@latest dist-tag)

open-circle/valibot (valibot)

`v1.4.2`

Compare Source

Many thanks to @Faze-up and @chatman-media for contributing to this release.

Fix word count actions to cache the Intl.Segmenter for non-primitive locales, preventing it from being recreated on every words, minWords, maxWords and notWords validation (pull request #1521)
Fix flatten method to handle issue path keys that collide with Object.prototype members like toString instead of throwing a TypeError (pull request #1522)
Fix intersect schema to merge object keys that collide with Object.prototype members like toString instead of failing to merge them (pull request #1522)

vitejs/vite (vite)

`v8.1.3`

Compare Source

Bug Fixes

css: inject inlined CSS after the shebang line (#22717) (1534d36)
deps: bump es-module-lexer to 2.3.0 (#22838) (7103c3a)
preload css for nested dynamic imports (#22759) (2c53054)
ssr: correct stacktrace column position for first line (#22828) (c4acd69)

`v8.1.2`

Compare Source

Bug Fixes

deps: revert es-module-lexer to 2.1.0 (#22827) (0d3bd7c)
restore, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#22757)" (#22825) (efb98cc)
revert, "fix: escape ids with multiple null bytes (#22687)" (cccef55)
revert, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#22757)" (cf97711)

`v8.1.1`

Compare Source

Features

update dynamic import warning to link to Vite docs (#22823) (62bd7af)

Bug Fixes

bundled-dev: avoid stack overflow on import.meta.hot.invalidate() (#22797) (709eb8e)
bundled-dev: serve assets emitted during HMR/lazy compile (#22745) (5876b2c)
bundledDev: skip plugin transform hooks for rolldown-lazy stub modules (#22778) (8f925e2)
css: preserve dollar signs in external @import urls with lightningcss (#22718) (9fa7ab4)
css: resolve tsconfig paths in CSS and Sass @import (#22775) (ef0b891)
deps: update all non-major dependencies (#22734) (e635f49)
deps: update all non-major dependencies (#22804) (8837400)
deps: update rolldown-related dependencies (#22591) (2ce6677)
escape ids with multiple null bytes (#22687) (833fc30)
hide console window when running 'net use' on Windows (#22698) (92b63f2)
ignore bundled config temp dir (#22800) (043a810)
invert esbuild.jsxSideEffects when converting to oxc.jsx.pure (#22809) (33895ba)
optimize-deps: ignore ERR_CLOSED_SERVER in scanner (#22784) (085a0ab)
optimizer: scanner should resolve input from root (#22769) (9722b07)
resolve pnpm .modules.yaml from workspace root instead of cwd (#22757) (2531ac7)
return sourcemap field from some plugins that were lacking (#22782) (7e18bf8)
server: handle malformed URI in indexHtmlMiddleware (#22781) (84f5ccc)

Miscellaneous Chores

improve dependency optimizer messages (#22549) (092cb3b)

Code Refactoring

css: remove lightningcss null byte bug workaround (#22822) (2dafd3b)
use pre-defined environments variable to avoid duplicate Object.values calls (#22790) (1113acf)

Tests

enable "manual chunk path" test and remove "worker.format error" test (#22824) (c088511)

tree-sitter/tree-sitter (web-tree-sitter)

`v0.26.10`

Compare Source

What's Changed

fix(lib): update doc comment for ts_parser_parse by @WillLillis in #5642
fix(lib): use correct TREE_SITTER_HIDE_SYMBOLS macro name in alloc.h by @tree-sitter-ci-bot[bot] in #5643
fix(cli): improve soundness of cst range calculation by @WillLillis in #5650
fix(lib): Consider subtree lookahead bytes when determining whether the parser can reuse a node. by @tree-sitter-ci-bot[bot] in #5656
fix(cli): display warning to user if parser test corpus dir isn't found by @tree-sitter-ci-bot[bot] in #5669
fix: add DESCRIPTION to grammar Makefile template by @WillLillis in #5672
fix(cli): infinite loop in highlight test by @WillLillis in #5674
fix(lib): address strict aliasing violations in TreeCursor type by @WillLillis in #5693
build(deps): bump wasmtime-c-api to v36.0.12 by @clason in #5709
fix(dsl): forbid invalid field names by @WillLillis in #5710
Fix issues with queries matching a parent node with anchored children (siblings) by @tree-sitter-ci-bot[bot] in #5712
test(query): regression test for anchored siblings inside a parent by @tree-sitter-ci-bot[bot] in #5716
release v0.26.10 by @WillLillis in #5717

Full Changelog: tree-sitter/tree-sitter@v0.26.9...v0.26.10

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

Branch creation
- "before 10am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

socket-security · 2026-07-05T16:48:48Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/tsx@4.23.0
	npm/esbuild@0.28.1
	npm/void@0.10.4
	npm/@oxlint/plugins@1.72.0
	npm/fs-extra@11.3.6
	npm/valibot@1.4.2
	npm/knip@6.24.0
	npm/web-tree-sitter@0.26.10

View full report

socket-security · 2026-07-05T16:48:50Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Potentially malicious package (AI signal): npm `void` is 88.0% likely malicious Notes: High-risk design. The module includes an explicit remote code execution mechanism (user-controlled AsyncFunction evaluation) that runs with access to an authenticated platform SDK. This enables capability abuse and potential sensitive data exposure or remote administrative changes, and it can also write local project configuration via sdk.link. Without strong external isolation/authorization and strict constraints on who can call the 'query' tool, this is effectively backdoor-level behavior for any attacker who can reach the service. Confidence: 0.88 Severity: 0.98 From: docs/package.json → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is AI-detected potential malware? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Given the AI system's identification of this package as malware, extreme caution is advised. It is recommended to avoid downloading or installing this package until the threat is confirmed or flagged as a false positive. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

netlify · 2026-07-05T16:49:33Z

✅ Deploy Preview for rolldown-rs canceled.

Name	Link
🔨 Latest commit	`b3088da`
🔍 Latest deploy log	https://app.netlify.com/projects/rolldown-rs/deploys/6a4b07dc60d99b00088c8d85

renovate · 2026-07-06T01:40:46Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@V1OL3TF0X

## [1.1.5] - 2026-07-08 ### 🚀 Features - detect top-level import-binding reads as execution-order sensitive (#10180) by @hyf0 - sourcemap_filenames: add a sourcemapFileNames option (#9271) by @V1OL3TF0X - binding: record plugin hook result kind in tracing spans (#10154) by @IWANABETHATGUY - linking: skip side-effect-free modules in per-entry reachability (#10111) by @IWANABETHATGUY - improve error message for unresolved virtual imports (#10156) by @sapphi-red - add descriptive metadata to plugin API (#10106) by @sapphi-red - add `--configLoader=native` option (#10118) by @sapphi-red ### 🐛 Bug Fixes - improve invalid annotation warnings (#10185) by @hyf0 - keep deduplicated asset filenames stable once they can be observed (#10191) by @shulaoda - sourcemap_filenames: use public option name in pattern errors (#10188) by @IWANABETHATGUY - sourcemap_filenames: hash prepared sourcemap content (#10178) by @hyf0 - tree-shake unused circular declarators exported via export list (#10166) by @IWANABETHATGUY - dev: don't panic when an HMR rebuild hits an unresolved import (#10162) by @shulaoda - propagate errors from output.globals function (#9880) by @shulaoda - dev: revert cache mutations when a partial scan fails (#10110) by @shulaoda - dev: update importer relationships of cached modules in incremental build (#10107) by @shulaoda - hmr: fall back to full reload when a changed module is not registered as executed (#10132) by @shulaoda - chunk-optimizer: follow entry facade edges in runtime placement cycle check (#10101) by @hyf0 - dev: ignore watcher events after close (#10113) by @hyf0 - emit async wrapper for TLA modules under onDemandWrapping (#10086) by @IWANABETHATGUY - gate sideEffects:false modules' side effects on body demand (#10080) by @IWANABETHATGUY - rolldown_plugin_vite_resolve: return empty object for `browser: false` mapped modules (#10082) by @sapphi-red - reset the word-boundary state on newline in Hires::Boundary sourcemaps (#10025) by @shulaoda - trim an emptied chunk's outro/intro instead of skipping past it (#10029) by @shulaoda - test each edited chunk's own start against indent exclude ranges (#10026) by @shulaoda - preserve sourcemap mappings for indented lines when a CJS module shares the chunk (#10074) by @hyf0 ### 🚜 Refactor - separate tree-shaking side effects from execution order sensitivity (#10168) by @hyf0 - type construct_vite_preload_call to take an ObjectPattern (#10135) by @shulaoda - treeshake: single-source the own-export classification shared with the lazy-barrel loader (#10098) by @IWANABETHATGUY - dev: reuse Vite's bundledDev server (#10081) by @h-a-n-a - clippy: ban std HashMap/HashSet in favour of FxHashMap/FxHashSet (#10108) by @Boshen - treeshake: make body demand a second module bit instead of a stmt multimap (#10097) by @IWANABETHATGUY - seal used_symbol_refs by construction after its last writer (#10091) by @hyf0 - treeshake: replace inclusion mutual recursion with a worklist engine (#10096) by @IWANABETHATGUY - treeshake: split include_statements.rs into focused modules (#10095) by @IWANABETHATGUY - drop redundant is_user_defined filter on partitioned entries (#10050) by @shulaoda - project the retained export interface out of used_symbol_refs (#10089) by @hyf0 - track used external symbols separately from used_symbol_refs (#10088) by @hyf0 - make module namespace inclusion an explicit linking metadata field (#10087) by @hyf0 - rename statement evaluation metadata (#10078) by @hyf0 ### 📚 Documentation - virtual modules user-facing id convention (#10155) by @sapphi-red - cli: clarify disabling boolean/object flags like codeSplitting (#10153) by @IWANABETHATGUY - chore: remove Vite+ alpha banner (#10105) by @mdong1909 - write down the used_symbol_refs contract (#10090) by @hyf0 - dev/lazy: update design and implementation (#10079) by @h-a-n-a ### ⚡ Performance - ast_scanner: stop order-sensitivity checks once a module is flagged (#10190) by @IWANABETHATGUY - return impl ExactSizeIterator from slice-backed accessors (#10133) by @Boshen - binding: box dev and watcher napi futures (#10103) by @Boshen ### 🧪 Testing - move string_wizard replace unit tests to the JS magic-string suite (#10176) by @IWANABETHATGUY - dev: assert incremental scan state matches a fresh full build after each HMR step (#10115) by @shulaoda - dev: restore runtime assertions of delete_file_not_used_anymore (#10112) by @shulaoda - dev: fix flaky dev server tests in CI (#10152) by @h-a-n-a - add regression test for #10099 (lazyBarrel drops default-import binding but keeps its property reads) (#10109) by @IWANABETHATGUY ### ⚙️ Miscellaneous Tasks - deploy website to Void via GitHub OIDC (#10192) by @Boshen - deps: update oxc to 0.139.0 (#10161) by @shulaoda - deps: update test262 submodule for tests (#10160) by @rolldown-guard[bot] - rolldown_plugin_utils: remove dead asset-url and css scaffolding (#10131) by @shulaoda - deps: revert vite-plus to v0.2.1 (#10148) by @shulaoda - deps: update github actions (#10141) by @renovate[bot] - deps: update dependency rust to v1.96.1 (#10145) by @renovate[bot] - deps: update npm packages (#10142) by @renovate[bot] - deps: update rust crates (#10143) by @renovate[bot] - deps: update napi to v3.10.3 (#10121) by @renovate[bot] - rolldown_utils: remove unused time module (#10138) by @shulaoda - remove dead CopyModulePlugin::is_active method (#10129) by @shulaoda - remove dead LazyCompilationContext::is_lazy_module method (#10128) by @shulaoda - remove dead BuildDiagnostic::downcast_ref method (#10127) by @shulaoda - deps: update dependency vite-plus to v0.2.2 (#10084) by @renovate[bot] - deps: update rust crate oxc_sourcemap to v8.1.0 (#10122) by @renovate[bot] - deps: update crate-ci/typos action to v1.48.0 (#10124) by @renovate[bot] - enable more clippy restriction lints (#10114) by @Boshen - deps: update rust dependencies (#10100) by @Boshen - deps: update oxc resolver to v11.23.0 (#10083) by @renovate[bot] ### ◀️ Revert - Revert "chore(deps): revert vite-plus to v0.2.1" (#10157) by @h-a-n-a - "fix(hmr): fall back to full reload when a changed module is not registered as executed (#10132)" (#10151) by @shulaoda ### ❤️ New Contributors * @V1OL3TF0X made their first contribution in [#9271](#9271) Co-authored-by: shulaoda <[email protected]>

chore(deps): update npm packages

b0eeb94

u

aac2109

Merge branch 'main' into renovate/npm-packages

b3088da

shulaoda merged commit 045bc8f into main Jul 6, 2026
52 of 54 checks passed

shulaoda deleted the renovate/npm-packages branch July 6, 2026 01:54

rolldown-guard Bot mentioned this pull request Jul 8, 2026

release: v1.1.5 #10194

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update npm packages#10142

chore(deps): update npm packages#10142
shulaoda merged 3 commits into
mainfrom
renovate/npm-packages

renovate Bot commented Jul 5, 2026

Uh oh!

socket-security Bot commented Jul 5, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 5, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Jul 5, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Jul 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

renovate Bot commented Jul 5, 2026

Release Notes

v11.3.6

v6.24.0: Release 6.24.0

v6.23.0: Release 6.23.0

v6.22.0: Release 6.22.0

v6.21.0: Release 6.21.0

v4.22.5

Bug Fixes

v1.4.2

v8.1.3

Bug Fixes

v8.1.2

Bug Fixes

v8.1.1

Features

Bug Fixes

Miscellaneous Chores

Code Refactoring

Tests

v0.26.10

What's Changed

Configuration

Uh oh!

socket-security Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for rolldown-rs canceled.

Uh oh!

renovate Bot commented Jul 6, 2026

Edited/Blocked Notification

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`v11.3.6`

`v6.24.0`: Release 6.24.0

`v6.23.0`: Release 6.23.0

`v6.22.0`: Release 6.22.0

`v6.21.0`: Release 6.21.0

`v4.22.5`

`v1.4.2`

`v8.1.3`

`v8.1.2`

`v8.1.1`

`v0.26.10`

socket-security Bot commented Jul 5, 2026 •

edited

Loading

socket-security Bot commented Jul 5, 2026 •

edited

Loading

netlify Bot commented Jul 5, 2026 •

edited

Loading