Skip to content

Comments

chore(deps): lock file maintenance npm packages#6632

Merged
shulaoda merged 2 commits intomainfrom
renovate/npm-packages
Oct 19, 2025
Merged

chore(deps): lock file maintenance npm packages#6632
shulaoda merged 2 commits intomainfrom
renovate/npm-packages

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Oct 19, 2025

This PR contains the following updates:

Package Type Update Change Age Adoption Passing Confidence
lockFileMaintenance All locks refreshed
@rollup/plugin-commonjs (source) pnpm.catalog.default patch 28.0.6 -> 28.0.8 age adoption passing confidence
@rollup/plugin-node-resolve (source) pnpm.catalog.default patch 16.0.2 -> 16.0.3 age adoption passing confidence
@types/node (source) pnpm.catalog.default minor 24.7.2 -> 24.8.1 age adoption passing confidence
@types/react-dom (source) pnpm.catalog.default patch 19.2.1 -> 19.2.2 age adoption passing confidence
esbuild pnpm.catalog.default patch 0.25.10 -> 0.25.11 age adoption passing confidence
rollup (source) pnpm.catalog.default patch 4.52.4 -> 4.52.5 age adoption passing confidence
vite (source) pnpm.catalog.default patch 7.1.9 -> 7.1.10 age adoption passing confidence
vitepress-plugin-group-icons pnpm.catalog.default patch 1.6.3 -> 1.6.4 age adoption passing confidence
zx (source) pnpm.catalog.default patch 8.8.4 -> 8.8.5 age adoption passing confidence
knip (source) devDependencies minor 5.64.3 -> 5.66.1 age adoption passing confidence
oxlint (source) devDependencies minor 1.22.0 -> 1.23.0 age adoption passing confidence
pnpm (source) packageManager patch 10.18.2 -> 10.18.3 age adoption passing confidence
vue-router (source) dependencies minor 4.5.1 -> 4.6.3 age adoption passing confidence

🔧 This Pull Request updates lock files to use the latest dependency versions.


Release Notes

rollup/plugins (@​rollup/plugin-commonjs)

v28.0.8

2025-10-16

Bugfixes
  • fix: guard moduleSideEffects for wrapped externals (#​1914)

v28.0.7

2025-10-14

Bugfixes
  • fix: avoid hoisting dynamically required node: builtins under strictRequires (#​1909)
rollup/plugins (@​rollup/plugin-node-resolve)

v16.0.3

2025-10-13

Bugfixes
  • fix: resolve bare targets of package "imports" using export maps; avoid fileURLToPath(null) (#​1908)
evanw/esbuild (esbuild)

v0.25.11

Compare Source

  • Add support for with { type: 'bytes' } imports (#​4292)

    The import bytes proposal has reached stage 2.7 in the TC39 process, which means that although it isn't quite recommended for implementation, it's generally approved and ready for validation. Furthermore it has already been implemented by Deno and Webpack. So with this release, esbuild will also add support for this. It behaves exactly the same as esbuild's existing binary loader. Here's an example:

    import data from './image.png' with { type: 'bytes' }
    const view = new DataView(data.buffer, 0, 24)
    const width = view.getInt32(16)
    const height = view.getInt32(20)
    console.log('size:', width + '\xD7' + height)
  • Lower CSS media query range syntax (#​3748, #​4293)

    With this release, esbuild will now transform CSS media query range syntax into equivalent syntax using min-/max- prefixes for older browsers. For example, the following CSS:

    @&#8203;media (640px <= width <= 960px) {
      main {
        display: flex;
      }
    }

    will be transformed like this with a target such as --target=chrome100 (or more specifically with --supported:media-range=false if desired):

    @&#8203;media (min-width: 640px) and (max-width: 960px) {
      main {
        display: flex;
      }
    }
rollup/rollup (rollup)

v4.52.5

Compare Source

2025-10-18

Bug Fixes
  • Always produce valid UUIDs as debugIds in sourcemaps (#​6144)
Pull Requests
vitejs/vite (vite)

v7.1.10

Compare Source

Bug Fixes
Documentation
Miscellaneous Chores
yuyinws/vitepress-plugin-group-icons (vitepress-plugin-group-icons)

v1.6.4

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
google/zx (zx)

v8.8.5: — Temporary Reservoir

Compare Source

This release fixes the issue, when zx flushes external node_modules on linking #​1348 #​1349 #​1355

Also [email protected] arrives here.

webpro-nl/knip (knip)

v5.66.1

Compare Source

v5.66.0

Compare Source

v5.65.0

Compare Source

oxc-project/oxc (oxlint)

v1.23.0: oxlint v1.23.0

Compare Source

[1.23.0] - 2025-10-13

🚀 Features
  • 452d128 linter: Node/no_process_env (#​14536) (Kenneth Skovhus)
  • a9e1261 linter: Implement react-refresh/only-export-components (#​14122) (Rintaro Itokawa)
  • a8d542b linter/no-duplicate-imports: Support allowSeparateTypeImports option (#​14527) (camc314)
  • 75a529c linter: Add run info about what functions rules implement (#​13839) (camchenry)
  • 4fbdef2 language_server: Support fmt.configPath configuration (#​14502) (Sysix)
  • 4d3ce2e language_server: Autodetect root .oxfmtrc.json (#​14466) (Sysix)
🐛 Bug Fixes
  • fb4a20d language_server: Add whitespace for // oxlint-disable-next-line fix (#​14356) (Sysix)
  • 6fce7f4 oxlint/changelog: Remove duplicate changelog entries (#​14528) (camc314)
  • 74e52f3 linter/plugins: Resolve JS plugins with ESM condition names (#​14541) (magic-akari)
  • 9965676 linter/exhaustive-deps: Ignore empty strings passed to additionalHooks option (#​14464) (Redas)
  • d0a8e3e linter: vue/no_required_prop_with_default called Option::unwrap() on a None value (#​14491) (Sysix)
  • 1192ea2 linter: Correct nextjs/no-typos path handling (#​14480) (shulaoda)
  • 2796b16 tsgolint: Pipe tsgolints stderr (#​14477) (camc314)
🚜 Refactor
  • 6440cde linter: Remove lifetime of Message (#​14481) (Sysix)
  • f599bef language_server: Move Message to DiagnosticReport transformation to one place (#​14447) (Sysix)
  • 4f301de napi/parser, linter/plugins: Improve formatting of generated code (#​14554) (overlookmotel)
  • 68c0252 napi/parser, linter/plugins: Shorten generated raw transfer deserializer code (#​14553) (overlookmotel)
  • 20e884e linter: Store LintService in LintRunner (#​14471) (Sysix)
  • 9e9c5ba linter: Simplify built-in lint plugin checks (#​14518) (camchenry)
  • 1986e0f linter/no-ex-assign: Use let-else chain (#​14526) (camc314)
  • ce9bcf0 linter/no-func-assign: Use let-else chain (#​14525) (camc314)
  • a9cea7c language_server: Use FxHashSet for ServerLinter::extended_paths (#​14517) (Sysix)
  • ea5838e linter/no-import-assign: Use let-else chain (#​14524) (camc314)
  • f977700 language_server: Pass LintOptions to Worker::refresh_server_linter (#​14510) (Sysix)
  • 54b001f linter/no-new-require: Improve diagnostic message clarity (#​14511) (shulaoda)
  • 650ea68 linter: Improve nextjs/no-typos rule (#​14476) (shulaoda)
📚 Documentation
  • 198f2e9 linter: Fix code example for branches-sharing-code (#​14514) (camc314)
  • d776a17 linter: Improve nextjs/no-typos rule documentation (#​14470) (shulaoda)
⚡ Performance
  • b44a30e language_server: Transform Message to DiagnosticReport with one call (#​14448) (Sysix)
  • 31766fd linter/plugins: Provide loc via prototype (#​14552) (overlookmotel)
  • aec0c08 linter: Allow analyzing node types in match blocks with guards (#​14459) (camchenry)
  • 9044187 linter: Skip running node-specific rule if file contains no relevant nodes (#​14457) (camchenry)
  • 422f54e linter: Only run rule run functions if implemented (#​14454) (camchenry)
  • 2c228ae liner: Use top-level match for no_obj_calls (#​14523) (camchenry)
  • c49d891 linter: Use match for no_negated_condition (#​14522) (camchenry)
  • e222fc2 linter: Use match for no_multi_assign (#​14521) (camchenry)
  • 4440516 linter: Refactor rules to take advantage of node type skipping (#​14519) (camchenry)
  • 78261d6 linter: Refactor no-invalid-fetch-options to be more easily analyzed (#​14458) (camchenry)
🧪 Testing
  • 8d8881d linter/plugins: Expand tests for module resolution of plugins (#​14559) (overlookmotel)
  • 33b6cde language_server: Add basic tests for WorkspaceWorker::did_change_configuration (#​14531) (Sysix)
  • bfe1ecd language_server: Add tests for WorkspaceWorker::init_watchers (#​14516) (Sysix)
💼 Other
pnpm/pnpm (pnpm)

v10.18.3

Compare Source

Patch Changes
  • Fix a bug where pnpm would infinitely recurse when using verifyDepsBeforeInstall: install and pre/post install scripts that called other pnpm scripts #​10060.
  • Fixed scoped registry keys (e.g., @scope:registry) being parsed as property paths in pnpm config get when --location=project is used #​9362.
  • Remove pnpm-specific CLI options before passing to npm publish to prevent "Unknown cli config" warnings #​9646.
  • Fixed EISDIR error when bin field points to a directory #​9441.
  • Preserve version and hasBin for variations packages #​10022.
  • Fixed pnpm config set --location=project incorrectly handling keys with slashes (auth tokens, registry settings) #​9884.
  • When both pnpm-workspace.yaml and .npmrc exist, pnpm config set --location=project now writes to pnpm-workspace.yaml (matching read priority) #​10072.
  • Prevent a table width error in pnpm outdated --long #​10040.
  • Sync bin links after injected dependencies are updated by build scripts. This ensures that binaries created during build processes are properly linked and accessible to consuming projects #​10057.
vuejs/router (vue-router)

v4.6.3

Compare Source

Please refer to CHANGELOG.md for details.

v4.6.2

Compare Source

Please refer to CHANGELOG.md for details.

v4.6.1

Compare Source

Please refer to CHANGELOG.md for details.

v4.6.0

Compare Source

Please refer to CHANGELOG.md for details.


Configuration

📅 Schedule: Branch creation - "before 9am on monday" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot enabled auto-merge (squash) October 19, 2025 17:39
@graphite-app
Copy link
Contributor

graphite-app bot commented Oct 19, 2025

How to use the Graphite Merge Queue

Add the label graphite: merge to this PR to add it to the merge queue.

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

@socket-security
Copy link

socket-security bot commented Oct 19, 2025

@netlify
Copy link

netlify bot commented Oct 19, 2025

Deploy Preview for rolldown-rs ready!

Name Link
🔨 Latest commit caf8baf
🔍 Latest deploy log https://app.netlify.com/projects/rolldown-rs/deploys/68f55cc011dd3b0008dd766a
😎 Deploy Preview https://deploy-preview-6632--rolldown-rs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@renovate renovate bot force-pushed the renovate/npm-packages branch from 56131e5 to 1de0750 Compare October 19, 2025 19:38
@shulaoda shulaoda disabled auto-merge October 19, 2025 19:38
@renovate renovate bot enabled auto-merge (squash) October 19, 2025 19:41
@renovate renovate bot force-pushed the renovate/npm-packages branch from 1de0750 to e492ca5 Compare October 19, 2025 19:41
@shulaoda shulaoda self-assigned this Oct 19, 2025
@shulaoda shulaoda disabled auto-merge October 19, 2025 21:02
@renovate renovate bot enabled auto-merge (squash) October 19, 2025 21:18
@renovate renovate bot force-pushed the renovate/npm-packages branch from e492ca5 to 0aaac33 Compare October 19, 2025 21:18
@shulaoda shulaoda disabled auto-merge October 19, 2025 21:20
@shulaoda shulaoda merged commit 9ea01e5 into main Oct 19, 2025
7 of 8 checks passed
@shulaoda shulaoda deleted the renovate/npm-packages branch October 19, 2025 21:48
shulaoda added a commit that referenced this pull request Oct 20, 2025
## [1.0.0-beta.44] - 2025-10-20

:boom: Breaking Changes
- Top-level `jsx` removed, use `transform.jsx` instead
- `output.minifyInternalExports` now enabled by default

:dart: Enhanced Tree-Shaking
- JSON default imports are now tree-shakeable
```js
// config.json
{
"apiUrl": "[https://api.example.com](https://api.example.com/)",
"timeout": 5000,
"retries": 3,
"debug": false
}

// main.js
// Before: Entire JSON was included in bundle
import config from './config.json';
console.log(config.apiUrl);

// After: Only the used property is included
// Bundle now contains just the apiUrl value
```
- Built-in typed array constructors (`new Uint8Array()`, `new Int32Array()`, etc.) marked as pure

:gear: Configuration Improvements
- Support `output.cleanDir` option
- Deprecated some top-level  options
  - `define` → `transform.define`
  - `inject` → `transform.inject`
  - `dropLabels` → `transform.dropLabels`
  - `keepNames` → `output.keepNames`
  - `profilerNames` → `output.generatedCode.profilerNames`

### 💥 BREAKING CHANGES

- enable `output.minifyInternalExports` for `format: 'es'` or `minify: true` (#6594) by @sapphi-red
- node/options: remove `InputOptions.jsx`, prefer `transform.jsx` always (#6548) by @hyf0

### 🚀 Features

- support jsx preset for `transform.jsx` (#6630) by @shulaoda
- rolldown_plugin_vite_html: align `inject_to_body` function (#6622) by @shulaoda
- rolldown_vite_css_post_plugin: tweak `is_legacy` field (#6620) by @shulaoda
- native-plugin: expose `viteHtmlPlugin` (#6609) by @shulaoda
- native-plugin: expose `viteCSSPostPlugin` (#6606) by @shulaoda
- builtin-plugin: expose `viteCSSPlugin` (#6605) by @shulaoda
- rolldown_plugin_vite_html: complete plugin binding (#6604) by @shulaoda
- rolldown_plugin_vite_css: support plugin binding (#6598) by @shulaoda
- add TypedArray constructors to side-effect free globals (#6592) by @IWANABETHATGUY
- rolldown_plugin_vite_html: align process src attr logic (#6572) by @shulaoda
- rolldown: support `output.clearDir` to clean up `dir` before build (#6486) by @aprosail
- dev: return `RolldownOutput` instead of `BindingOutputs` from `onOutput` (#6563) by @sapphi-red
- rolldown_plugin_vite_html: align process srcset logic (#6560) by @shulaoda
- rolldown_plugin_vite_html: align process src function (#6559) by @shulaoda
- rolldown_plugin_vite_html: align parse secset function (#6558) by @shulaoda
- node/options: deprecate `dropLabels` and add `transform.dropLabels` (#6557) by @hyf0
- node/options: deprecate `keepNames` and add `output.keepNames` (#6556) by @hyf0
- node/options: deprecate `profilerNames` and add `output.generatedCode.profilerNames` (#6555) by @hyf0
- node/options: deprecate top level `inject` and `define` and add `transform.define`, `transform.inject` (#6544) by @hyf0
- rolldown_plugin_vite_html: initialize attributes handle logic (#6543) by @shulaoda
- rolldown: oxc v0.95.0 (#6541) by @Boshen
- rolldown_plugin_vite_html: align inject css logic (#6528) by @shulaoda
- rolldown_plugin_vite_html: align modulepreload inject logic (#6526) by @shulaoda
- rolldown_plugin_vite_html: align css bundle output inject logic (#6524) by @shulaoda
- rolldown_plugin_vite_html: support inject_to_head function (#6522) by @shulaoda
- rolldown_plugin_vite_html: align emit and delete logic (#6521) by @shulaoda
- rolldown_vite_html: align handle html asset url logic (#6518) by @shulaoda
- add an example how to transform code and generate sourcemap with `experimental.nativeMagicString` (#6514) by @IWANABETHATGUY
- rolldown_plugin_vite_html: align handle inline css logic (#6517) by @shulaoda

### 🐛 Bug Fixes

- native-plugin: use correct config for assetPlugin (#6638) by @shulaoda
- no_color not being respected on reporter (#6615) by @H4ad
- improve tree shaking for JSON default imports (#6626) by @IWANABETHATGUY
- cjs treeshaking removes used code (#6597) by @IWANABETHATGUY
- plugin/vite-resolve: return `package_json_path` from resolveId hook (#6434) by @sapphi-red
- dev: `should have idx` error happens with `deferSyncScanData` + incremental rebuild (#6568) by @sapphi-red
- rolldown: sync scoping properly in pre_process_ecma_ast (#6537) by @Boshen
- process CJS tree shaking bailout modules before eliminating unused dynamic entries (#6549) by @IWANABETHATGUY
- rust/dev: error of `bundler.scan`doesn't get handled (#6547) by @Copilot
- inline only self referenced json module properties (#6519) by @IWANABETHATGUY
- avoid processing native MagicString sourcemap when `sourcemap` is disabled (#6510) by @IWANABETHATGUY

### 🚜 Refactor

- rolldown_binding: unify `BindingAssetInlineLimit` (#6625) by @shulaoda
- rolldown_binding: tweak `BindingAssetPluginConfig` (#6624) by @shulaoda
- tweak `viteCSSPlugin` config (#6610) by @shulaoda
- rust/dev: remove unnecessary bundler cache management of dev engine (#6576) by @hyf0
- rust/dev: refactor `TaskInput` into enum to reduce invalid states (#6575) by @hyf0
- improve the error message of `ScanStageCache#merge` (#6564) by @IWANABETHATGUY
- rust/dev: use `client_id` to check if module is executed for test environment (#6566) by @hyf0
- rust/binding: mark napi object that won't be received from js side (#6531) by @hyf0
- rust/binding: mark napi object struct that won't be passed to js explicitly (#6525) by @hyf0
- rust/binding: use `&str` or `JsString` to avoid unnecessary clone (#6523) by @hyf0
- rust/binding: use `&str` to avoid unnecessary clone (#6520) by @hyf0
- rust: replace unwrap with expect for better error handling in message sending (#6509) by @hyf0

### 📚 Documentation

- add redirect from `/guide/in-depth/` to `/in-depth/` (#6554) by @Copilot
- guide: polish notable features page (#6535) by @sapphi-red
- builtin-plugins: add replace plugin docs (#6534) by @sapphi-red
- add `Additional Thanks` in `acknowledgements` page (#6507) by @hyf0
- polish doc for `experimental.nativeMagicString` (#6504) by @IWANABETHATGUY

### ⚡ Performance

- cli: advance `createTokioRuntime` (#6618) by @hyf0
- rolldown: reduce unnecessary Vec allocate (#6601) by @Brooooooklyn
- rolldown: make derived assets generation more parallel (#6600) by @Brooooooklyn
- rolldown: make chunks generation more parallel (#6599) by @Brooooooklyn
- rolldown_utils: only allocate HASH_PLACEHOLDER_LEFT once (#6595) by @Brooooooklyn
- rolldown: use oxc-resolver with simd-json (#6591) by @Boshen
- rolldown: avoid allocate the sourcemap sources on non Windows os (#6590) by @Brooooooklyn
- resolver: use optimized fs.read_to_string impl (#6589) by @Brooooooklyn
- deps: upgrade json-escape-simd and add simdutf8 dependency (#6579) by @Brooooooklyn
- rust/dev: remove unncessary clone for `ClientInput` (#6565) by @hyf0
- visit ast in `cross_module_optimization` stage parallel (#6552) by @IWANABETHATGUY

### 🧪 Testing

- json module prop conflict with normal module declaration binding (#6540) by @IWANABETHATGUY
- vite-tests: fix rolldown overrides (#6532) by @sapphi-red

### ⚙️ Miscellaneous Tasks

- remove string conversion warning in `replacePlugin` to compatible with rollup (#6639) by @IWANABETHATGUY
- deps: update dependency dprint-json to v0.21.0 (#6637) by @renovate[bot]
- deps: lock file maintenance (#6635) by @renovate[bot]
- deps: lock file maintenance npm packages (#6632) by @renovate[bot]
- node: use built-in styleText (#6340) by @dumbmatter
- deps: update actions/setup-node action to v6 (#6629) by @renovate[bot]
- deps: update github-actions (#6628) by @renovate[bot]
- deps: update dependency dprint-markdown to v0.20.0 (#6627) by @renovate[bot]
- Switch color dependencies (ansis and picocolors) to built-in styleText (#6619) by @IWANABETHATGUY
- native-plugin: tweak assetPlugin (#6623) by @shulaoda
- remove deprecated warning in `build.ts` (#6621) by @IWANABETHATGUY
- deps: update dependency tsdown to v0.15.8 (#6617) by @renovate[bot]
- rolldown_binding: rename vite css plugin config field (#6611) by @shulaoda
- add colored deprecation warnings for top-level options (#6612) by @IWANABETHATGUY
- rust: make `cargo publish --workspace` work (#6287) by @Boshen
- deps: update dependency rolldown-plugin-dts to v0.16.12 (#6608) by @renovate[bot]
- test: add `opposite_minify_internal_exports` and remove `minify_internal_exports` extend test (#6596) by @hyf0
- test: render snapshot for build and dev independently (#6584) by @hyf0
- test: split test logic for normal build and dev engine (#6580) by @hyf0
- fix rolldown build self warning (#6578) by @IWANABETHATGUY
- tweak `BindingBuiltinPluginName` (#6574) by @shulaoda
- rust: use forked `notify` crate (#6573) by @Boshen
- add `.len()` and `.is_empty()` to `HybridIndexVec` (#6570) by @sapphi-red
- ai: improve `AGENT.md` with verified prompts (#6533) by @hyf0
- clippy: set `too-many-lines-threshold` to 200 (#6530) by @shulaoda
- clean up examples/basic-vue (#6515) by @IWANABETHATGUY
- deps: update dependency tsdown to v0.15.7 (#6512) by @renovate[bot]
- add shulaoda to release PR assignees (#6505) by @shulaoda

### ❤️ New Contributors

* @dumbmatter made their first contribution in [#6340](#6340)
* @H4ad made their first contribution in [#6615](#6615)
* @aprosail made their first contribution in [#6486](#6486)

Co-authored-by: shulaoda <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant