chore(deps): update npm packages by renovate[bot] · Pull Request #8948 · rolldown/rolldown

renovate · 2026-03-29T16:43:13Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@oxlint/plugins (source)	`1.56.0` → `1.57.0`
diff	`8.0.3` → `8.0.4`
rollup (source)	`4.59.0` → `4.60.0`
typedoc (source)	`0.28.17` → `0.28.18`
vite (source)	`8.0.1` → `8.0.3`
vitepress-plugin-group-icons	`1.7.1` → `1.7.3`
vitepress-plugin-llms	`1.11.1` → `1.12.0`
vitest (source)	`4.1.0` → `4.1.2`
vue (source)	`3.5.30` → `3.5.31`

Release Notes

kpdecker/jsdiff (diff)

`v8.0.4`

Compare Source

#667 - fix another bug in diffWords when used with an Intl.Segmenter. If the text to be diffed included a combining mark after a whitespace character (i.e. roughly speaking, an accented space), diffWords would previously crash. Now this case is handled correctly.

rollup/rollup (rollup)

`v4.60.0`

Compare Source

2026-03-22

Features

Support source phase imports as long as they are external (#6279)

Pull Requests

#6279: feat: external only Source Phase imports support (@guybedford, @lukastaegert)

`v4.59.1`

Compare Source

2026-03-21

Bug Fixes

Fix a crash when using lazy dynamic imports with moduleSideEffects:false (#6306)

Pull Requests

#6281: fix(deps): update minor/patch updates (@renovate[bot], @lukastaegert)
#6282: chore(deps): update github artifact actions (major) (@renovate[bot], @lukastaegert)
#6283: chore(deps): update dependency nyc to v18 (@renovate[bot], @lukastaegert)
#6284: fix(deps): update swc monorepo (major) (@renovate[bot])
#6285: chore(deps): lock file maintenance (@renovate[bot])
#6290: chore(deps): update minor/patch updates (@renovate[bot], @lukastaegert)
#6291: chore(deps): update dependency @shikijs/vitepress-twoslash to v4 (@renovate[bot])
#6292: chore(deps): lock file maintenance (@renovate[bot])
#6297: chore(deps): update minor/patch updates (@renovate[bot])
#6298: chore(deps): lock file maintenance (@renovate[bot])
#6299: chore(deps): lock file maintenance (@renovate[bot])
#6300: docs: update packagephobia link (@bluwy)
#6301: chore(deps): update dependency lint-staged to ^16.3.3 (@renovate[bot])
#6306: fix: fix chunk assignment for deoptimized module with dynamic import (@JoaoBrlt, @lukastaegert)
#6307: chore(deps): update minor/patch updates (@renovate[bot])
#6308: chore(deps): update dependency lru-cache to v11 (@renovate[bot])
#6309: chore(deps): update dependency vite to v8 (@renovate[bot])
#6310: chore(deps): lock file maintenance (@renovate[bot])
#6311: chore(deps): lock file maintenance (@renovate[bot])
#6312: chore(deps): lock file maintenance (@renovate[bot])

TypeStrong/TypeDoc (typedoc)

`v0.28.18`

Compare Source

Features

Support TypeScript 6.0, #3084.

vitejs/vite (vite)

`v8.0.3`

Compare Source

Features

update rolldown to 1.0.0-rc.12 (#22024) (84164ef)

Bug Fixes

html: cache unfiltered CSS list to prevent missing styles across entries (#22017) (5464190)
module-runner: handle non-ascii characters in base64 sourcemaps (#21985) (77c95bf)
module-runner: skip re-import if the runner is closed (#22020) (ee2c2cd)
optimizer: scan is not resolving sub path import if used in a glob import (#22018) (ddfe20d)
ssr: ssrTransform incorrectly rewrites meta identifier inside import.meta when a binding named meta exists (#22019) (cff5f0c)

Miscellaneous Chores

deps: bump picomatch from 4.0.3 to 4.0.4 (#22027) (7e56003)

Tests

html: add tests for getCssFilesForChunk (#22016) (43fbbf9)

`v8.0.2`

Compare Source

Features

update rolldown to 1.0.0-rc.11 (#21998) (ff91c31)

Bug Fixes

deps: update all non-major dependencies (#21988) (9b7d150)

Miscellaneous Chores

deps: update dependency @vitejs/devtools to ^0.1.5 (#21992) (b2dd65b)

yuyinws/vitepress-plugin-group-icons (vitepress-plugin-group-icons)

`v1.7.3`

Compare Source

🚀 Features

Migrate to vite-plus - by @yuyinws in #35 (ed34c)

🐞 Bug Fixes

types: Don't bundle markdown-it types - by @brc-dd in #36 (513e7)

View changes on GitHub

`v1.7.2`

Compare Source

🚀 Features

Add decodeHtmlEntities function to handle HTML entity decoding - by @yuyinws (c4e1c)

View changes on GitHub

okineadev/vitepress-plugin-llms (vitepress-plugin-llms)

`v1.12.0`

Compare Source

🚀 Enhancements

Add ignoreFilesPerOutput option for separate file filtering for llms.txt, llms-full.txt and individual pages - by @okineadev (a48c7)

🩹 Fixes

Fix index.md resolving - by @okineadev (f46fc)

💖 Contributors

@okineadev

View changes on GitHub

vitest-dev/vitest (vitest)

`v4.1.2`

Compare Source

This release bumps Vitest's flatted version and removes version pinning to resolve flatted's CVE related issues (#9975).

🐞 Bug Fixes

Don't resolve setupFiles from parent directory - by @hi-ogawa in #9960 (7aa93)
Ensure sequential mock/unmock resolution - by @hi-ogawa and Claude Opus 4.6 in #9830 (7c065)
browser: Take failure screenshot if toMatchScreenshot can't capture a stable screenshot - by @macarie in #9847 (faace)
coverage: Correct coverageConfigDefaults values and types - by @Arthie in #9940 (b3c99)
pretty-format: Fix output limit over counting - by @hi-ogawa in #9965 (d3b7a)
Disable colors if agent is detected - by @sheremet-va and @AriPerkkio in #9851 (6f97b)

View changes on GitHub

`v4.1.1`

Compare Source

🚀 Features

experimental:
- Expose matchesTagsFilter to test if the current filter matches tags - by @sheremet-va in #9913 (eec53)
- Introduce experimental.vcsProvider - by @sheremet-va in #9928 (56115)

🐞 Bug Fixes

Mark TestProject.testFilesList internal properly - by @sapphi-red in #9867 (54f26)
Detect fixture that returns without calling use - by @oilater in #9831 and #9861 (633ae)
Drop vite 8.beta support - by @AriPerkkio in #9862 (b78f5)
Type regression in vi.mocked() static class methods - by @purepear and @hi-ogawa in #9857 (90926)
Properly re-evaluate actual modules of mocked external - by @hi-ogawa in #9898 (ae5ec)
Preserve coverage report when html reporter overlaps - by @hi-ogawa in #9889 (2d81a)
Provide vi.advanceTimers to the preview provider - by @sheremet-va in #9891 (1bc3e)
Don't leak event listener in playwright provider - by @sheremet-va in #9910 (d9355)
Open browser in --standalone mode without running tests - by @sheremet-va in #9911 (e78ad)
Guard disposable and optional body - by @sheremet-va in #9912 (6fdb2)
Resolve retry.condition RegExp serialization issue - by @nstepien and @hi-ogawa in #9942 (7b605)
collect:
- Don't treat extra props on test return as tests - by @sheremet-va in #9871 (141e7)
coverage:
- Simplify provider types - by @AriPerkkio in #9931 (aaf9f)
- Load built-in provider without module runner - by @AriPerkkio in #9939 (bf892)
expect:
- Soft assertions continue after .resolves/.rejects promise errors - by @mixelburg, Maks Pikov, Claude Opus 4.6 (1M context) and @hi-ogawa in #9843 (6d74b)
- Fix sinon-chai style API - by @hi-ogawa in #9943 (0f08d)
pretty-format:
- Limit output for large object - by @hi-ogawa and Claude Opus 4.6 (1M context) in #9949 (0d5f9)

View changes on GitHub

vuejs/core (vue)

`v3.5.31`

Compare Source

Bug Fixes

compiler-sfc: allow Node.js subpath imports patterns in asset urls (#13045) (95c3356), closes #9919
compiler-sfc: support template literal as defineModel name (#14622) (bd7eef0), closes #14621
reactivity: normalize toRef property keys before dep lookup + improve types (#14625) (1bb28d0), closes #12427 #12431
runtime-core: invalidate detached v-for memo vnodes after unmount (#14624) (560def4), closes #12708 #12710
runtime-core: preserve nullish event handlers in mergeProps (#14550) (5725222)
runtime-core: prevent merging model listener when value is null or undefined (#14629) (b39e032)
runtime-dom: defer teleport mount/update until suspense resolves (#8619) (88ed045), closes #8603
runtime-dom: handle activeElement check in Shadow DOM for v-model (#14196) (959ded2)
server-renderer: cleanup component effect scopes after SSR render (#14548) (862f11e)
suspense: avoid unmount activeBranch twice if wrapped in transition (#9392) (908c6ad), closes #7966
suspense: update suspense vnode's el during branch self-update (#12922) (a2c1700), closes #12920
transition: skip enter guard while hmr updating (#14611) (be0a2f1), closes #14608
types: prevent shallowReactive marker from leaking into value unions (#14493) (3b561db), closes #14490

Configuration

📅 Schedule: Branch creation - "before 10am on monday" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

netlify · 2026-03-29T16:43:33Z

✅ Deploy Preview for rolldown-rs canceled.

Name	Link
🔨 Latest commit	`156cd64`
🔍 Latest deploy log	https://app.netlify.com/projects/rolldown-rs/deploys/69c9ce004ff89d00088bb9e3

socket-security · 2026-03-29T16:43:45Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@oxlint/plugins@1.56.0 ⏵ 1.57.0	⁺¹		⁺¹	⁺¹
	diff@8.0.3 ⏵ 8.0.4			⁺¹

View full report

@sapphi-red

## [1.0.0-rc.13] - 2026-04-01 ### 🚀 Features - add friendly error for unloadable virtual modules (#8955) by @sapphi-red - better error message for unsupported CSS error (#8911) by @sapphi-red ### 🐛 Bug Fixes - prevent chunk merging from leaking entry side effects (#8979) by @IWANABETHATGUY - correct inlining based on module's def format and esModule flag (#8975) by @h-a-n-a - generate init calls for excluded re-exports in strict execution order (#8858) by @IWANABETHATGUY - consistent order for `meta.chunks` in `renderChunk` hook (#8956) by @sapphi-red - subpath imports in glob imports failing to find files (#8885) by @kalvenschraut - browser: bundle binding types in dts output (#8930) by @nyan-left - ci: guard artifact download step in `vite-test-ubuntu` when build is skipped (#8934) by @Copilot - track CJS re-export import records to fix inline const and tree-shaking (#8925) by @h-a-n-a - use ImportKind::Import for common-chunk root computation (#8899) by @IWANABETHATGUY - watch: clear emitted_filenames between rebuilds (#8914) by @IWANABETHATGUY - ci: cache esbuild snapshots to avoid 429 rate limiting (#8921) by @IWANABETHATGUY - always check circular deps in chunk optimizer (#8915) by @IWANABETHATGUY - don't mark calls to reassigned bindings as pure (#8917) by @IWANABETHATGUY - magic-string: throw TypeError for non-string content args (#8905) by @IWANABETHATGUY - magic-string: add split-point validation and overwrite/update options (#8904) by @IWANABETHATGUY ### 🚜 Refactor - pre-compute has_side_effects on ChunkCandidate (#8981) by @IWANABETHATGUY - cleanup and simplify in dynamic_import.rs (#8927) by @ulrichstark - rename came_from_cjs to came_from_commonjs for consistency (#8938) by @IWANABETHATGUY - inline `create_ecma_view` return destructuring and remove redundant binding (#8932) by @shulaoda ### 📚 Documentation - document ensure_lazy_module_initialization_order in code-splitting design doc (#8931) by @IWANABETHATGUY ### 🧪 Testing - add regression test for runtime helper circular dependency (#8958) by @h-a-n-a - enable 8 previously-skipped MagicString remove tests (#8945) by @IWANABETHATGUY - add test for why PureAnnotation is needed in execution order check (#8933) by @IWANABETHATGUY ### ⚙️ Miscellaneous Tasks - add `@emnapi/runtime` and `@emnapi/core` as direct deps of `@rolldown/browser` (#8978) by @Copilot - deps: update dependency vite-plus to v0.1.15 (#8970) by @renovate[bot] - deps: update dependency oxfmt to ^0.43.0 (#8969) by @renovate[bot] - deps: upgrade oxc to 0.123.0 (#8967) by @shulaoda - justfile: deduplicate update-submodule as alias of setup-submodule (#8968) by @shulaoda - deps: update rollup submodule for tests to v4.60.1 (#8965) by @sapphi-red - deps: update test262 submodule for tests (#8966) by @sapphi-red - remove unused `type-check` scripts (#8957) by @sapphi-red - deps: update actions/cache action to v5 (#8953) by @renovate[bot] - deps: update npm packages to v6 (major) (#8954) by @renovate[bot] - deps: update npm packages (#8948) by @renovate[bot] - deps: update rust crates (#8949) by @renovate[bot] - deps: update github-actions (#8947) by @renovate[bot] - deps: update napi (#8943) by @renovate[bot] - deps: update dependency rolldown-plugin-dts to ^0.23.0 (#8944) by @renovate[bot] - regenerate testing snapshots (#8928) by @ulrichstark - deps: update dependency rust to v1.94.1 (#8923) by @renovate[bot] ### ❤️ New Contributors * @kalvenschraut made their first contribution in [#8885](#8885) * @nyan-left made their first contribution in [#8930](#8930) Co-authored-by: shulaoda <[email protected]>

renovate bot enabled auto-merge (squash) March 29, 2026 16:43

renovate-approve bot approved these changes Mar 29, 2026

View reviewed changes

renovate bot force-pushed the renovate/npm-packages branch from 6f16e48 to 60fc00b Compare March 29, 2026 21:09

chore(deps): update npm packages

156cd64

renovate bot force-pushed the renovate/npm-packages branch from 60fc00b to 156cd64 Compare March 30, 2026 01:12

renovate bot merged commit 941a734 into main Mar 30, 2026
53 checks passed

renovate bot deleted the renovate/npm-packages branch March 30, 2026 01:16

This was referenced Apr 1, 2026

release: v1.0.0-rc.13 #8971

Open

release: v1.0.0-rc.13 #8984

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update npm packages#8948

chore(deps): update npm packages#8948
renovate[bot] merged 1 commit intomainfrom
renovate/npm-packages

renovate bot commented Mar 29, 2026 •

edited

Loading

Uh oh!

netlify bot commented Mar 29, 2026 •

edited

Loading

Uh oh!

socket-security bot commented Mar 29, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Mar 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Features

Pull Requests

Bug Fixes

Pull Requests

Features

Features

Bug Fixes

Miscellaneous Chores

Tests

Features

Bug Fixes

Miscellaneous Chores

🚀 Features

🐞 Bug Fixes

🚀 Features

🚀 Enhancements

🩹 Fixes

💖 Contributors

🐞 Bug Fixes

🚀 Features

🐞 Bug Fixes

Bug Fixes

Configuration

Uh oh!

netlify bot commented Mar 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for rolldown-rs canceled.

Uh oh!

socket-security bot commented Mar 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Mar 29, 2026 •

edited

Loading

netlify bot commented Mar 29, 2026 •

edited

Loading

socket-security bot commented Mar 29, 2026 •

edited

Loading