chore(deps): update npm packages by renovate[bot] · Pull Request #9533 · rolldown/rolldown

renovate · 2026-05-24T17:32:10Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@oxlint/plugins (source)	`1.65.0` → `1.66.0`
@rolldown/pluginutils (source)	`1.0.0` → `1.0.1`
mocha (source)	`11.7.5` → `11.7.6`
tinybench	`6.0.1` → `6.0.2`
tsx (source)	`4.22.1` → `4.22.3`
vite (source)	`8.0.11` → `8.0.14`
vitest (source)	`4.1.6` → `4.1.7`
void (source)	`^0.7.11` → `^0.8.0`
vue-router (source)	`5.0.6` → `5.0.7`
web-tree-sitter (source)	`0.26.8` → `0.26.9`

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

rolldown/plugins (@rolldown/pluginutils)

`v1.0.1`

mochajs/mocha (mocha)

`v11.7.6`

Compare Source

🩹 Fixes

make describe().timeout() work (aafe6fd)
test: replace wmic usage with native Windows API (#5694) (73ebdfa)

🧹 Chores

format all code (#5629) (0696784)
remove Netlify (#5630) (8d01d33)

tinylibs/tinybench (tinybench)

`v6.0.2`

Compare Source

🐞 Bug Fixes

lint: Add promise recommended config and jsdoc check-tag-names rule - by @jerome-benoit (124e4)

View changes on GitHub

privatenumber/tsx (tsx)

`v4.22.3`

Compare Source

`v4.22.2`

Compare Source

vitejs/vite (vite)

`v8.0.14`

Compare Source

Features

update rolldown to 1.0.2 (#22484) (96efc88)

Bug Fixes

deps: update all non-major dependencies (#22471) (98b8163)
dev: handle errors when sending messages to vite server (#22450) (e8e9a34)
html: handle trailing slash paths in transformIndexHtml (#22480) (5d94d1b)
optimizer: pass oxc jsx options to transformSync in dependency scan (#22342) (b3132da)

Miscellaneous Chores

deps: update rolldown-related dependencies (#22470) (7cb728e)
remove irrelevant commits from changelog (2c69495)

Code Refactoring

glob: do not rewrite import path for absolute base (#22310) (0ae2844)

Tests

css: sass does not use main field (#22449) (ebf39a0)

`v8.0.13`

Compare Source

Features

bundled-dev: add lazy bundling support (#21406) (4f0949f)
optimizer: improve the esbuild plugin converter to pass some properties of build result to onEnd (#22357) (47071ce)
update rolldown to 1.0.1 (#22444) (8c766a6)

Bug Fixes

build: copy public directory after building same environment with write=false (#22328) (158e8ae)
css: await sass/less/styl worker disposal on teardown (fix #22274) (#22275) (b7edcb7)
css: keep deprecated name/originalFileName in synthetic assetFileNames call (#22439) (8e59c97)
make isBundled per environment (#22257) (a576326)
ssr: avoid rewriting labels that collide with imports (#22451) (d9b18e0)

Miscellaneous Chores

remove irrelevant commits from changelog (#22430) (6ea3838)
update changelog (#22413) (fcdc87c)

`v8.0.12`

Compare Source

Features

update rolldown to 1.0.0 (#22401) (cf0ff41)

Bug Fixes

create-vite: pass react framework to TanStack CLI (#22397) (18f0f90)
deps: update all non-major dependencies (#22420) (2be6000)
module-runner: prevent partial-exports race on concurrent imports of in-flight invalidated re-export chains (#22369) (f5a22e6)
refer to rolldownOptions instead of deprecated rollupOptions in messages (#22400) (b675c7b)
worker: apply build.target to worker bundle (#22404) (3c93fde)
worker: forward define to worker bundle transform (#22408) (d4838a0)

Miscellaneous Chores

deps: update dependency eslint-plugin-n to v18 (#22423) (2fe7bd2)
deps: update rolldown-related dependencies (#22421) (66b9eb3)

vitest-dev/vitest (vitest)

`v4.1.7`

Compare Source

🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in #10384 (4f0f2)

View changes on GitHub

voidzero-dev/void (void)

`v0.8.1`

Compare Source

`v0.8.0`

Compare Source

vuejs/router (vue-router)

`v5.0.7`

Compare Source

🚀 Features

Upgrade to babel 8 - by @posva (8d3e6)
Make defineParamParser() more intuitive - by @posva (8715b)
Upgrade @vue/devtools-api - by @posva (87c3a)
matcher: Hint at params: {} workaround in discarded params warning - by @posva and shanliuling in #2689 (c2b13)
param-parsers: Add include/exclude options - by @posva (91cde)

🐞 Bug Fixes

matcher:
- Finalize param token before processing escaped colon - by @babu-ch and @posva in #2654 (20521)
query:
- Use Object.create(null) to prevent prototype pollution - by @wdskuki, wdsmini and @posva in #2661 (be88c)
resolve:
- Omit empty optional params from resolved params - by @babu-ch and @posva in #2434 (1ef09)
types:
- Wire RouteNamedMap via generated routes.d.ts - by @posva in #2700 (aef99)
unplugin:
- Avoid generating empty routes - by @FrontEndDog and @posva in #2642 (10a8b)
- Apply definePage path-param parser overrides - by @posva in #2699 (c8074)
volar:
- Drop runtime @vue/language-core import - by @danielroe in #2710 (8af50)

View changes on GitHub

tree-sitter/tree-sitter (web-tree-sitter)

`v0.26.9`

Compare Source

What's Changed

ci(actions): bump actions/cache to v5 by @tree-sitter-ci-bot[bot] in #5482
build(deps): bump wasmtime-c-api to v36.0.7 by @WillLillis in #5514
fix(loader): allow filenames with dots by @tree-sitter-ci-bot[bot] in #5538
fix(rust): fix new clippy lints by @WillLillis in #5539
test: bump c test fixture to v0.24.2 by @tree-sitter-ci-bot[bot] in #5542
fix(generate): pass default optimization level in generate_parser_for_grammar by @tree-sitter-ci-bot[bot] in #5543
feat(dist): enable install via cargo binstall (#5533) by @clason in #5544
Prevent a buffer over-read when parsing 4-byte UTF-16 characters. by @tree-sitter-ci-bot[bot] in #5549
fix(query): overflow in capture pool ids + some perf by @tree-sitter-ci-bot[bot] in #5555
docs: note zero point unbounded behavior in query functions by @WillLillis in #5563
build(deps): bump wasmtime-c-api to v36.0.8 by @clason in #5574
fix(cli): account for process versions > 5 in the parse command's pretty debug output. by @tree-sitter-ci-bot[bot] in #5577
fix(generate): improve error message for nonterminals used in immediate token rule by @tree-sitter-ci-bot[bot] in #5583
fix(generate): rewrite parse_grammar with forward DFS by @WillLillis in #5584
fix(wasm): load supertype tables for ABI 15 grammars by @tree-sitter-ci-bot[bot] in #5606
build(deps): bump wasmtime-c-api to v36.0.9 by @clason in #5611
Validate Wasm language memory reads by @tree-sitter-ci-bot[bot] in #5613
release v0.26.9 by @clason in #5612

Full Changelog: tree-sitter/tree-sitter@v0.26.8...v0.26.9

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

Branch creation
- "before 10am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-05-24T17:32:13Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Scope: all 38 workspace projects
Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 72, reused 0, downloaded 0, added 0
packages/rollup-tests                    | [WARN] deprecated [email protected]
Progress: resolved 206, reused 1, downloaded 0, added 0
/tmp/renovate/repos/github/rolldown/rolldown/packages/rolldown/tests:
[ERR_PNPM_TRUST_DOWNGRADE] High-risk trust downgrade for "[email protected]" (possible package takeover)

This error happened while installing the dependencies of [email protected]

Trust checks are based solely on publish date, not semver. A package cannot be installed if any earlier-published version had stronger trust evidence. Earlier versions had trusted publisher, but this version has provenance attestation. A trust downgrade may indicate a supply chain incident.
Progress: resolved 503, reused 1, downloaded 0, added 0

netlify · 2026-05-24T17:33:55Z

✅ Deploy Preview for rolldown-rs canceled.

Name	Link
🔨 Latest commit	`25f1e74`
🔍 Latest deploy log	https://app.netlify.com/projects/rolldown-rs/deploys/6a1374660b9bf4000890245a

renovate · 2026-05-24T21:59:18Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

socket-security · 2026-05-24T21:59:40Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@oxlint/plugins@1.66.0
	npm/void@0.8.11

View full report

@kylecannon

## [1.0.3] - 2026-05-27 ### 🚀 Features - transform: respect decorator strictNullChecks option (#9580) by @kylecannon - drop `defer` keyword (#9503) by @TheAlexLichter ### 🐛 Bug Fixes - ci: create target dir before cargo release-oxc update (#9584) by @shulaoda - ci: reorder prepare-release steps to avoid dirty git check failure (#9583) by @shulaoda - testing: canonicalize temp dir early and use platform-specific separator in test262 (#9582) by @shulaoda - testing: resolve symlinked temp dir in test262 snapshot normalization (#9581) by @shulaoda - testing: canonicalize temp dir path in test262 snapshot normalization (#9579) by @shulaoda - dev: `onOutput` called twice when initial build fails (#9552) by @hyf0 - dev: make `ensureCurrentBuildFinish` not returning error when engine closes (#9564) by @h-a-n-a - oxc-runtime: route require() to CJS helper variant (#9263) (#9526) by @IWANABETHATGUY - generator: use exporter chunk's export mode for CJS default re-exports (#9299) (#9529) by @IWANABETHATGUY - rolldown: always run reduced-atom static cycle check (#9441) (#9514) by @IWANABETHATGUY - apply transform.dropLabels before scanning (#9521) (#9522) by @IWANABETHATGUY - rolldown_watcher: take `rolldown` dep through the workspace (#9510) by @Boshen - cache: keep the scan-stage cache consistent when a build fails (#9495) by @h-a-n-a - skip JSON default-import namespace optimization for write targets (#9484) (#9489) by @IWANABETHATGUY - deps: skip pnpm frozen-lockfile on Netlify to dodge catalog mismatch bug (#9471) by @Boshen ### 🚜 Refactor - oxc-runtime: use Cow for helper path construction (#9538) by @IWANABETHATGUY - fold import defer phase drop into PreProcessor (#9524) by @IWANABETHATGUY - distinguish `map: null` vs `map: undefined` in transform hook output (#9497) by @sapphi-red ### 📚 Documentation - explain the policy for Rust crates (#9547) by @sapphi-red - cache: add design doc for cache (#9544) by @h-a-n-a - guide/troubleshooting: add TDZ error section (#9537) by @sapphi-red - dev-engine: add design doc for dev-engine (#9479) by @h-a-n-a - lazy-barrel: tweak some words (#9483) by @shulaoda - lazy-barrel: expand reasoning behind LARGE_BARREL_MODULES advice (#9477) by @shulaoda ### ⚡ Performance - generate: thread ast_table by value into codegen consumer (#9555) by @Boshen - finalizers: replace `_reExport` construction with a direct call to avoid calling `clone_in` (#9501) by @Dunqing - reorder hot-path boolean checks to short-circuit on cheap predicates first (#9523) by @Boshen ### 🧪 Testing - rolldown: regression fixture for #9401 (#9418) by @IWANABETHATGUY - failing test for #9441 (#9504) by @TheAlexLichter ### ⚙️ Miscellaneous Tasks - deps: upgrade oxc to 0.133.0 (#9563) by @Dunqing - deps: update crate-ci/typos action to v1.46.3 (#9576) by @renovate[bot] - deps: update mimalloc-safe to 0.1.62 (#9577) by @shulaoda - mimalloc-safe: update to a bug-fix branch for verification (#9569) by @shulaoda - deps: update test262 submodule for tests (#9551) by @rolldown-guard[bot] - point published crates' readme to root README.md (#9553) by @Boshen - replace actions-cool/issues-helper with gh CLI (#9543) by @Boshen - deps: update cargo-shear to 1.12.4 (#9541) by @Boshen - deps: update taiki-e/install-action action to v2.79.4 (#9535) by @renovate[bot] - deps: update github actions (#9532) by @renovate[bot] - deps: update rust crates (#9534) by @renovate[bot] - deps: update npm packages (#9533) by @renovate[bot] - gate experimental/testing-only items to silence dead_code in publish builds (#9517) by @Boshen - docs: deploy to Void (#9509) by @Boshen - release: set up cargo-release-oxc for publishing crates (#9476) by @Boshen - rolldown_plugin_lazy_compilation: add missing description (#9507) by @Boshen - mimalloc-safe: update to a bug-fix branch for verification (#9506) by @shulaoda - deps: update crate-ci/typos action to v1.46.2 (#9468) by @renovate[bot] ### ❤️ New Contributors * @kylecannon made their first contribution in [#9580](#9580)

@kylecannon

## [1.0.3] - 2026-05-27 ### 🚀 Features - transform: respect decorator strictNullChecks option (#9580) by @kylecannon - drop `defer` keyword (#9503) by @TheAlexLichter ### 🐛 Bug Fixes - ci: create target dir before cargo release-oxc update (#9584) by @shulaoda - ci: reorder prepare-release steps to avoid dirty git check failure (#9583) by @shulaoda - testing: canonicalize temp dir early and use platform-specific separator in test262 (#9582) by @shulaoda - testing: resolve symlinked temp dir in test262 snapshot normalization (#9581) by @shulaoda - testing: canonicalize temp dir path in test262 snapshot normalization (#9579) by @shulaoda - dev: `onOutput` called twice when initial build fails (#9552) by @hyf0 - dev: make `ensureCurrentBuildFinish` not returning error when engine closes (#9564) by @h-a-n-a - oxc-runtime: route require() to CJS helper variant (#9263) (#9526) by @IWANABETHATGUY - generator: use exporter chunk's export mode for CJS default re-exports (#9299) (#9529) by @IWANABETHATGUY - rolldown: always run reduced-atom static cycle check (#9441) (#9514) by @IWANABETHATGUY - apply transform.dropLabels before scanning (#9521) (#9522) by @IWANABETHATGUY - rolldown_watcher: take `rolldown` dep through the workspace (#9510) by @Boshen - cache: keep the scan-stage cache consistent when a build fails (#9495) by @h-a-n-a - skip JSON default-import namespace optimization for write targets (#9484) (#9489) by @IWANABETHATGUY - deps: skip pnpm frozen-lockfile on Netlify to dodge catalog mismatch bug (#9471) by @Boshen ### 🚜 Refactor - oxc-runtime: use Cow for helper path construction (#9538) by @IWANABETHATGUY - fold import defer phase drop into PreProcessor (#9524) by @IWANABETHATGUY - distinguish `map: null` vs `map: undefined` in transform hook output (#9497) by @sapphi-red ### 📚 Documentation - explain the policy for Rust crates (#9547) by @sapphi-red - cache: add design doc for cache (#9544) by @h-a-n-a - guide/troubleshooting: add TDZ error section (#9537) by @sapphi-red - dev-engine: add design doc for dev-engine (#9479) by @h-a-n-a - lazy-barrel: tweak some words (#9483) by @shulaoda - lazy-barrel: expand reasoning behind LARGE_BARREL_MODULES advice (#9477) by @shulaoda ### ⚡ Performance - generate: thread ast_table by value into codegen consumer (#9555) by @Boshen - finalizers: replace `_reExport` construction with a direct call to avoid calling `clone_in` (#9501) by @Dunqing - reorder hot-path boolean checks to short-circuit on cheap predicates first (#9523) by @Boshen ### 🧪 Testing - rolldown: regression fixture for #9401 (#9418) by @IWANABETHATGUY - failing test for #9441 (#9504) by @TheAlexLichter ### ⚙️ Miscellaneous Tasks - deps: upgrade oxc to 0.133.0 (#9563) by @Dunqing - deps: update crate-ci/typos action to v1.46.3 (#9576) by @renovate[bot] - deps: update mimalloc-safe to 0.1.62 (#9577) by @shulaoda - mimalloc-safe: update to a bug-fix branch for verification (#9569) by @shulaoda - deps: update test262 submodule for tests (#9551) by @rolldown-guard[bot] - point published crates' readme to root README.md (#9553) by @Boshen - replace actions-cool/issues-helper with gh CLI (#9543) by @Boshen - deps: update cargo-shear to 1.12.4 (#9541) by @Boshen - deps: update taiki-e/install-action action to v2.79.4 (#9535) by @renovate[bot] - deps: update github actions (#9532) by @renovate[bot] - deps: update rust crates (#9534) by @renovate[bot] - deps: update npm packages (#9533) by @renovate[bot] - gate experimental/testing-only items to silence dead_code in publish builds (#9517) by @Boshen - docs: deploy to Void (#9509) by @Boshen - release: set up cargo-release-oxc for publishing crates (#9476) by @Boshen - rolldown_plugin_lazy_compilation: add missing description (#9507) by @Boshen - mimalloc-safe: update to a bug-fix branch for verification (#9506) by @shulaoda - deps: update crate-ci/typos action to v1.46.2 (#9468) by @renovate[bot] ### ❤️ New Contributors * @kylecannon made their first contribution in [#9580](#9580)

chore(deps): update npm packages

3c3d97f

u

25f1e74

shulaoda approved these changes May 24, 2026

View reviewed changes

shulaoda merged commit 5b38caa into main May 24, 2026
54 checks passed

shulaoda deleted the renovate/npm-packages branch May 24, 2026 22:08

rolldown-guard Bot mentioned this pull request May 27, 2026

release: v1.0.3 for rust crates #9585

Merged

shulaoda mentioned this pull request May 27, 2026

release: v1.0.3 #9586

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update npm packages#9533

chore(deps): update npm packages#9533
shulaoda merged 2 commits into
mainfrom
renovate/npm-packages

renovate Bot commented May 24, 2026

Uh oh!

renovate Bot commented May 24, 2026

Uh oh!

netlify Bot commented May 24, 2026 •

edited

Loading

Uh oh!

renovate Bot commented May 24, 2026

Uh oh!

socket-security Bot commented May 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented May 24, 2026

Release Notes

🩹 Fixes

🧹 Chores

🐞 Bug Fixes

Features

Bug Fixes

Miscellaneous Chores

Code Refactoring

Tests

Features

Bug Fixes

Miscellaneous Chores

Features

Bug Fixes

Miscellaneous Chores

🐞 Bug Fixes

🚀 Features

🐞 Bug Fixes

What's Changed

Configuration

Uh oh!

renovate Bot commented May 24, 2026

⚠️ Artifact update problem

File name: pnpm-lock.yaml

Uh oh!

netlify Bot commented May 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for rolldown-rs canceled.

Uh oh!

renovate Bot commented May 24, 2026

Edited/Blocked Notification

Uh oh!

socket-security Bot commented May 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

netlify Bot commented May 24, 2026 •

edited

Loading