chore(deps): update bundlers

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
rolldown (source)	1.2.9 → 1.2.10
rollup (source)	4.63.3 → 4.63.4

---

Release Notes

rolldown/rolldown (rolldown)

v1.2.10

Compare Source

🚀 Features

• rolldown_plugin_esm_external_require: prefer 'module.exports' over a namespace spread (#​10901) by @​isker
• watch: support directories in addWatchFile (#​10944) by @​shulaoda
• label code-splitting timing rows (#​10896) by @​IWANABETHATGUY
• separate code-splitting group timing rows (#​10892) by @​IWANABETHATGUY
• clarify callback owners in the timing report (#​10890) by @​IWANABETHATGUY
• add checks.bundlerTimings with deprecated pluginTimings alias (#​10883) by @​IWANABETHATGUY

🐛 Bug Fixes

• code-splitting: initialize leaves behind a re-exported namespace import (#​10694) by @​hyfdev
• node: record the WASI target on the WebContainer binding fallback (#​10952) by @​shulaoda
• dev: force incremental build on in DevEngine::new (#​10958) by @​o-alexandrov
• tree-shaking: propagate side effects through cycles (#​10893) by @​IWANABETHATGUY
• deconflict CJS locals that shadow a renamed require wrapper (#​10793) by @​logaretm
• include group indexes in labeled codeSplitting timing rows (#​10916) by @​IWANABETHATGUY
• docs: type-check Algolia indices option (#​10934) by @​shulaoda
• docs: restore Algolia search (#​10929) by @​isker
• tell code-splitting timing rows apart by position (#​10903) by @​IWANABETHATGUY

🚜 Refactor

• rolldown_fs_watcher: remove the single-path API (#​10950) by @​shulaoda
• dev: register watch files through FsWatcher (#​10949) by @​shulaoda
• watch: let FsWatcher own the watched paths (#​10948) by @​shulaoda
• watch: identify watch files by normalized absolute path (#​10943) by @​shulaoda
• plugin: build a plugin-resolved ResolvedId in one place (#​10921) by @​IWANABETHATGUY

📚 Documentation

• dev: add HMR design, align dev docs and engine comments (#​10271) by @​h-a-n-a

⚡ Performance

• batch sourcemapPathTransform calls (#​10763) by @​IWANABETHATGUY
• batch sourcemapIgnoreList calls (#​10762) by @​IWANABETHATGUY
• hmr: drop the unused kind argument from registerFactory (#​10915) by @​h-a-n-a

🧪 Testing

• handle Windows paths in sourcemap callback tests (#​10942) by @​IWANABETHATGUY

⚙️ Miscellaneous Tasks

• replace custom ban-expect-assertions JS lint with builtin no-restricted-properties (#​10933) by @​isker
• deps: update napi (#​10959) by @​renovate[bot]
• deps: upgrade oxc to 0.151.0 (#​10939) by @​camc314
• deps: update test262 submodule for tests (#​10941) by @​rolldown-guard[bot]
• deps: update npm packages (#​10931) by @​renovate[bot]
• deps: update napi (#​10928) by @​renovate[bot]
• deps: update dependency vite-plus to v0.3.3 (#​10914) by @​renovate[bot]
• deps: update rust crates (#​10932) by @​renovate[bot]
• deps: update github actions (#​10930) by @​renovate[bot]
• deps: update dependency rolldown-plugin-dts to v0.28.6 (#​10924) by @​renovate[bot]
• deps: update crate-ci/typos action to v1.50.2 (#​10917) by @​renovate[bot]
• deps: update dependency @​napi-rs/cli to v3.10.4 (#​10913) by @​renovate[bot]
• deps: update napi (#​10897) by @​renovate[bot]

❤️ New Contributors

• @​o-alexandrov made their first contribution in #​10958

rollup/rollup (rollup)

v4.63.4

Compare Source

2026-09-19

Bug Fixes

• Ensure meta information of the cached module is exposed in shouldTransformCachedModule (#​6442)
• Do not create invalid code if import attribute values contain special characters (#​6502)

Pull Requests

• #​6429: ci: collect Rust coverage from JS tests in dedicated job (@​lukastaegert)
• #​6442: fix: expose cached module meta during cache checks (@​ychampion, @​lukastaegert)
• #​6496: docs: name the parameter runHook actually takes (@​darkdi, @​lukastaegert)
• #​6502: Escape quotes and backslashes in import attribute values (@​dylanpulver, @​lukastaegert)
• #​6517: Improve agent instructions (@​lukastaegert)
• #​6518: fix(deps): update minor/patch updates (@​renovate[bot])
• #​6519: Request Copilot code review via workflow (@​lukastaegert)

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • "before 11am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	rolldown@​1.2.9 ⏵ 1.2.10			+1
	rollup@​4.63.3 ⏵ 4.63.4

View full report