[dependabot]

Bumps the npm-production group with 1 update: @rollup/rollup-linux-x64-gnu.

Updates @rollup/rollup-linux-x64-gnu from 4.64.5 to 4.64.9

Release notes

Sourced from @​rollup/rollup-linux-x64-gnu's releases.

v4.64.9

4.64.9

2026-10-17

Bug Fixes

• Ensure export live-bindings are properly maintained for aliased exports (#6576)
• Retain typed array constructor calls if the argument has iteration side effects (#6582)

Pull Requests

• #6576: Fix live bindings for aliased reassigned exports (@​oxura, @​lukastaegert)
• #6582: Retain typed array constructors that iterate their argument (@​joshuablac, @​lukastaegert)

v4.64.8

4.64.8

2026-10-17

Bug Fixes

• Ensure chunk hashes change when sourcemap comments change (#6509)
• Resolve some relative import resolution edge cases (#6522)

Pull Requests

• #6509: fix: include sourcemap comments in chunk hashes (@​snoopuppy582, @​wangxpych, @​lukastaegert)
• #6522: fix(browser): match node's join and relative for "." and ".." segments (@​luantaraschi, @​lukastaegert)
• #6577: Update dtolnay/rust-toolchain digest to 686976e (@​renovate[bot])
• #6578: Update minor/patch updates (@​renovate[bot])
• #6579: Update swc monorepo (major) (@​renovate[bot], @​lukastaegert)
• #6580: Lock file maintenance (@​renovate[bot], @​lukastaegert)
• #6581: Update dependency eslint-plugin-unicorn to v78 (@​renovate[bot])

v4.64.7

4.64.7

2026-10-15

Bug Fixes

• Fix an issue where watching not-yet-created files from plugins did not work if several shared a directory (#6575)

Pull Requests

• #6575: Report creation of missing watch files sharing a directory on Linux (@​lukastaegert)

v4.64.6

4.64.6

... (truncated)

Changelog

Sourced from @​rollup/rollup-linux-x64-gnu's changelog.

4.64.9

2026-10-17

Bug Fixes

• Ensure export live-bindings are properly maintained for aliased exports (#6576)
• Retain typed array constructor calls if the argument has iteration side effects (#6582)

Pull Requests

• #6576: Fix live bindings for aliased reassigned exports (@​oxura, @​lukastaegert)
• #6582: Retain typed array constructors that iterate their argument (@​joshuablac, @​lukastaegert)

4.64.8

2026-10-17

Bug Fixes

• Ensure chunk hashes change when sourcemap comments change (#6509)
• Resolve some relative import resolution edge cases (#6522)

Pull Requests

• #6509: fix: include sourcemap comments in chunk hashes (@​snoopuppy582, @​wangxpych, @​lukastaegert)
• #6522: fix(browser): match node's join and relative for "." and ".." segments (@​luantaraschi, @​lukastaegert)
• #6577: Update dtolnay/rust-toolchain digest to 686976e (@​renovate[bot])
• #6578: Update minor/patch updates (@​renovate[bot])
• #6579: Update swc monorepo (major) (@​renovate[bot], @​lukastaegert)
• #6580: Lock file maintenance (@​renovate[bot], @​lukastaegert)
• #6581: Update dependency eslint-plugin-unicorn to v78 (@​renovate[bot])

4.64.7

2026-10-15

Bug Fixes

• Fix an issue where watching not-yet-created files from plugins did not work if several shared a directory (#6575)

Pull Requests

• #6575: Report creation of missing watch files sharing a directory on Linux (@​lukastaegert)

4.64.6

2026-10-13

Bug Fixes

... (truncated)

Commits

• 6278729 4.64.9
• 3b41241 Retain typed array constructors that iterate their argument (#6582)
• 092d139 Fix live bindings for aliased reassigned exports (#6576)
• b7dd776 4.64.8
• 77a6b2b fix: include sourcemap comments in chunk hashes (#6509)
• 55f46a5 fix(browser): match node's join and relative for "." and ".." segments (#6522)
• fabcaff Update swc monorepo (major) (#6579)
• e410d42 Lock file maintenance (#6580)
• 5104039 Update dtolnay/rust-toolchain digest to 686976e (#6577)
• 175b8dc Update dependency eslint-plugin-unicorn to v78 (#6581)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[github-actions]

Non-blocking: this bump doesn't change the build. rollup is still 4.64.5 and pins its native binary exactly ("@rollup/rollup-linux-x64-gnu": "4.64.5"), so npm now nests a separate 4.64.5 copy under node_modules/rollup/node_modules/ (line ~10347), and that's the copy rollup loads. The hoisted 4.64.9 isn't used. The lock root also gains a dependencies entry ("4.64.9") that package.json doesn't have, because there it's only optionalDependencies: "*". The next npm install will rewrite that line, which adds lockfile churn. Consider closing this PR and bumping rollup and the binary to 4.64.9 together, or grouping the two in the Dependabot config.

[github-actions]

AI review: approve for 2ae3212

Dependabot PR that only changes package-lock.json: it moves the hoisted @rollup/rollup-linux-x64-gnu from 4.64.5 to 4.64.9. Nothing blocks merging, but the bump doesn't change the build. rollup is still 4.64.5 and pins its native binary exactly, so npm nests a separate 4.64.5 copy under rollup/node_modules, and that's the copy rollup loads. The hoisted 4.64.9 isn't used. The lock root also gains a dependencies entry that package.json doesn't have, where the package is only an optional dependency with *. The next npm install will rewrite that line. The hoisted entry also loses its dev flag. None of this affects the bundled dist/ or the action at runtime. I left a non-blocking inline comment suggesting rollup and its binary be bumped together. I couldn't view CI status (gh pr checks needed approval), so I haven't confirmed that npm ci passes with this lockfile.

Review run