chore(deps): update bundlers

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
rolldown (source)	1.2.12 → 1.2.13
rollup (source)	4.63.6 → 4.64.0

---

Release Notes

rolldown/rolldown (rolldown)

v1.2.13

Compare Source

🚀 Features

• rolldown_plugin_vite_import_glob: follow file creation and deletion via hotUpdate (#​10550) by @​shulaoda
• inline-common-chunks: deduplicate shared code along known loading paths (#​11093) by @​hyfdev
• rolldown_plugin_vite_import_glob: record a matcher per glob call in dev (#​10592) by @​shulaoda
• rolldown_plugin_vite_import_glob: watch the directory each glob reads (#​10549) by @​shulaoda
• watch: hand watch.exclude to notify as its ignore filter (#​11008) by @​shulaoda
• dev: add experimental.devMode.hotUpdate option (#​11123) by @​h-a-n-a

🐛 Bug Fixes

• renamer: check the printed name of namespace-alias imports for captures (#​11129) by @​IWANABETHATGUY
• devtools: honor devtools.sessionId by @​Brooooooklyn
• renamer: keep a renamed nested binding off its module's top-level bindings (#​11128) by @​IWANABETHATGUY
• dev: keep this undefined when calling an imported function in HMR patches and lazy chunks (#​11126) by @​h-a-n-a
• dev: read string-named imports correctly in HMR patches and lazy chunks (#​11127) by @​h-a-n-a
• sanitize preserveModules chunk names after resolving the relative path (#​11087) by @​waltuov
• keep the with clause on bare external imports (#​11100) by @​IWANABETHATGUY
• generator: filter DISABLE_JS_HOOK bits from generated HookUsage (#​10346) by @​Brooooooklyn
• dev: make the module factory async for top-level await (#​11118) by @​h-a-n-a
• node: give each renderChunk call its own meta object (#​11115) by @​Brooooooklyn
• honor externalLiveBindings for imported exports (#​11048) by @​camc314
• dev: keep a late payload from replacing newer module code (#​11030) by @​h-a-n-a
• binding: use-after-free in async transform with a TsconfigCache (#​11080) by @​shulaoda
• fail on chunk syntax errors and escape export names once (#​11051) by @​hyfdev
• dev: ship newly imported modules the client never received (#​11029) by @​h-a-n-a
• code-splitting: avoid cycles from redundant re-export initialization (#​11073) by @​hyfdev
• link: treat re-exports of the same external binding as one export (#​11069) by @​IWANABETHATGUY
• escape namespace properties in IIFE and UMD output (#​11085) by @​hyfdev
• escape dependency paths in CJS and UMD output (#​11084) by @​hyfdev
• use computed access for arbitrary import names (#​11083) by @​hyfdev
• generate valid bindings for shimmed exports (#​11082) by @​hyfdev
• dev: reload the page when an HMR update fails after merging its edit (#​11031) by @​h-a-n-a
• dev/lazy: ship the deps of a module that a patch shipped but never ran (#​11028) by @​h-a-n-a
• code-splitting: don't move init calls in front of unwrapped JSON modules (#​11062) by @​IWANABETHATGUY
• escape export names in defineProperty calls (#​11047) by @​camc314

📚 Documentation

• say the CLI bundles multiple configs one after another (#​11111) by @​Brooooooklyn
• add renderChunk hook filter docs (#​11065) by @​sapphi-red

⚡ Performance

• use concat_string! instead of format! for plain string joins (#​11139) by @​IWANABETHATGUY
• utils: evaluate each concat_string! argument once (#​11105) by @​IWANABETHATGUY
• json: escape JSON.parse string with json-escape-simd (#​11104) by @​IWANABETHATGUY
• unwrap JSON modules with a non-object root (#​11066) by @​IWANABETHATGUY

🧪 Testing

• inline-common-chunks: fix flaky inlineCommonChunks concurrent imports (#​11088) by @​hyfdev

⚙️ Miscellaneous Tasks

• deps: upgrade oxc to 0.153.0 (#​11109) by @​camc314
• update pnpm to v12 (#​10876) by @​btea
• deps: update pnpm to v11.28.0 (#​11049) by @​renovate[bot]
• deps: update rollup submodule for tests to v4.64.0 (#​11116) by @​rolldown-guard[bot]
• deps: update napi (#​11137) by @​renovate[bot]
• scripts: spawn the rolldown CLI without a shell in setup-vite (#​10875) by @​Brooooooklyn
• deps: bump @napi-rs/wasm-runtime to ~1.2.5 (#​11117) by @​shulaoda
• deps: update napi (#​11108) by @​renovate[bot]
• deps: update taiki-e/install-action action to v2.87.22 (#​11096) by @​renovate[bot]
• deps: update npm packages (#​11095) by @​renovate[bot]
• deps: update rust crates (#​11097) by @​renovate[bot]
• deps: update napi (#​11063) by @​renovate[bot]
• deps: update dependency rust to v1.99.0 (#​11071) by @​renovate[bot]
• deps: update dependency vite-plus to v1 (#​11056) by @​renovate[bot]

rollup/rollup (rollup)

v4.64.0

Compare Source

2026-10-02

Features

• Improve try-catch deoptimization to cover calling methods on objects (#​6541)

Bug Fixes

• Fix a situation where some feature-detections of core-js were not triggering properly (#​6541)

Pull Requests

• #​6541: Retain callbacks of helper methods called from try statements (@​lukastaegert)
• #​6542: Run additional tests as part of the coverage job (@​lukastaegert)
• #​6544: Update msys2/setup-msys2 digest to ec48f7c (@​renovate[bot], @​lukastaegert)
• #​6545: Update minor/patch updates (@​renovate[bot])
• #​6546: Update dependency @​mermaid-js/mermaid-cli to v12 (@​renovate[bot])
• #​6547: Update Rust crate swc_compiler_base to v65 (@​renovate[bot])

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • "before 11am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	rolldown@​1.2.12 ⏵ 1.2.13	+1		+1
	rollup@​4.63.6 ⏵ 4.64.0	+1			+1

View full report