Lockfile maintenance

[lockfile-maintenance]

Update selected lockfiles with a minimum release age of 3 days.

The package managers' native exceptions still apply. Validate updates with the repository's PR CI.

Version changes

Versions are grouped by package name. — means the package was not present.

package-lock.json

Package	Before	After	Change	History
@oxc-project/types	0.151.0	0.152.0	minor	Release history
@rolldown/binding-android-arm-eabi	1.2.11	1.2.12	patch	Release history
@rolldown/binding-android-arm64	1.2.11	1.2.12	patch	Release history
@rolldown/binding-darwin-arm64	1.2.11	1.2.12	patch	Release history
@rolldown/binding-darwin-x64	1.2.11	1.2.12	patch	Release history
@rolldown/binding-freebsd-x64	1.2.11	1.2.12	patch	Release history
@rolldown/binding-linux-arm-gnueabihf	1.2.11	1.2.12	patch	Release history
@rolldown/binding-linux-arm64-gnu	1.2.11	1.2.12	patch	Release history
@rolldown/binding-linux-arm64-musl	1.2.11	1.2.12	patch	Release history
@rolldown/binding-linux-ppc64-gnu	1.2.11	1.2.12	patch	Release history
@rolldown/binding-linux-s390x-gnu	1.2.11	1.2.12	patch	Release history
@rolldown/binding-linux-x64-gnu	1.2.11	1.2.12	patch	Release history
@rolldown/binding-linux-x64-musl	1.2.11	1.2.12	patch	Release history
@rolldown/binding-openharmony-arm64	1.2.11	1.2.12	patch	Release history
@rolldown/binding-win32-arm64-msvc	1.2.11	1.2.12	patch	Release history
@rolldown/binding-win32-x64-msvc	1.2.11	1.2.12	patch	Release history
chai	6.2.2	6.3.0	minor	Release history
hono	4.13.12	4.13.13	patch	Release history
nanoid	3.3.19	3.3.20	patch	Release history
postcss	8.5.28	8.5.29	patch	Release history
rolldown	1.2.11	1.2.12	patch	Release history
source-map-js	1.2.1	1.2.2	patch	Release history
tinyrainbow	3.1.1	3.2.0	minor	Release history
vite	8.3.2	8.3.3	patch	Release history

@oxc-project/types — 0.151.0 → 0.152.0 (0 releases)

Back to version changes · CHANGELOG.md · Releases

No published release notes found. See the links above.

@rolldown/binding-android-arm-eabi — 1.2.11 → 1.2.12 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v1.2.12

[1.2.12] - 2026-09-30

🚀 Features

• inline common chunks containing import() and deduplicate shared code in lazy chunks (#11034) by @​hyfdev
• experimental inlineCommonChunks support (#10899) by @​hyfdev
• dev: ship imported bindings for HMR partial accept (#10856) by @​h-a-n-a

🐛 Bug Fixes

• chunking: re-derive chunk exec orders after the runtime leaves its host chunk (#11005) by @​hyfdev
• code-splitting: gate member-read init paths on the reading statement (#11039) by @​hyfdev
• code-splitting: retain initialization paths through re-exported namespaces (#11037) by @​hyfdev
• dev: reject non-ESM output formats in dev mode (#11038) by @​h-a-n-a
• dev: align import.meta.hot.accept deps with Vite (#10997) by @​h-a-n-a
• dev: clear the resolver cache when a file is created or deleted (#10986) by @​waltuov
• error: name the resolved specifier in unresolved import diagnostics (#11014) by @​linyiru
• make entries-aware chunk merging deterministic (#11002) by @​hyfdev
• watch: avoid restarting macOS watcher for unchanged paths (#10992) by @​sep2

🚜 Refactor

• dev: ship the dev runtime entry as one file (#10998) by @​h-a-n-a
• binding: remove __internalForcePanic (#10989) by @​IWANABETHATGUY

📚 Documentation

• fix cloudflare preview builds (#10996) by @​sapphi-red
• fix build config loader warning (#10994) by @​sapphi-red
• deps: use Vite 8 (#10993) by @​sapphi-red

⚡ Performance

• dev: only ship rows with dynamic edges in registerGraph (#11019) by @​h-a-n-a

🧪 Testing

• code-splitting: cover more re-exported namespace shapes (#11042) by @​hyfdev
• webcontainer: cover the WebContainer download fallback in plain Node (#10966) by @​shulaoda
• dev: pin the runtime entry file layout that Vite serves (#10983) by @​h-a-n-a

⚙️ Miscellaneous Tasks

• pin VOID_API_URL for the docs deploy (#11041) by @​shulaoda
• opt into the WebContainer smoke test for napi bumps and loader changes (#10967) by @​shulaoda
• deps: upgrade oxc to 0.152.0 (#11018) by @​camc314
• deps: update rust crates (#11012) by @​renovate[bot]
• deps: update npm packages (#11011) by @​renovate[bot]
• deps: update crate-ci/typos action to v1.50.3 (#11023) by @​renovate[bot]
• deps: update test262 submodule for tests (#11022) by @​rolldown-guard[bot]
• deps: update rollup submodule for tests to v4.63.5 (#11021) by @​rolldown-guard[bot]
• deps: update dependency vite-plus to v1 (#11017) by @​renovate[bot]
• deps: update github actions (#11010) by @​renovate[bot]
• remove CLAUDE.md (#10925) by @​iiio2
• verify release debug info by matching file IDs (#10988) by @​IWANABETHATGUY
• deps: update rollup submodule for tests to v4.63.4 (#10940) by @​rolldown-guard[bot]

❤️ New Contributors

• @​waltuov made their first contribution in #10986
• @​linyiru made their first contribution in #11014
• @​sep2 made their first contribution in #10992

Co-authored-by: shulaoda 165626830+shulaoda@​users.noreply.github.com

@rolldown/binding-android-arm64 — 1.2.11 → 1.2.12 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v1.2.12

[1.2.12] - 2026-09-30

🚀 Features

• inline common chunks containing import() and deduplicate shared code in lazy chunks (#11034) by @​hyfdev
• experimental inlineCommonChunks support (#10899) by @​hyfdev
• dev: ship imported bindings for HMR partial accept (#10856) by @​h-a-n-a

🐛 Bug Fixes

• chunking: re-derive chunk exec orders after the runtime leaves its host chunk (#11005) by @​hyfdev
• code-splitting: gate member-read init paths on the reading statement (#11039) by @​hyfdev
• code-splitting: retain initialization paths through re-exported namespaces (#11037) by @​hyfdev
• dev: reject non-ESM output formats in dev mode (#11038) by @​h-a-n-a
• dev: align import.meta.hot.accept deps with Vite (#10997) by @​h-a-n-a
• dev: clear the resolver cache when a file is created or deleted (#10986) by @​waltuov
• error: name the resolved specifier in unresolved import diagnostics (#11014) by @​linyiru
• make entries-aware chunk merging deterministic (#11002) by @​hyfdev
• watch: avoid restarting macOS watcher for unchanged paths (#10992) by @​sep2

🚜 Refactor

• dev: ship the dev runtime entry as one file (#10998) by @​h-a-n-a
• binding: remove __internalForcePanic (#10989) by @​IWANABETHATGUY

📚 Documentation

• fix cloudflare preview builds (#10996) by @​sapphi-red
• fix build config loader warning (#10994) by @​sapphi-red
• deps: use Vite 8 (#10993) by @​sapphi-red

⚡ Performance

• dev: only ship rows with dynamic edges in registerGraph (#11019) by @​h-a-n-a

🧪 Testing

• code-splitting: cover more re-exported namespace shapes (#11042) by @​hyfdev
• webcontainer: cover the WebContainer download fallback in plain Node (#10966) by @​shulaoda
• dev: pin the runtime entry file layout that Vite serves (#10983) by @​h-a-n-a

⚙️ Miscellaneous Tasks

• pin VOID_API_URL for the docs deploy (#11041) by @​shulaoda
• opt into the WebContainer smoke test for napi bumps and loader changes (#10967) by @​shulaoda
• deps: upgrade oxc to 0.152.0 (#11018) by @​camc314
• deps: update rust crates (#11012) by @​renovate[bot]
• deps: update npm packages (#11011) by @​renovate[bot]
• deps: update crate-ci/typos action to v1.50.3 (#11023) by @​renovate[bot]
• deps: update test262 submodule for tests (#11022) by @​rolldown-guard[bot]
• deps: update rollup submodule for tests to v4.63.5 (#11021) by @​rolldown-guard[bot]
• deps: update dependency vite-plus to v1 (#11017) by @​renovate[bot]
• deps: update github actions (#11010) by @​renovate[bot]
• remove CLAUDE.md (#10925) by @​iiio2
• verify release debug info by matching file IDs (#10988) by @​IWANABETHATGUY
• deps: update rollup submodule for tests to v4.63.4 (#10940) by @​rolldown-guard[bot]

❤️ New Contributors

• @​waltuov made their first contribution in #10986
• @​linyiru made their first contribution in #11014
• @​sep2 made their first contribution in #10992

Co-authored-by: shulaoda 165626830+shulaoda@​users.noreply.github.com

@rolldown/binding-darwin-arm64 — 1.2.11 → 1.2.12 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v1.2.12

[1.2.12] - 2026-09-30

🚀 Features

• inline common chunks containing import() and deduplicate shared code in lazy chunks (#11034) by @​hyfdev
• experimental inlineCommonChunks support (#10899) by @​hyfdev
• dev: ship imported bindings for HMR partial accept (#10856) by @​h-a-n-a

🐛 Bug Fixes

• chunking: re-derive chunk exec orders after the runtime leaves its host chunk (#11005) by @​hyfdev
• code-splitting: gate member-read init paths on the reading statement (#11039) by @​hyfdev
• code-splitting: retain initialization paths through re-exported namespaces (#11037) by @​hyfdev
• dev: reject non-ESM output formats in dev mode (#11038) by @​h-a-n-a
• dev: align import.meta.hot.accept deps with Vite (#10997) by @​h-a-n-a
• dev: clear the resolver cache when a file is created or deleted (#10986) by @​waltuov
• error: name the resolved specifier in unresolved import diagnostics (#11014) by @​linyiru
• make entries-aware chunk merging deterministic (#11002) by @​hyfdev
• watch: avoid restarting macOS watcher for unchanged paths (#10992) by @​sep2

🚜 Refactor

• dev: ship the dev runtime entry as one file (#10998) by @​h-a-n-a
• binding: remove __internalForcePanic (#10989) by @​IWANABETHATGUY

📚 Documentation

• fix cloudflare preview builds (#10996) by @​sapphi-red
• fix build config loader warning (#10994) by @​sapphi-red
• deps: use Vite 8 (#10993) by @​sapphi-red

⚡ Performance

• dev: only ship rows with dynamic edges in registerGraph (#11019) by @​h-a-n-a

🧪 Testing

• code-splitting: cover more re-exported namespace shapes (#11042) by @​hyfdev
• webcontainer: cover the WebContainer download fallback in plain Node (#10966) by @​shulaoda
• dev: pin the runtime entry file layout that Vite serves (#10983) by @​h-a-n-a

⚙️ Miscellaneous Tasks

• pin VOID_API_URL for the docs deploy (#11041) by @​shulaoda
• opt into the WebContainer smoke test for napi bumps and loader changes (#10967) by @​shulaoda
• deps: upgrade oxc to 0.152.0 (#11018) by @​camc314
• deps: update rust crates (#11012) by @​renovate[bot]
• deps: update npm packages (#11011) by @​renovate[bot]
• deps: update crate-ci/typos action to v1.50.3 (#11023) by @​renovate[bot]
• deps: update test262 submodule for tests (#11022) by @​rolldown-guard[bot]
• deps: update rollup submodule for tests to v4.63.5 (#11021) by @​rolldown-guard[bot]
• deps: update dependency vite-plus to v1 (#11017) by @​renovate[bot]
• deps: update github actions (#11010) by @​renovate[bot]
• remove CLAUDE.md (#10925) by @​iiio2
• verify release debug info by matching file IDs (#10988) by @​IWANABETHATGUY
• deps: update rollup submodule for tests to v4.63.4 (#10940) by @​rolldown-guard[bot]

❤️ New Contributors

• @​waltuov made their first contribution in #10986
• @​linyiru made their first contribution in #11014
• @​sep2 made their first contribution in #10992

Co-authored-by: shulaoda 165626830+shulaoda@​users.noreply.github.com

@rolldown/binding-darwin-x64 — 1.2.11 → 1.2.12 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v1.2.12

[1.2.12] - 2026-09-30

🚀 Features

• inline common chunks containing import() and deduplicate shared code in lazy chunks (#11034) by @​hyfdev
• experimental inlineCommonChunks support (#10899) by @​hyfdev
• dev: ship imported bindings for HMR partial accept (#10856) by @​h-a-n-a

🐛 Bug Fixes

• chunking: re-derive chunk exec orders after the runtime leaves its host chunk (#11005) by @​hyfdev
• code-splitting: gate member-read init paths on the reading statement (#11039) by @​hyfdev
• code-splitting: retain initialization paths through re-exported namespaces (#11037) by @​hyfdev
• dev: reject non-ESM output formats in dev mode (#11038) by @​h-a-n-a
• dev: align import.meta.hot.accept deps with Vite (#10997) by @​h-a-n-a
• dev: clear the resolver cache when a file is created or deleted (#10986) by @​waltuov
• error: name the resolved specifier in unresolved import diagnostics (#11014) by @​linyiru
• make entries-aware chunk merging deterministic (#11002) by @​hyfdev
• watch: avoid restarting macOS watcher for unchanged paths (#10992) by @​sep2

🚜 Refactor

• dev: ship the dev runtime entry as one file (#10998) by @​h-a-n-a
• binding: remove __internalForcePanic (#10989) by @​IWANABETHATGUY

📚 Documentation

• fix cloudflare preview builds (#10996) by @​sapphi-red
• fix build config loader warning (#10994) by @​sapphi-red
• deps: use Vite 8 (#10993) by @​sapphi-red

⚡ Performance

• dev: only ship rows with dynamic edges in registerGraph (#11019) by @​h-a-n-a

🧪 Testing

• code-splitting: cover more re-exported namespace shapes (#11042) by @​hyfdev
• webcontainer: cover the WebContainer download fallback in plain Node (#10966) by @​shulaoda
• dev: pin the runtime entry file layout that Vite serves (#10983) by @​h-a-n-a

⚙️ Miscellaneous Tasks

• pin VOID_API_URL for the docs deploy (#11041) by @​shulaoda
• opt into the WebContainer smoke test for napi bumps and loader changes (#10967) by @​shulaoda
• deps: upgrade oxc to 0.152.0 (#11018) by @​camc314
• deps: update rust crates (#11012) by @​renovate[bot]
• deps: update npm packages (#11011) by @​renovate[bot]
• deps: update crate-ci/typos action to v1.50.3 (#11023) by @​renovate[bot]
• deps: update test262 submodule for tests (#11022) by @​rolldown-guard[bot]
• deps: update rollup submodule for tests to v4.63.5 (#11021) by @​rolldown-guard[bot]
• deps: update dependency vite-plus to v1 (#11017) by @​renovate[bot]
• deps: update github actions (#11010) by @​renovate[bot]
• remove CLAUDE.md (#10925) by @​iiio2
• verify release debug info by matching file IDs (#10988) by @​IWANABETHATGUY
• deps: update rollup submodule for tests to v4.63.4 (#10940) by @​rolldown-guard[bot]

❤️ New Contributors

• @​waltuov made their first contribution in #10986
• @​linyiru made their first contribution in #11014
• @​sep2 made their first contribution in #10992

Co-authored-by: shulaoda 165626830+shulaoda@​users.noreply.github.com

@rolldown/binding-freebsd-x64 — 1.2.11 → 1.2.12 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v1.2.12

[1.2.12] - 2026-09-30

🚀 Features

• inline common chunks containing import() and deduplicate shared code in lazy chunks (#11034) by @​hyfdev
• experimental inlineCommonChunks support (#10899) by @​hyfdev
• dev: ship imported bindings for HMR partial accept (#10856) by @​h-a-n-a

🐛 Bug Fixes

• chunking: re-derive chunk exec orders after the runtime leaves its host chunk (#11005) by @​hyfdev
• code-splitting: gate member-read init paths on the reading statement (#11039) by @​hyfdev
• code-splitting: retain initialization paths through re-exported namespaces (#11037) by @​hyfdev
• dev: reject non-ESM output formats in dev mode (#11038) by @​h-a-n-a
• dev: align import.meta.hot.accept deps with Vite (#10997) by @​h-a-n-a
• dev: clear the resolver cache when a file is created or deleted (#10986) by @​waltuov
• error: name the resolved specifier in unresolved import diagnostics (#11014) by @​linyiru
• make entries-aware chunk merging deterministic (#11002) by @​hyfdev
• watch: avoid restarting macOS watcher for unchanged paths (#10992) by @​sep2

🚜 Refactor

• dev: ship the dev runtime entry as one file (#10998) by @​h-a-n-a
• binding: remove __internalForcePanic (#10989) by @​IWANABETHATGUY

📚 Documentation

• fix cloudflare preview builds (#10996) by @​sapphi-red
• fix build config loader warning (#10994) by @​sapphi-red
• deps: use Vite 8 (#10993) by @​sapphi-red

⚡ Performance

• dev: only ship rows with dynamic edges in registerGraph (#11019) by @​h-a-n-a

🧪 Testing

• code-splitting: cover more re-exported namespace shapes (#11042) by @​hyfdev
• webcontainer: cover the WebContainer download fallback in plain Node (#10966) by @​shulaoda
• dev: pin the runtime entry file layout that Vite serves (#10983) by @​h-a-n-a

⚙️ Miscellaneous Tasks

• pin VOID_API_URL for the docs deploy (#11041) by @​shulaoda
• opt into the WebContainer smoke test for napi bumps and loader changes (#10967) by @​shulaoda
• deps: upgrade oxc to 0.152.0 (#11018) by @​camc314
• deps: update rust crates (#11012) by @​renovate[bot]
• deps: update npm packages (#11011) by @​renovate[bot]
• deps: update crate-ci/typos action to v1.50.3 (#11023) by @​renovate[bot]
• deps: update test262 submodule for tests (#11022) by @​rolldown-guard[bot]
• deps: update rollup submodule for tests to v4.63.5 (#11021) by @​rolldown-guard[bot]
• deps: update dependency vite-plus to v1 (#11017) by @​renovate[bot]
• deps: update github actions (#11010) by @​renovate[bot]
• remove CLAUDE.md (#10925) by @​iiio2
• verify release debug info by matching file IDs (#10988) by @​IWANABETHATGUY
• deps: update rollup submodule for tests to v4.63.4 (#10940) by @​rolldown-guard[bot]

❤️ New Contributors

• @​waltuov made their first contribution in #10986
• @​linyiru made their first contribution in #11014
• @​sep2 made their first contribution in #10992

Co-authored-by: shulaoda 165626830+shulaoda@​users.noreply.github.com

@rolldown/binding-linux-arm-gnueabihf — 1.2.11 → 1.2.12 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v1.2.12

[1.2.12] - 2026-09-30

🚀 Features

• inline common chunks containing import() and deduplicate shared code in lazy chunks (#11034) by @​hyfdev
• experimental inlineCommonChunks support (#10899) by @​hyfdev
• dev: ship imported bindings for HMR partial accept (#10856) by @​h-a-n-a

🐛 Bug Fixes

• chunking: re-derive chunk exec orders after the runtime leaves its host chunk (#11005) by @​hyfdev
• code-splitting: gate member-read init paths on the reading statement (#11039) by @​hyfdev
• code-splitting: retain initialization paths through re-exported namespaces (#11037) by @​hyfdev
• dev: reject non-ESM output formats in dev mode (#11038) by @​h-a-n-a
• dev: align import.meta.hot.accept deps with Vite (#10997) by @​h-a-n-a
• dev: clear the resolver cache when a file is created or deleted (#10986) by @​waltuov
• error: name the resolved specifier in unresolved import diagnostics (#11014) by @​linyiru
• make entries-aware chunk merging deterministic (#11002) by @​hyfdev
• watch: avoid restarting macOS watcher for unchanged paths (#10992) by @​sep2

🚜 Refactor

• dev: ship the dev runtime entry as one file (#10998) by @​h-a-n-a
• binding: remove __internalForcePanic (#10989) by @​IWANABETHATGUY

📚 Documentation

• fix cloudflare preview builds (#10996) by @​sapphi-red
• fix build config loader warning (#10994) by @​sapphi-red
• deps: use Vite 8 (#10993) by @​sapphi-red

⚡ Performance

• dev: only ship rows with dynamic edges in registerGraph (#11019) by @​h-a-n-a

🧪 Testing

• code-splitting: cover more re-exported namespace shapes (#11042) by @​hyfdev
• webcontainer: cover the WebContainer download fallback in plain Node (#10966) by @​shulaoda
• dev: pin the runtime entry file layout that Vite serves (#10983) by @​h-a-n-a

⚙️ Miscellaneous Tasks

• pin VOID_API_URL for the docs deploy (#11041) by @​shulaoda
• opt into the WebContainer smoke test for napi bumps and loader changes (#10967) by @​shulaoda
• deps: upgrade oxc to 0.152.0 (#11018) by @​camc314
• deps: update rust crates (#11012) by @​renovate[bot]
• deps: update npm packages (#11011) by @​renovate[bot]
• deps: update crate-ci/typos action to v1.50.3 (#11023) by @​renovate[bot]
• deps: update test262 submodule for tests (#11022) by @​rolldown-guard[bot]
• deps: update rollup submodule for tests to v4.63.5 (#11021) by @​rolldown-guard[bot]
• deps: update dependency vite-plus to v1 (#11017) by @​renovate[bot]
• deps: update github actions (#11010) by @​renovate[bot]
• remove CLAUDE.md (#10925) by @​iiio2
• verify release debug info by matching file IDs (#10988) by @​IWANABETHATGUY
• deps: update rollup submodule for tests to v4.63.4 (#10940) by @​rolldown-guard[bot]

❤️ New Contributors

• @​waltuov made their first contribution in #10986
• @​linyiru made their first contribution in #11014
• @​sep2 made their first contribution in #10992

Co-authored-by: shulaoda 165626830+shulaoda@​users.noreply.github.com

@rolldown/binding-linux-arm64-gnu — 1.2.11 → 1.2.12 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v1.2.12

[1.2.12] - 2026-09-30

🚀 Features

• inline common chunks containing import() and deduplicate shared code in lazy chunks (#11034) by @​hyfdev
• experimental inlineCommonChunks support (#10899) by @​hyfdev
• dev: ship imported bindings for HMR partial accept (#10856) by @​h-a-n-a

🐛 Bug Fixes

• chunking: re-derive chunk exec orders after the runtime leaves its host chunk (#11005) by @​hyfdev
• code-splitting: gate member-read init paths on the reading statement (#11039) by @​hyfdev
• code-splitting: retain initialization paths through re-exported namespaces (#11037) by @​hyfdev
• dev: reject non-ESM output formats in dev mode (#11038) by @​h-a-n-a
• dev: align import.meta.hot.accept deps with Vite (#10997) by @​h-a-n-a
• dev: clear the resolver cache when a file is created or deleted (#10986) by @​waltuov
• error: name the resolved specifier in unresolved import diagnostics (#11014) by @​linyiru
• make entries-aware chunk merging deterministic (#11002) by @​hyfdev
• watch: avoid restarting macOS watcher for unchanged paths (#10992) by @​sep2

🚜 Refactor

• dev: ship the dev runtime entry as one file (#10998) by @​h-a-n-a
• binding: remove __internalForcePanic (#10989) by @​IWANABETHATGUY

📚 Documentation

• fix cloudflare preview builds (#10996) by @​sapphi-red
• fix build config loader warning (#10994) by @​sapphi-red
• deps: use Vite 8 (#10993) by @​sapphi-red

⚡ Performance

• dev: only ship rows with dynamic edges in registerGraph (#11019) by @​h-a-n-a

🧪 Testing

• code-splitting: cover more re-exported namespace shapes (#11042) by @​hyfdev
• webcontainer: cover the WebContainer download fallback in plain Node (#10966) by @​shulaoda
• dev: pin the runtime entry file layout that Vite serves (#10983) by @​h-a-n-a

⚙️ Miscellaneous Tasks

• pin VOID_API_URL for the docs deploy (#11041) by @​shulaoda
• opt into the WebContainer smoke test for napi bumps and loader changes (#10967) by @​shulaoda
• deps: upgrade oxc to 0.152.0 (#11018) by @​camc314
• deps: update rust crates (#11012) by @​renovate[bot]
• deps: update npm packages (#11011) by @​renovate[bot]
• deps: update crate-ci/typos action to v1.50.3 (#11023) by @​renovate[bot]
• deps: update test262 submodule for tests (#11022) by @​rolldown-guard[bot]
• deps: update rollup submodule for tests to v4.63.5 (#11021) by @​rolldown-guard[bot]
• deps: update dependency vite-plus to v1 (#11017) by @​renovate[bot]
• deps: update github actions (#11010) by @​renovate[bot]
• remove CLAUDE.md (#10925) by @​iiio2
• verify release debug info by matching file IDs (#10988) by @​IWANABETHATGUY
• deps: update rollup submodule for tests to v4.63.4 (#10940) by @​rolldown-guard[bot]

❤️ New Contributors

• @​waltuov made their first contribution in #10986
• @​linyiru made their first contribution in #11014
• @​sep2 made their first contribution in #10992

Co-authored-by: shulaoda 165626830+shulaoda@​users.noreply.github.com

@rolldown/binding-linux-arm64-musl — 1.2.11 → 1.2.12 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v1.2.12

[1.2.12] - 2026-09-30

🚀 Features

• inline common chunks containing import() and deduplicate shared code in lazy chunks (#11034) by @​hyfdev
• experimental inlineCommonChunks support (#10899) by @​hyfdev
• dev: ship imported bindings for HMR partial accept (#10856) by @​h-a-n-a

🐛 Bug Fixes

• chunking: re-derive chunk exec orders after the runtime leaves its host chunk (#11005) by @​hyfdev
• code-splitting: gate member-read init paths on the reading statement (#11039) by @​hyfdev
• code-splitting: retain initialization paths through re-exported namespaces (#11037) by @​hyfdev
• dev: reject non-ESM output formats in dev mode (#11038) by @​h-a-n-a
• dev: align import.meta.hot.accept deps with Vite (#10997) by @​h-a-n-a
• dev: clear the resolver cache when a file is created or deleted (#10986) by @​waltuov
• error: name the resolved specifier in unresolved import diagnostics (#11014) by @​linyiru
• make entries-aware chunk merging deterministic (#11002) by @​hyfdev
• watch: avoid restarting macOS watcher for unchanged paths (#10992) by @​sep2

🚜 Refactor

• dev: ship the dev runtime entry as one file (#10998) by @​h-a-n-a
• binding: remove __internalForcePanic (#10989) by @​IWANABETHATGUY

📚 Documentation

• fix cloudflare preview builds (#10996) by @​sapphi-red
• fix build config loader warning (#10994) by @​sapphi-red
• deps: use Vite 8 (#10993) by @​sapphi-red

⚡ Performance

• dev: only ship rows with dynamic edges in registerGraph (#11019) by @​h-a-n-a

🧪 Testing

• code-splitting: cover more re-exported namespace shapes (#11042) by @​hyfdev
• webcontainer: cover the WebContainer download fallback in plain Node (#10966) by @​shulaoda
• dev: pin the runtime entry file layout that Vite serves (#10983) by @​h-a-n-a

⚙️ Miscellaneous Tasks

• pin VOID_API_URL for the docs deploy (#11041) by @​shulaoda
• opt into the WebContainer smoke test for napi bumps and loader changes (#10967) by @​shulaoda
• deps: upgrade oxc to 0.152.0 (#11018) by @​camc314
• deps: update rust crates (#11012) by @​renovate[bot]
• deps: update npm packages (#11011) by @​renovate[bot]
• deps: update crate-ci/typos action to v1.50.3 (#11023) by @​renovate[bot]
• deps: update test262 submodule for tests (#11022) by @​rolldown-guard[bot]
• deps: update rollup submodule for tests to v4.63.5 (#11021) by @​rolldown-guard[bot]
• deps: update dependency vite-plus to v1 (#11017) by @​renovate[bot]
• deps: update github actions (#11010) by @​renovate[bot]
• remove CLAUDE.md (#10925) by @​iiio2
• verify release debug info by matching file IDs (#10988) by @​IWANABETHATGUY
• deps: update rollup submodule for tests to v4.63.4 (#10940) by @​rolldown-guard[bot]

❤️ New Contributors

• @​waltuov made their first contribution in #10986
• @​linyiru made their first contribution in #11014
• @​sep2 made their first contribution in #10992

Co-authored-by: shulaoda 165626830+shulaoda@​users.noreply.github.com

@rolldown/binding-linux-ppc64-gnu — 1.2.11 → 1.2.12 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v1.2.12

[1.2.12] - 2026-09-30

🚀 Features

• inline common chunks containing import() and deduplicate shared code in lazy chunks (#11034) by @​hyfdev
• experimental inlineCommonChunks support (#10899) by @​hyfdev
• dev: ship imported bindings for HMR partial accept (#10856) by @​h-a-n-a

🐛 Bug Fixes

• chunking: re-derive chunk exec orders after the runtime leaves its host chunk (#11005) by @​hyfdev
• code-splitting: gate member-read init paths on the reading statement (#11039) by @​hyfdev
• code-splitting: retain initialization paths through re-exported namespaces (#11037) by @​hyfdev
• dev: reject non-ESM output formats in dev mode (#11038) by @​h-a-n-a
• dev: align import.meta.hot.accept deps with Vite (#10997) by @​h-a-n-a
• dev: clear the resolver cache when a file is created or deleted (#10986) by @​waltuov
• error: name the resolved specifier in unresolved import diagnostics (#11014) by @​linyiru
• make entries-aware chunk merging deterministic (#11002) by @​hyfdev
• watch: avoid restarting macOS watcher for unchanged paths (#10992) by @​sep2

🚜 Refactor

• dev: ship the dev runtime entry as one file (#10998) by @​h-a-n-a
• binding: remove __internalForcePanic (#10989) by @​IWANABETHATGUY

📚 Documentation

• fix cloudflare preview builds (#10996) by @​sapphi-red
• fix build config loader warning (#10994) by @​sapphi-red
• deps: use Vite 8 (#10993) by @​sapphi-red

⚡ Performance

• dev: only ship rows with dynamic edges in registerGraph (#11019) by @​h-a-n-a

🧪 Testing

• code-splitting: cover more re-exported namespace shapes (#11042) by @​hyfdev
• webcontainer: cover the WebContainer download fallback in plain Node (#10966) by @​shulaoda
• dev: pin the runtime entry file layout that Vite serves (#10983) by @​h-a-n-a

⚙️ Miscellaneous Tasks

• pin VOID_API_URL for the docs deploy (#11041) by @​shulaoda
• opt into the WebContainer smoke test for napi bumps and loader changes (#10967) by @​shulaoda
• deps: upgrade oxc to 0.152.0 (#11018) by @​camc314
• deps: update rust crates (#11012) by @​renovate[bot]
• deps: update npm packages (#11011) by @​renovate[bot]
• deps: update crate-ci/typos action to v1.50.3 (#11023) by @​renovate[bot]
• deps: update test262 submodule for tests (#11022) by @​rolldown-guard[bot]
• deps: update rollup submodule for tests to v4.63.5 (#11021) by @​rolldown-guard[bot]
• deps: update dependency vite-plus to v1 (#11017) by @​renovate[bot]
• deps: update github actions (#11010) by @​renovate[bot]
• remove CLAUDE.md (#10925) by @​iiio2
• verify release debug info by matching file IDs (#10988) by @​IWANABETHATGUY
• deps: update rollup submodule for tests to v4.63.4 (#10940) by @​rolldown-guard[bot]

❤️ New Contributors

• @​waltuov made their first contribution in #10986
• @​linyiru made their first contribution in #11014
• @​sep2 made their first contribution in #10992

Co-authored-by: shulaoda 165626830+shulaoda@​users.noreply.github.com

@rolldown/binding-linux-s390x-gnu — 1.2.11 → 1.2.12 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v1.2.12

[1.2.12] - 2026-09-30

🚀 Features

• inline common chunks containing import() and deduplicate shared code in lazy chunks (#11034) by @​hyfdev
• experimental inlineCommonChunks support (#10899) by @​hyfdev
• dev: ship imported bindings for HMR partial accept (#10856) by @​h-a-n-a

🐛 Bug Fixes

• chunking: re-derive chunk exec orders after the runtime leaves its host chunk (#11005) by @​hyfdev
• code-splitting: gate member-read init paths on the reading statement (#11039) by @​hyfdev
• code-splitting: retain initialization paths through re-exported namespaces (#11037) by @​hyfdev
• dev: reject non-ESM output formats in dev mode (#11038) by @​h-a-n-a
• dev: align import.meta.hot.accept deps with Vite (#10997) by @​h-a-n-a
• dev: clear the resolver cache when a file is created or deleted (#10986) by @​waltuov
• error: name the resolved specifier in unresolved import diagnostics (#11014) by @​linyiru
• make entries-aware chunk merging deterministic (#11002) by @​hyfdev
• watch: avoid restarting macOS watcher for unchanged paths (#10992) by @​sep2

🚜 Refactor

• dev: ship the dev runtime entry as one file (#10998) by @​h-a-n-a
• binding: remove __internalForcePanic (#10989) by @​IWANABETHATGUY

📚 Documentation

• fix cloudflare preview builds (#10996) by @​sapphi-red
• fix build config loader warning (#10994) by @​sapphi-red
• deps: use Vite 8 (#10993) by @​sapphi-red

⚡ Performance

• dev: only ship rows with dynamic edges in registerGraph (#11019) by @​h-a-n-a

🧪 Testing

• code-splitting: cover more re-exported namespace shapes (#11042) by @​hyfdev
• webcontainer: cover the WebContainer download fallback in plain Node (#10966) by @​shulaoda
• dev: pin the runtime entry file layout that Vite serves (#10983) by @​h-a-n-a

⚙️ Miscellaneous Tasks

• pin VOID_API_URL for the docs deploy (#11041) by @​shulaoda
• opt into the WebContainer smoke test for napi bumps and loader changes (#10967) by @​shulaoda
• deps: upgrade oxc to 0.152.0 (#11018) by @​camc314
• deps: update rust crates (#11012) by @​renovate[bot]
• deps: update npm packages (#11011) by @​renovate[bot]
• deps: update crate-ci/typos action to v1.50.3 (#11023) by @​renovate[bot]
• deps: update test262 submodule for tests (#11022) by @​rolldown-guard[bot]
• deps: update rollup submodule for tests to v4.63.5 (#11021) by @​rolldown-guard[bot]
• deps: update dependency vite-plus to v1 (#11017) by @​renovate[bot]
• deps: update github actions (#11010) by @​renovate[bot]
• remove CLAUDE.md (#10925) by @​iiio2
• verify release debug info by matching file IDs (#10988) by @​IWANABETHATGUY
• deps: update rollup submodule for tests to v4.63.4 (#10940) by @​rolldown-guard[bot]

❤️ New Contributors

• @​waltuov made their first contribution in #10986
• @​linyiru made their first contribution in #11014
• @​sep2 made their first contribution in #10992

Co-authored-by: shulaoda 165626830+shulaoda@​users.noreply.github.com

@rolldown/binding-linux-x64-gnu — 1.2.11 → 1.2.12 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

@rolldown/binding-linux-x64-musl — 1.2.11 → 1.2.12 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

@rolldown/binding-openharmony-arm64 — 1.2.11 → 1.2.12 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

@rolldown/binding-win32-arm64-msvc — 1.2.11 → 1.2.12 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

@rolldown/binding-win32-x64-msvc — 1.2.11 → 1.2.12 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

chai — 6.2.2 → 6.3.0 (1 release)

Back to version changes · Compare · Releases

hono — 4.13.12 → 4.13.13 (1 release)

Back to version changes · Compare · Releases

v4.13.13

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'
const ittyRouter = IttyRouter()

ittyRouter.get('/hello', () => new Response('Hello from itty-router'))
const app = new Hono()

app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

• test(client): simulate network error for undefined route in parseResponse test in test(client): simulate network error for undefined route in parseResponse test honojs/hono#5439
• docs(request): fix jsdoc comments for some getters in docs(request): fix jsdoc comments for some getters honojs/hono#5445
• fix(jsx): allow JSXNode function component results in fix(jsx): allow JSXNode function component results honojs/hono#5476
• feat(mount): introduce Mount Middleware and deprecate app.mount in feat(mount): introduce Mount Middleware and deprecate app.mount honojs/hono#5221

Full Changelog: honojs/hono@v4.13.12...v4.13.13

nanoid — 3.3.19 → 3.3.20 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

3.3.20

• Fixed types (by @​johnemau).

postcss — 8.5.28 → 8.5.29 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

rolldown — 1.2.11 → 1.2.12 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

source-map-js — 1.2.1 → 1.2.2 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v1.2.2

• Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @​xfournet

• Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

  Reported by @​waydeshi in #76. A fix was also proposed by @​aniebiet in #78.

tinyrainbow — 3.1.1 → 3.2.0 (1 release)

Back to version changes · Compare · Releases

vite — 8.3.2 → 8.3.3 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

Report truncated to fit the PR body limit. See Releases for omitted notes and the file diff for remaining changes.

Rebase

• Rebase this PR by regenerating lockfiles from the latest base branch.

Check the box above or post a new PR comment with /lockfile rebase on its own line. Requires repository write access.

Workflow requirements and manual fallback

Enable App-based rebase handling with rebase: true in .github/lockfile-maintenance-auth.yml, or configure an Actions request handler as described below.

For Actions-based handling, the workflow must subscribe to pull_request_target: types: [edited] for the checkbox and issue_comment: types: [created] for comments, and configure the request-rebase job.
If these handlers are not configured, open the maintenance workflow and select Run workflow on the branch used for maintenance. This requires workflow_dispatch.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-10-09 18:12 UTC · Rule: dependency-updates · triggered by merge protections
• ✅ Checks passed · on draft merge queue: checking #208 on main (01b1e51) #210
• ✅ Merged — 2026-10-09 18:25 UTC · at 48379c0aaca284737cc2a1531ff0502983d44416 · merge-batch via merge queue: checking #208 on main (01b1e51) #210

This pull request spent 13 minutes in the queue, including 2 minutes 10 seconds running CI.

Required conditions to merge

• #approved-reviews-by >= 1
  • Lockfile maintenance #208
• github-review-approved [🛡 GitHub repository ruleset rule main]
  • Lockfile maintenance #208
• any of [🛡 GitHub repository ruleset rule main]:
  • check-success = @github-actions/test
  • check-neutral = @github-actions/test
  • check-skipped = @github-actions/test