Bump the npm_and_yarn group across 13 directories with 17 updates

[dependabot]

Bumps the npm_and_yarn group with 7 updates in the /astro-fastify directory:

Package	From	To
@astrojs/node	8.2.5	10.0.0
@fastify/middie	8.3.0	9.2.0
astro	4.5.9	5.18.1
fastify	4.26.2	5.8.3
brace-expansion	2.0.1	2.0.3
minimatch	5.1.6	5.1.9
undici	5.28.3	5.29.0

Bumps the npm_and_yarn group with 5 updates in the /astro-fastify-ssg directory:

Package	From	To
astro	4.5.9	5.18.1
fastify	4.26.2	5.8.3
brace-expansion	2.0.1	2.0.3
minimatch	5.1.6	5.1.9
undici	5.28.3	5.29.0

Bumps the npm_and_yarn group with 7 updates in the /eslint-plugin-tailwindcss directory:

Package	From	To
ajv	6.12.6	6.14.0
brace-expansion	1.1.11	1.1.13
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
rollup	4.13.0	4.60.1
flatted	3.3.1	3.4.2
yaml	2.4.1	2.8.3

Bumps the npm_and_yarn group with 2 updates in the /fastify-http-errors-enhanced directory: fastify and ajv.
Bumps the npm_and_yarn group with 1 update in the /hono directory: hono.
Bumps the npm_and_yarn group with 4 updates in the /jest directory: ajv, brace-expansion, minimatch and picomatch.
Bumps the npm_and_yarn group with 5 updates in the /kita directory:

Package	From	To
fastify	4.26.2	5.8.3
brace-expansion	1.1.11	1.1.13
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
yaml	2.4.1	2.8.3

Bumps the npm_and_yarn group with 1 update in the /media-capture directory: brace-expansion.
Bumps the npm_and_yarn group with 2 updates in the /npm-run-script directory: brace-expansion and minimatch.
Bumps the npm_and_yarn group with 1 update in the /use-swr directory: ajv.
Bumps the npm_and_yarn group with 5 updates in the /vad directory:

Package	From	To
ajv	6.12.4	6.14.0
brace-expansion	1.1.11	1.1.13
minimatch	3.0.4	3.1.5
picomatch	2.2.2	2.3.2
next	9.5.2	15.5.14

Bumps the npm_and_yarn group with 4 updates in the /vercel-fastify directory: fastify, brace-expansion, minimatch and picomatch.
Bumps the npm_and_yarn group with 5 updates in the /wxt directory:

Package	From	To
brace-expansion	2.0.1	2.0.3
brace-expansion	1.1.11	1.1.13
minimatch	9.0.3	9.0.9
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
rollup	4.12.1	4.60.1
tar	6.2.0	removed

Updates @astrojs/node from 8.2.5 to 10.0.0

Release notes

Sourced from @​astrojs/node's releases.

@​astrojs/node@​10.0.0

Major Changes

• #15654 a32aee6 Thanks @​florian-lefebvre! - Removes the experimentalErrorPageHost option

  This option allowed fetching a prerendered error page from a different host than the server is currently running on.

  However, there can be security implications with prefetching from other hosts, and often more customization was required to do this safely. This has now been removed as a built-in option so that you can implement your own secure solution as needed and appropriate for your project via middleware.

  What should I do?

  If you were previously using this feature, you must remove the option from your adapter configuration as it no longer exists:

  // astro.config.mjs
  import { defineConfig } from 'astro/config'
  import node from '@astrojs/node'
  export default defineConfig({
  adapter: node({
  mode: 'standalone',
  
  experimentalErrorPageHost: 'http://localhost:4321'
  })
  })

You can replicate the previous behavior by checking the response status in a middleware and fetching the prerendered page yourself:

// src/middleware.ts
import { defineMiddleware } from 'astro:middleware';
export const onRequest = defineMiddleware(async (ctx, next) => {
const response = await next();
if (response.status === 404 || response.status === 500) {
return fetch(http://localhost:4321/${response.status}.html);
}
return response;
});

Minor Changes

• #15258 d339a18 Thanks @​ematipico! - Stabilizes the adapter feature experimentalStatiHeaders. If you were using this feature in any of the supported adapters, you'll need to change the name of the flag:

  export default defineConfig({
    adapter: netlify({
  -    experimentalStaticHeaders: true
  +    staticHeaders: true

... (truncated)

Changelog

Sourced from @​astrojs/node's changelog.

10.0.0

Major Changes

• #15654 a32aee6 Thanks @​florian-lefebvre! - Removes the experimentalErrorPageHost option

  This option allowed fetching a prerendered error page from a different host than the server is currently running on.

  However, there can be security implications with prefetching from other hosts, and often more customization was required to do this safely. This has now been removed as a built-in option so that you can implement your own secure solution as needed and appropriate for your project via middleware.

  What should I do?

  If you were previously using this feature, you must remove the option from your adapter configuration as it no longer exists:

  // astro.config.mjs
  import { defineConfig } from 'astro/config'
  import node from '@astrojs/node'
  export default defineConfig({
  adapter: node({
  mode: 'standalone',
  
  experimentalErrorPageHost: 'http://localhost:4321'
  })
  })

You can replicate the previous behavior by checking the response status in a middleware and fetching the prerendered page yourself:

// src/middleware.ts
import { defineMiddleware } from 'astro:middleware';
export const onRequest = defineMiddleware(async (ctx, next) => {
const response = await next();
if (response.status === 404 || response.status === 500) {
return fetch(http://localhost:4321/${response.status}.html);
}
return response;
});

Minor Changes

• #15258 d339a18 Thanks @​ematipico! - Stabilizes the adapter feature experimentalStatiHeaders. If you were using this feature in any of the supported adapters, you'll need to change the name of the flag:

  export default defineConfig({
    adapter: netlify({
  -    experimentalStaticHeaders: true

... (truncated)

Commits

• 48e5c4d [ci] release (#15808)
• 2ce9e74 chore: update docs links (#15732)
• 25560db [ci] release (beta) (#15773)
• 39ff2a5 Harden Node adapter HTTP server defaults and request body handling (#15759)
• 6414732 Spelling (#15601)
• 1567e8c Normalize static file paths before evaluating dotfile access rules (#15763)
• 02e24d9 Harden origin check port handling for consistency (#15777)
• 9b0def6 [ci] release (beta) (#15758)
• 3885e8d [ci] release (beta) (#15687)
• 20b05c0 fix(node): harden static file handler path resolution (#15745)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​astrojs/node since your current version.

Updates @fastify/middie from 8.3.0 to 9.2.0

Release notes

Sourced from @​fastify/middie's releases.

v9.2.0

⚠️ Security Release

Fixes GHSA-8p85-9qpw-fwgw

What's Changed

• ci: remove stale.yml by @​Tony133 in fastify/middie#247

New Contributors

• @​Tony133 made their first contribution in fastify/middie#247

Full Changelog: fastify/middie@v9.1.0...v9.2.0

v9.1.0

What's Changed

• build(dependabot): reduce npm updates to monthly by @​Fdawgs in fastify/middie#228
• chore: rename master to main by @​Fdawgs in fastify/middie#230
• ci(ci): set job permissions by @​Fdawgs in fastify/middie#231
• test: migrate from tap to node:test by @​matteo-gobbo in fastify/middie#229
• chore: remove .taprc by @​Fdawgs in fastify/middie#232
• ci: set permissions at workflow level by @​Fdawgs in fastify/middie#233
• ci: restore job level permissions by @​Fdawgs in fastify/middie#234
• build(deps-dev): bump serve-static from 1.16.2 to 2.2.0 by @​dependabot[bot] in fastify/middie#235
• build(deps-dev): bump tsd from 0.31.2 to 0.32.0 by @​dependabot[bot] in fastify/middie#236
• chore(license): update date ranges; standardise style by @​Fdawgs in fastify/middie#237
• build(deps-dev): bump @​types/node from 22.15.34 to 24.0.8 by @​dependabot[bot] in fastify/middie#238
• chore(tests): removed simple-get by @​ilteoood in fastify/middie#239
• build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by @​dependabot[bot] in fastify/middie#241
• chore(.npmrc): ignore scripts by @​Fdawgs in fastify/middie#242
• build(deps-dev): remove @​fastify/pre-commit by @​Fdawgs in fastify/middie#243
• ci(ci): add concurrency config by @​Fdawgs in fastify/middie#244
• build(deps-dev): bump @​types/node from 24.10.4 to 25.0.3 by @​dependabot[bot] in fastify/middie#246
• fix: decode paths before matching by @​kamilmysliwiec in fastify/middie#245

New Contributors

• @​matteo-gobbo made their first contribution in fastify/middie#229
• @​ilteoood made their first contribution in fastify/middie#239
• @​kamilmysliwiec made their first contribution in fastify/middie#245

Full Changelog: fastify/middie@v9.0.3...v9.1.0

v9.0.3

What's Changed

• build(deps-dev): bump helmet from 7.2.0 to 8.0.0 by @​dependabot in fastify/middie#217
• refactor(lib/engine): replace var with let by @​Fdawgs in fastify/middie#218
• build(deps): bump fastify/workflows from 5.0.0 to 5.0.1 by @​dependabot in fastify/middie#219
• style: remove trailing whitespace by @​Fdawgs in fastify/middie#220
• docs(readme): update ci badge syntax by @​Fdawgs in fastify/middie#221
• build(deps-dev): replace standard with neostandard by @​Fdawgs in fastify/middie#222
• types: use node: prefix for builtins by @​Fdawgs in fastify/middie#223

... (truncated)

Commits

• f9b3e79 Bumped v9.2.0
• 140e0dd fix: harden middie path normalization and matching
• 45c02d0 ci: remove stale.yml (#247)
• 8de54e3 v9.1.0
• d44cd56 fix: decode paths before matching (#245)
• ed987d6 build(deps-dev): bump @​types/node from 24.10.4 to 25.0.3 (#246)
• ca2c812 ci(ci): add concurrency config (#244)
• d405c42 build(deps-dev): remove @​fastify/pre-commit (#243)
• 3c66977 chore(.npmrc): ignore scripts (#242)
• d30c7cc build(deps-dev): bump tsd from 0.32.0 to 0.33.0 (#241)
• Additional commits viewable in compare view

Updates astro from 4.5.9 to 5.18.1

Release notes

Sourced from astro's releases.

astro@5.18.1

Patch Changes

• Updated dependencies [c2cd371]:
  • @​astrojs/internal-helpers@​0.7.6
  • @​astrojs/markdown-remark@​6.3.11

Changelog

Sourced from astro's changelog.

4.16.16

Patch Changes

• #12542 65e50eb Thanks @​kadykov! - Fix JPEG image size determination

• #12525 cf0d8b0 Thanks @​ematipico! - Fixes an issue where with i18n enabled, Astro couldn't render the 404.astro component for nonexistent routes.

4.16.15

Patch Changes

• #12498 b140a3f Thanks @​ematipico! - Fixes a regression where Astro was trying to access Request.headers

4.16.14

Patch Changes

• #12480 c3b7e7c Thanks @​matthewp! - Removes the default throw behavior in astro:env

• #12444 28dd3ce Thanks @​ematipico! - Fixes an issue where a server island hydration script might fail case the island ID misses from the DOM.

• #12476 80a9a52 Thanks @​florian-lefebvre! - Fixes a case where the Content Layer glob() loader would not update when renaming or deleting an entry

• #12418 25baa4e Thanks @​oliverlynch! - Fix cached image redownloading if it is the first asset

• #12477 46f6b38 Thanks @​ematipico! - Fixes an issue where the SSR build was emitting the dist/server/entry.mjs file with an incorrect import at the top of the file/

• #12365 a23985b Thanks @​apatel369! - Fixes an issue where Astro.currentLocale was not correctly returning the locale for 404 and 500 pages.

4.16.13

Patch Changes

• #12436 453ec6b Thanks @​martrapp! - Fixes a potential null access in the clientside router

• #12392 0462219 Thanks @​apatel369! - Fixes an issue where scripts were not correctly injected during the build. The issue was triggered when there were injected routes with the same entrypoint and different pattern

4.16.12

Patch Changes

• #12420 acac0af Thanks @​ematipico! - Fixes an issue where the dev server returns a 404 status code when a user middleware returns a valid Response.

4.16.11

Patch Changes

• #12305 f5f7109 Thanks @​florian-lefebvre! - Fixes a case where the error overlay would not escape the message

... (truncated)

Commits

• 434d9cc [ci] release (#15829)
• c2cd371 fix(helpers): Backport remote patterns segments fix (#15828)
• 011f061 [ci] release (#15597)
• efae11c fix: X-Forwarded-Proto rejected when allowedDomains includes protocol… (#15594)
• 751ccf0 Update actionBodySizeLimit changeset and make minor (#15600)
• b7dd447 make actionBodySizeLimit configurable (#15589)
• e0f1a2b [ci] release (#15571)
• 522f880 Limit action request body size (#15564)
• 436962a chore: Upgrade Vite and esbuild (#15554)
• e01e98b Respect remote image allowlists (#15569)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for astro since your current version.

Updates fastify from 4.26.2 to 5.8.3

Release notes

Sourced from fastify's releases.

v5.8.3

⚠️ Security Release

This fixes CVE CVE-2026-3635 GHSA-444r-cwp2-x5xf.

What's Changed

• docs(readme): add @​Tony133 to plugin team by @​Tony133 in fastify/fastify#6565
• Updated Plugins-Guide.md; Changed "fastify" to "instance" during plugin registration to showcase that it's added as a child by @​kyrylchenko in fastify/fastify#6566
• test: use fastify.test in test case by @​climba03003 in fastify/fastify#6568
• docs: use fastify.example in documentation by @​climba03003 in fastify/fastify#6567
• docs: add common performance degradation guidance by @​maxpetrusenko in fastify/fastify#6520
• docs(server): fix camelCase anchor links in TOC by @​Deepvamja in fastify/fastify#6530
• ci(link-checker): fix root-relative links resolution by @​barba-rossa in fastify/fastify#6535
• docs: update syntax markdown, absolute paths and links by @​Tony133 in fastify/fastify#6569
• docs: clarify content-type parser/schema mismatch is outside threat model by @​mcollina in fastify/fastify#6537
• docs: fix incorrect code examples in Reply and Request reference by @​mahmoodhamdi in fastify/fastify#6582
• docs: replace redirected npm.im http-errors link by @​mcollina in fastify/fastify#6588
• types: Allow port to be null in request type definition by @​TristanBarlow in fastify/fastify#6589
• docs: update links by @​Tony133 in fastify/fastify#6593
• ci(lock-threads): use shared lock-threads workflow by @​Fdawgs in fastify/fastify#6592

New Contributors

• @​kyrylchenko made their first contribution in fastify/fastify#6566
• @​maxpetrusenko made their first contribution in fastify/fastify#6520
• @​Deepvamja made their first contribution in fastify/fastify#6530
• @​barba-rossa made their first contribution in fastify/fastify#6535
• @​mahmoodhamdi made their first contribution in fastify/fastify#6582
• @​TristanBarlow made their first contribution in fastify/fastify#6589

Full Changelog: fastify/fastify@v5.8.2...v5.8.3

v5.8.2

What's Changed

• docs(ecosystem): add @​yeliex/fastify-problem-details by @​yeliex in fastify/fastify#6546
• Revert "chore: upgrade borp to v1.0.0" by @​climba03003 in fastify/fastify#6564
• docs: document body validation with custom content type parsers by @​mcollina in fastify/fastify#6556
• docs(ecosystem): add fastify-file-router by @​bhouston in fastify/fastify#6441
• docs: add fastify-svelte-view to Ecosystem list by @​matths in fastify/fastify#6453
• fix: anchor keyValuePairsReg to prevent quadratic backtracking by @​mcollina in fastify/fastify#6558
• docs: added note on handling of invalid URLs in setNotFoundHandler by @​leftieFriele in fastify/fastify#5661
• docs(guides): update codemod links by @​OluchiEzeifedikwa in fastify/fastify#6479
• docs: add @​glidemq/fastify to community plugins by @​avifenesh in fastify/fastify#6560

New Contributors

• @​yeliex made their first contribution in fastify/fastify#6546
• @​matths made their first contribution in fastify/fastify#6453
• @​leftieFriele made their first contribution in fastify/fastify#5661
• @​OluchiEzeifedikwa made their first contribution in fastify/fastify#6479
• @​avifenesh made their first contribution in fastify/fastify#6560

... (truncated)

Commits

• a3e77ce Bumped v5.8.3
• 4e1db5b fix: gate host and protocol getters on proxy trust function
• a22217f ci(lock-threads): use shared lock-threads workflow (#6592)
• 1851f20 docs: update links (#6593)
• 9cc5187 types: Allow port to be null in request type definition (#6589)
• 722d83b docs: replace redirected npm.im http-errors link (#6588)
• a1413de docs: fix incorrect code examples in Reply and Request reference (#6582)
• d7f01b6 docs: clarify content-type parser/schema mismatch is outside threat model (#6...
• a0649e9 docs: update syntax markdown, absolute paths and links (#6569)
• d477915 ci(link-checker): fix root-relative links resolution (#6535)
• Additional commits viewable in compare view

Updates ajv from 8.12.0 to 8.18.0

Commits

• e3af0a7 6.14.0
• b552ed6 add regExp option to address $data exploit via a regular expression (CVE-2025...
• 72f2286 docs: update v7 info
• 231e52b Merge pull request #1320 from philsturgeon/patch-1
• d3475fc Add spectral, an AJV util from a sponsor
• 413afe0 docs: v7.0.0-beta.3
• 11e997b update readme for v7
• See full diff in compare view

Updates brace-expansion from 2.0.1 to 2.0.3

Release notes

Sourced from brace-expansion's releases.

v2.0.2

• pkg: publish on tag 2.x 14f1d91
• fmt ed7780a
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

---

juliangruber/brace-expansion@v2.0.1...v2.0.2

Commits

• 73b5459 2.0.3
• 311ac0d Backport fix for GHSA-f886-m6hf-6m8v to v2 (#96)
• a3efcee 2.0.2
• 14f1d91 pkg: publish on tag 2.x
• ed7780a fmt
• 36603d5 Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)
• See full diff in compare view

Updates devalue from 4.3.2 to 5.6.4

Release notes

Sourced from devalue's releases.

v5.6.4

Patch Changes

• 87c1f3c: fix: reject __proto__ keys in malformed Object wrapper payloads

  This validates the "Object" parse path and throws when the wrapped value has an own __proto__ key.

• 40f1db1: fix: ensure sparse array indices are integers

• 87c1f3c: fix: disallow __proto__ keys in null-prototype object parsing

  This disallows __proto__ keys in the "null" parse path so null-prototype object hydration cannot carry that key through parse/unflatten.

v5.6.3

Patch Changes

• 0f04d4d: fix: Properly handle __proto__
• 819f1ac: fix: better encoding for sparse arrays

v5.6.2

Patch Changes

• 1175584: fix: validate input for ArrayBuffer parsing
• e46afa6: fix: validate input for typed arrays
• 1175584: fix: more helpful errors for inputs causing stack overflows

v5.6.1

Patch Changes

• 2161d44: fix: add hasOwn check before calling reviver

v5.6.0

Minor Changes

• a3d09d4: feat: expose DevalueError for instanceof checks in catch clauses
• a3d09d4: feat: add value and root properties in DevalueError instances

v5.5.0

Minor Changes

• 828fa1c: Enable support for custom reducer/reviver for "function" values

v5.4.2

Patch Changes

• 5c26c0d: fix: allow custom revivers to revive things serialized by builtin reducers

v5.4.1

Patch Changes

... (truncated)

Changelog

Sourced from devalue's changelog.

5.6.4

Patch Changes

• 87c1f3c: fix: reject __proto__ keys in malformed Object wrapper payloads

  This validates the "Object" parse path and throws when the wrapped value has an own __proto__ key.

• 40f1db1: fix: ensure sparse array indices are integers

• 87c1f3c: fix: disallow __proto__ keys in null-prototype object parsing

  This disallows __proto__ keys in the "null" parse path so null-prototype object hydration cannot carry that key through parse/unflatten.

5.6.3

Patch Changes

• 0f04d4d: fix: Properly handle __proto__
• 819f1ac: fix: better encoding for sparse arrays

5.6.2

Patch Changes

• 1175584: fix: validate input for ArrayBuffer parsing
• e46afa6: fix: validate input for typed arrays
• 1175584: fix: more helpful errors for inputs causing stack overflows

5.6.1

Patch Changes

• 2161d44: fix: add hasOwn check before calling reviver

5.6.0

Minor Changes

• a3d09d4: feat: expose DevalueError for instanceof checks in catch clauses
• a3d09d4: feat: add value and root properties in DevalueError instances

5.5.0

Minor Changes

• 828fa1c: Enable support for custom reducer/reviver for "function" values

5.4.2

Patch Changes

... (truncated)

Commits

• 6cbb3f5 Version Packages (#133)
• 40f1db1 Merge commit from fork
• 87c1f3c Merge commit from fork
• a4a37d2 Version Packages (#132)
• 819f1ac Merge commit from fork
• 0f04d4d Merge commit from fork
• fcf4e88 fix tests
• 1d8a5ea Version Packages (#131)
• 1175584 Merge commit from fork
• e46afa6 Merge commit from fork
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for devalue since your current version.

Updates minimatch from 5.1.6 to 5.1.9

Commits

• 4419b6e 5.1.9
• 383ce59 docs: add warning about ReDoS
• b02ef18 fix partial matching of globstar patterns
• e92ae29 5.1.8
• 79e4447 limit recursion for **, improve perf considerably
• 85ec0ff lockfile update
• 647146e lock node version to 14
• 85646c8 5.1.7
• 977c2d8 update CI matrix and actions
• 421ad12 update test expectations for coalesced consecutive stars
• Additional commits viewable in compare view

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

• fix: exception when glob pattern contains constructor by @​Jason3S in micromatch/picomatch#144
• Fix for CVE-2026-33671
• Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

• Changelogs are for humans, not machines.
• There should be an entry for every single version.
• The same types of changes should be grouped.
• Versions and sections should be linkable.
• The latest version comes first.
• The release date of each versions is displayed.
• Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

• Added for new features.
• Changed for changes in existing functionality.
• Deprecated for soon-to-be removed features.
• Removed for now removed features.
• Fixed for any bug fixes.
• Security in case of vulnerabilities.

4.0.0 (2024-02-07)

Fixes

• Fix bad text values in parse #126, thanks to @​connor4312

Changed

• Remove process global to work outside of node #129, thanks to @​styfle
• Add sideEffects to package.json #128, thanks to @​frandiox
• Removed os, make compatible browser environment. See #124, thanks to @​gwsbhqt

3.0.1

Fixes

... (truncated)

Commits

• 81cba8d Publish 2.3.2
• fc1f6b6 Merge commit from fork
• eec17ae Merge commit from fork
• 78f8ca4 Merge pull request #156 from micromatch/backport-144
• 3f4f10e Merge pull request #144 from Jason3S/jdent-object-properties
• See full diff in compare view

Updates rollup from 4.13.0 to 4.60.1

Release notes

Sourced from rollup's releases.

v4.60.1

4.60.1

2026-03-30

Bug Fixes

• Resolve a situation where side effect imports could be dropped due to a caching issue (#6286)

Pull Requests

• #6286: fix: skip dropping side-effects on namespaceReexportsByName cache hit (#6274) (@​littlegrayss, @​TrickyPi)
• #6317: chore(deps): pin dependencies (@​renovate[bot], @​lukastaegert)
• #6318: chore(deps): update msys2/setup-msys2 digest to cafece8 (@​renovate[bot], @​lukastaegert)
• #6319: chore(deps): update minor/patch updates (@​renovate[bot], @​lukastaegert)
• #6320: chore(deps): pin dependency typescript to v5 (@​renovate[bot], @​lukastaegert)
• #6321: chore(deps): update openharmony-rs/setup-ohos-sdk action to v1 (@​renovate[bot], @​lukastaegert)
• #6322: fix(deps): update swc monorepo (major) (@​renovate[bot], @​lukastaegert)
• #6323: chore(deps): lock file maintenance (@​renovate[bot])
• #6324: chore(deps): lock file maintenance (@​renovate[bot], @​lukastaegert)

v4.60.0

4.60.0

2026-03-22

Features

• Support source phase imports as long as they are external (#6279)

Pull Requests

• #6279: feat: external only Source Phase imports support (@​guybedford, @​lukastaegert)

v4.59.1

4.59.1

2026-03-21

Bug Fixes

• Fix a crash when using lazy dynamic imports with moduleSideEffects:false (#6306)

Pull Requests

• #6281: fix(deps): update minor/patch updates (@​renovate[bot], @​lukastaegert)
• #6282: chore(deps): update github artifact actions (major) (@​renovate[bot], @​lukastaegert)
• #6283: chore(deps): update dependency nyc to v18 (@​renovate[bot], @​lukastaegert)
• #6284: fix(deps): update swc monorepo (major) (@​renovate[bot])
• #6285: chore(deps): lock file maintenance (@​renovate[bot])

... (truncated)

Changelog

Sourced from rollup's changelog.

4.60.1

2026-03-30

Bug Fixes

• Resolve a situation where side effect imports could be dropped due to a caching issue (#6286)

Pull Requests

• #6286: fix: skip dropping side-effects on namespaceReexportsByName cache hit (#6274) (@​lit...

  Description has been truncated

  Note
  Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud