chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@typescript/native-preview (source)	7.0.0-dev.20260426.1 → 7.0.0-dev.20260503.1
rolldown (source)	1.0.0-rc.17 → 1.0.0-rc.18

---

Release Notes

microsoft/typescript-go (@​typescript/native-preview)

v7.0.0-dev.20260503.1

Compare Source

v7.0.0-dev.20260502.1

Compare Source

v7.0.0-dev.20260501.1

Compare Source

v7.0.0-dev.20260430.1

Compare Source

v7.0.0-dev.20260429.1

Compare Source

v7.0.0-dev.20260428.1

Compare Source

v7.0.0-dev.20260427.1

Compare Source

rolldown/rolldown (rolldown)

v1.0.0-rc.18

Compare Source

💥 BREAKING CHANGES

• optimization: default unspecified inlineConst.mode to smart (#​9248) by @​IWANABETHATGUY

🐛 Bug Fixes

• rolldown_plugin_vite_import_glob: return error instead of panicking when virtual module uses a relative glob (#​9241) by @​shulaoda
• binding: treat empty inlineConst object as omitted (#​9247) by @​IWANABETHATGUY
• rolldown: keep enum declaration for optional-chain access (#​9229) by @​Dunqing
• link_stage: restore inline let-else in exports-kind filter (#​9237) by @​IWANABETHATGUY
• dev/lazy: avoid module reinitialization in lazy compilation patches (#​9179) by @​h-a-n-a
• dev: visit identifier references for runtime rewrites in HMR finalizer (#​9191) by @​h-a-n-a
• chunk-optimizer: pick dominator for runtime placement to avoid cycles (#​9164) by @​IWANABETHATGUY
• make this.emitFile chunk path synchronous to avoid deadlock (#​9031) by @​lazarv
• use sentinel id for browser: false ignored modules (#​9192) by @​shulaoda
• prevent chunk optimizer from creating import cycles (#​9228) by @​IWANABETHATGUY

🚜 Refactor

• replace tokio::sync::Mutex with std::sync::Mutex for non-IO data (#​9176) by @​shulaoda
• rolldown_plugin_vite_import_glob: do not rewrite import path for absolute base (#​9195) by @​shulaoda
• runtime_helper: wrap DependedRuntimeHelperMap in a struct (#​9215) by @​IWANABETHATGUY
• drop redundant clear() in determine_safely_merge_cjs_ns (#​9206) by @​IWANABETHATGUY
• clean up generate_lazy_export (#​9208) by @​IWANABETHATGUY
• bitset: return bool from set_bit to fuse guard-and-set (#​9207) by @​IWANABETHATGUY
• link_stage: simplify exports-kind filter and clarify safety comments (#​9205) by @​IWANABETHATGUY

📚 Documentation

• determine_module_exports_kind (#​9252) by @​IWANABETHATGUY
• fix dead link to esbuild ESM/CJS interop tests (#​9230) by @​Copilot
• remove CSS bundling references (#​9234) by @​shulaoda
• correct IncrementalFullBuild row in BundleMode table (#​9214) by @​IWANABETHATGUY
• design: add bundler data lifecycle design doc (#​9212) by @​hyf0
• remove minifier alpha status notices (#​9202) by @​sapphi-red

⚙️ Miscellaneous Tasks

• upgrade oxc to 0.128.0 (#​9260) by @​shulaoda
• deps: bump rolldown-ariadne to 0.6.0 (#​9254) by @​IWANABETHATGUY
• deps: update github actions (#​9259) by @​renovate[bot]
• deps: update github actions (#​9258) by @​renovate[bot]
• remove renovate overrides (#​9257) by @​Boshen
• use ubuntu-latest for security workflow (#​9256) by @​Boshen
• notify Discord around release publish (#​9251) by @​Boshen
• add release environment to npm publish workflow (#​9250) by @​Boshen
• justfile: drop the -- separator before forwarded args in vp run (#​9246) by @​shulaoda
• deps: update test262 submodule for tests (#​9243) by @​sapphi-red
• add more tracing instrumentations (#​9220) by @​sapphi-red
• rolldown_plugin_vite_import_glob: remove outdated sourcemap doc comment (#​9213) by @​shulaoda
• update security workflow (#​9201) by @​Boshen

❤️ New Contributors

• @​lazarv made their first contribution in #​9031

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/unplugin-inline-enum@126

commit: 2c95312

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	rolldown@​1.0.0-rc.17 ⏵ 1.0.0-rc.18				+1
	@​typescript/​native-preview@​7.0.0-dev.20260426.1 ⏵ 7.0.0-dev.20260503.1			+1

View full report