fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
rolldown (source)	^1.0.1 → ^1.0.2			devDependencies	patch
semver	^7.8.0 → ^7.8.1			dependencies	patch
tinyexec	^1.1.2 → ^1.2.2			dependencies	minor
zizmorcore/zizmor-action	v0.5.3 → v0.5.6			action	patch

---

Release Notes

rolldown/rolldown (rolldown)

v1.0.2

Compare Source

🚀 Features

• devtools: emit package size in PackageGraphReady (#​9434) by @​IWANABETHATGUY
• devtools: classify package dependency types (#​9427) by @​IWANABETHATGUY
• devtools: map packages to modules and chunks (#​9426) by @​IWANABETHATGUY
• devtools: mark used packages (#​9423) by @​IWANABETHATGUY
• devtools: make duplicate packages discoverable (#​9422) by @​IWANABETHATGUY
• devtools: emit package metadata (#​9421) by @​IWANABETHATGUY
• update oxc to 0.132.0 (#​9449) by @​shulaoda
• update oxc to 0.131.0 (#​9424) by @​shulaoda
• allow checks.* to escalate emissions to hard errors (#​9388) by @​IWANABETHATGUY
• dev: support watcher options include and exclude (#​9395) by @​h-a-n-a
• emit warnings for invalid pure annotations (#​9381) by @​Kyujenius

🐛 Bug Fixes

• hash: keep chunk file names stable when an unrelated entry is added (#​9444) by @​hyf0
• call codeSplitting.groups[].name in deterministic order (#​9457) by @​sapphi-red
• dev/lazy: make resolve_id idempotent when the resolved id is already a lazy entry (#​9439) by @​h-a-n-a
• chunk-optimization: publish absorbed dynamic-entry namespace cross-chunk (#​9448) by @​IWANABETHATGUY
• treeshake: propagate pure annotation through compound exprs (#​9431) by @​Dunqing
• finalizer: skip redundant init call when barrel executes in same chunk (#​9354) by @​IWANABETHATGUY
• linking: initialize wrapped ESM re-export owners (#​9353) by @​IWANABETHATGUY
• do not inherit __toESM across chunks for named-only external imports (#​9333) (#​9415) by @​IWANABETHATGUY
• watcher: don't write output or emit events after close() (#​9328) by @​situ2001
• chunk-optimization: avoid unsafe dynamic-only merges (#​9398) by @​IWANABETHATGUY
• cjs: rename CJS-wrapped locals that would shadow chunk-scope names (#​9392) by @​hyf0
• dev/lazy: watch lazy modules added in rebuilds (#​9391) by @​h-a-n-a

🚜 Refactor

• rolldown_dev: move dev example to break publish cycle (#​9465) by @​Boshen
• binding: drop unsafe napi string helper, hoist transform ArcStr (#​9456) by @​hyf0
• ecmascript_utils: split rewrite_ident_reference off JsxExt trait (#​9417) by @​IWANABETHATGUY
• use ThreadsafeFunction::call_async_catch (#​9390) by @​sapphi-red

📚 Documentation

• devtools: document @​rolldown/debug usage and package graph consumption (#​9435) by @​IWANABETHATGUY
• replace Inter with system font stack in OG template SVG (#​9240) by @​yvbopeng
• remove output.comments warning as all issues have been resolved (#​9393) by @​sapphi-red
• in-depth: clarify @​PURE scope and document positions (#​9389) by @​Kyujenius
• readme: remove release candidate notice (#​9387) by @​shulaoda

⚡ Performance

• vite-resolve: cache importer existence checks (#​9443) by @​Brooooooklyn
• binding: reduce plugin string clones (#​9436) by @​Brooooooklyn

🧪 Testing

• enable legal_comments_inline test (#​9394) by @​sapphi-red

⚙️ Miscellaneous Tasks

• bump pnpm to v11.1.2 (#​9447) by @​Boshen
• deps: update rust crates (#​9461) by @​renovate[bot]
• deps: update rollup submodule for tests to v4.60.4 (#​9453) by @​rolldown-guard[bot]
• deps: update test262 submodule for tests (#​9454) by @​rolldown-guard[bot]
• deps: update npm packages (#​9430) by @​renovate[bot]
• deps: update github actions (#​9429) by @​renovate[bot]
• deps: update dependency rolldown-plugin-dts to v0.25.1 (#​9452) by @​renovate[bot]
• deps: update rust crates (#​9428) by @​renovate[bot]
• revert allow checks.* to escalate emissions to hard errors (#​9388) (#​9438) by @​IWANABETHATGUY
• update mimalloc-safe to 0.1.61 (#​9413) by @​shulaoda
• deny todo, unimplemented, and print_stderr clippy lints (#​9412) by @​Boshen
• deps: update mimalloc-safe to 0.1.60 (#​9410) by @​shulaoda
• remove pip install setuptools workaround for node-gyp on macOS (#​9370) by @​sapphi-red
• renovate: disable automerge to require manual approval (#​9386) by @​shulaoda
• deps: update napi (#​9385) by @​renovate[bot]

❤️ New Contributors

• @​yvbopeng made their first contribution in #​9240

npm/node-semver (semver)

v7.8.1

Compare Source

Bug Fixes

• 17aa702 #​869 strip build metadata before comparator trimming (#​869) (@​owlstronaut)
• 5f3ca13 #​867 handle prerelease bounds in subset (#​867) (@​puneetdixit200, Puneet Dixit)

tinylibs/tinyexec (tinyexec)

v1.2.2

Compare Source

What's Changed

• fix: correct shebang regex by @​43081j in #​134

Full Changelog: tinylibs/tinyexec@1.2.1...1.2.2

v1.2.1

Compare Source

What's Changed

• test: add async throw tests by @​43081j in #​133

Full Changelog: tinylibs/tinyexec@1.2.0...1.2.1

v1.2.0

Compare Source

What's Changed

• refactor: inline parse by @​hyperz111 in #​100
• chore: check types on lint by @​43081j in #​119
• test: add more normalize tests by @​43081j in #​120
• build: update tsdown config and dependencies by @​hyperz111 in #​121
• chore(deps-dev): bump the development-dependencies group with 2 updates by @​dependabot[bot] in #​122
• chore(deps-dev): bump the development-dependencies group with 6 updates by @​dependabot[bot] in #​123
• chore: set workflow permissions by @​43081j in #​124
• feat: add nodePath flag by @​43081j in #​125
• test: tidy up env tests by @​43081j in #​126
• chore(deps-dev): bump the development-dependencies group with 4 updates by @​dependabot[bot] in #​128
• chore(deps): bump the github-actions group with 2 updates by @​dependabot[bot] in #​127
• chore: setup funding / publish env by @​43081j in #​129
• chore: enable staged publishes by @​43081j in #​130

New Contributors

• @​hyperz111 made their first contribution in #​100

Full Changelog: tinylibs/tinyexec@1.1.2...1.2.0

zizmorcore/zizmor-action (zizmorcore/zizmor-action)

v0.5.6

Compare Source

• 1.25.2 is now available via the action
• 1.25.2 is now the default version of zizmor used by the action

v0.5.5

Compare Source

This is a no-op release.

v0.5.4

Compare Source

• 1.25.0 is now available via the action
• 1.25.0 is now the default version of zizmor used by the action

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.