chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@cloudflare/workers-types	^4.20251221.0 -> ^4.20251224.0
deno (source)	2.6 -> 2.6.3
pnpm (source)	10.26.0 -> 10.26.2
rolldown (source)	1.0.0-beta.56 -> 1.0.0-beta.57
rollup (source)	^4.53.5 -> ^4.54.0
shaders	^2.2.21 -> ^2.2.24
vite (source)	8.0.0-beta.2 -> 8.0.0-beta.4

---

Release Notes

cloudflare/workerd (@​cloudflare/workers-types)

v4.20251224.0

Compare Source

v4.20251223.0

Compare Source

denoland/deno (deno)

v2.6.3

Compare Source

• fix(check): improve node types handling
• Revert "fix(ext/node): stub out Module.register and Module.registerHooks"
  (#​31684)

v2.6.2

Compare Source

• feat(unstable): add sandbox subcommand (#​31568)
• fix(audit): fix deserde for transitive npm audit actions (#​31671)
• fix(check): handle workspace members having different jsx import sources and
  importing each other (#​31654)
• fix(check): regression with tsgo and node globals (#​31621)
• fix(cli): deno tunnel when token storage isn't working or without deno.json
  (#​31584)
• fix(compile): ensure temp dir exists during x64 codesign (#​31672)
• fix(ext/node): sqlite:backup compatibility (#​31610)
• fix(ext/node): add error handling functions and tests for UV bindings (#​31639)
• fix(ext/node): avoid env permission for TERM in console and readline (#​31638)
• fix(ext/node): fix hot loop in setImmediate with a pending timer (#​31643)
• fix(ext/node): stub out Module.register and Module.registerHooks (#​31666)
• fix(ext/node): support named pipe listen, connect and open (#​31624)
• fix(ext/telemetry): otel baggage propagation (#​31620)
• fix(fetch): fix SOCKS5 proxy URL validation logic (#​31604)
• fix(flags): implement a better sandbox subcommand (#​31657)
• fix(inspector): worker debugging support via CDP (#​31527)
• fix(x): cache on demand when running, resolve packages with only one binary,
  don't fail on node-gyp if not present (#​31619)
• fix(x): fix shim script when use custom alias name, re-enable alias tests
  (#​31653)
• fix: panic on dropped inspector session (#​31658)
• fix: update glob implementation to match with latest node (#​31627)

v2.6.1

Compare Source

• feat(unstable): deploy config allow app to be optional (#​31567)
• fix(add): include type-only imports when building graph (#​31552)
• fix(cli): add streams as transferable types (#​31586)
• fix(compile): intel mac compile fix (#​31575)
• fix(compile): sentinal conflict with strtab on intel mac (#​31587)
• fix(ext/node): DatabaseSync compatibility (#​31515)
• fix(x): correct alias deno command location for Windows (#​31573)
• fix(x): fix executing native binary on windows + some cleanup (#​31551)
• fix: --preload and --require flags only available in runtime subcommands
  (#​31614)
• fix: adjust deno_cache version (#​31553)
• fix: source map file names to non-existent paths (#​31564)

pnpm/pnpm (pnpm)

v10.26.2

Compare Source

v10.26.1

Compare Source

rolldown/rolldown (rolldown)

v1.0.0-beta.57

Compare Source

💥 BREAKING CHANGES

• tsconfig: enable project references support in manual mode (#​7545) by @​shulaoda

🚀 Features

• add CANNOT_CALL_NAMESPACE warning (#​7636) by @​sapphi-red
• add import path for unresolved import diagnostics (#​7625) by @​sapphi-red
• optimize dynamic entry facade chunks by merging with common chunks when they are captured by common chunks (#​7486) by @​IWANABETHATGUY

🐛 Bug Fixes

• rename __export to __exportAll to be compatible with cjs-module-lexer (#​7640) by @​IWANABETHATGUY
• strip UTF-8 BOM when using text loader (#​7635) by @​sapphi-red
• rolldown_plugin_replace: avoid crashing with invalid delimiters (#​7621) by @​sapphi-red

🚜 Refactor

• export all filter functions (#​7622) by @​sxzz
• allow multiple help messages in diagnostics (#​7624) by @​sapphi-red

📚 Documentation

• add README.md to packages/rolldown (#​7556) by @​Copilot

⚡ Performance

• use fsevents on macOS for file watching (#​7596) by @​sapphi-red

🧪 Testing

• handle re-exports of external modules in CJS format (#​7641) by @​IWANABETHATGUY
• update integration to use vite's rolldown-canary branch (#​7633) by @​shulaoda

⚙️ Miscellaneous Tasks

• docs: fix Netlify ignore condition to detect docs changes across all PR commits (#​7637) by @​Copilot
• deps: update rollup submodule for tests to v4.54.0 (#​7630) by @​sapphi-red
• skip benchmarks for PRs with 'graphite: merge-when-ready' label (#​7631) by @​Boshen
• deps: update esbuild for tests to 0.27.2 (#​7629) by @​sapphi-red
• fix "update-test-dependencies" workflow (#​7628) by @​sapphi-red
• deps: update test262 submodule for tests (#​7626) by @​sapphi-red
• deps: update dependency oxlint to v1.35.0 (#​7623) by @​renovate[bot]

rollup/rollup (rollup)

v4.54.0

Compare Source

2025-12-20

Features

• Enable tree-shaking for Symbol.hasInstance, Symbol.dispose and Symbol.asyncDispose properties if unused (#​6046)

Bug Fixes

• Ensure that well-known-Symbol-valued properties are not tree-shaken except in select cases (#​6046)
• Ensure namespace properties are included when referenced only from a try-catch (#​6216)

Pull Requests

• #​6046: fix: correctly handle wellknown protocols (@​cyyynthia, @​lukastaegert)
• #​6201: chore(deps): update dependency lru-cache to v11 (@​renovate[bot], @​lukastaegert)
• #​6211: chore(deps): update msys2/setup-msys2 digest to 4f806de (@​renovate[bot], @​lukastaegert)
• #​6212: chore(deps): update actions/cache action to v5 (@​renovate[bot])
• #​6213: chore(deps): update github artifact actions (major) (@​renovate[bot])
• #​6214: fix(deps): lock file maintenance minor/patch updates (@​renovate[bot])
• #​6215: chore(deps): lock file maintenance (@​renovate[bot])
• #​6216: fix: include namespace variable paths during try-catch deoptimization (@​schwing)

vitejs/vite (vite)

v8.0.0-beta.4

Compare Source

Features

• css: support es2024 build target for lightningcss (#​21294) (bd33b8e)
• update rolldown to 1.0.0-beta.56 (#​21323) (9847a63)

Bug Fixes

• detect import.meta.resolve when formatted across multiple lines (#​21312) (130e718)

v8.0.0-beta.3

Compare Source

Features

• introduce v2 native plugins and enable it by default (#​21268) (42f2ab3)
• ssr: avoid errors when rewriting already rewritten stacktrace (#​21269) (98d9a33)
• update rolldown to 1.0.0-beta.55 (#​21300) (2c8db85)

Bug Fixes

• allow no-cors requests for non-script tag requests (#​21299) (ef3d596)
• deps: update all non-major dependencies (#​21285) (4635b2e)
• unreachable error when building with experimental.bundledDev is enabled (#​21296) (e81c183)

---

Configuration

📅 Schedule: Branch creation - "after 2am and before 3am" (UTC), Automerge - "after 1am and before 2am" (UTC).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
nitro.build	Ready	Preview, Comment	Dec 24, 2025 8:35am

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/nitrojs/nitro@3889

commit: c674548