feat(deps): upgrade upstream dependencies (#2104)

## Summary

- Automated daily upgrade of upstream dependencies.
- Bumps rolldown to `v1.1.5` and tsdown to `0.22.4`, plus the oxc
toolchain (oxlint `1.73.0`, oxfmt `0.58.0`, `@oxc-project/*` / `oxc-*`
`0.139.0`, and the Rust `oxc*` crates `0.139.0`).
- Keeps `yuku-codegen`/`yuku-parser` (rolldown-plugin-dts napi packages)
external in the core bundle and adds them as core dependencies so their
native bindings resolve at runtime.
- Regenerates the NAPI binding types and applies oxfmt formatter output;
`build-upstream` failed for this run.

## Dependency updates

| Package | From | To |
| --- | --- | --- |
| `rolldown` | `6cbd233` | `v1.1.5 (f09947a)` |
| `tsdown` | `0.22.3` | `0.22.4` |
| `@tsdown/css` | `0.22.3` | `0.22.4` |
| `@tsdown/exe` | `0.22.3` | `0.22.4` |
| `oxfmt` | `0.57.0` | `0.58.0` |
| `oxlint` | `1.72.0` | `1.73.0` |
| `@oxc-project/runtime` | `0.138.0` | `0.139.0` |
| `@oxc-project/types` | `0.138.0` | `0.139.0` |
| `oxc-minify` | `0.138.0` | `0.139.0` |
| `oxc-parser` | `0.138.0` | `0.139.0` |
| `oxc-transform` | `0.138.0` | `0.139.0` |
| `oxc` (Rust crates) | `0.138.0` | `0.139.0` |
| `oxc_resolver` | `11.22.0` | `11.23.0` |
| `oxc_sourcemap` | `8.0.1` | `8.1.0` |
| `num-bigint` | `0.4.6` | `0.5.1` |

<details><summary>Unchanged dependencies</summary>

- `vite`: `v8.1.3 (578ffb8)`
- `vitest`: `4.1.10`
- `@vitest/browser`: `4.1.10`
- `@vitest/browser-playwright`: `4.1.10`
- `@vitest/browser-preview`: `4.1.10`
- `@vitest/browser-webdriverio`: `4.1.10`
- `@vitest/expect`: `4.1.10`
- `@vitest/mocker`: `4.1.10`
- `@vitest/pretty-format`: `4.1.10`
- `@vitest/runner`: `4.1.10`
- `@vitest/snapshot`: `4.1.10`
- `@vitest/spy`: `4.1.10`
- `@vitest/utils`: `4.1.10`
- `lightningcss`: `^1.32.0`
- `@oxc-node/cli`: `0.1.0`
- `@oxc-node/core`: `0.1.0`
- `oxlint-tsgolint`: `0.24.0`
- `VITEST_VERSION constant`: `4.1.10`
- `README vitest pins`: `4.1.10`
- `@vitejs/devtools`: `0.3.4`

</details>

## Code changes

- `packages/core/build.ts`: keep `yuku-codegen`/`yuku-parser` external
(their loaders `require` a per-platform `.node` binding relative to
their own `__dirname`, which bundling would break).
- `packages/core/package.json`: add `yuku-codegen`/`yuku-parser` as core
`dependencies`; bump `bundledVersions` (rolldown `1.1.4` -> `1.1.5`,
tsdown `0.22.3` -> `0.22.4`).
- `packages/cli/binding/index.d.cts`: regenerated NAPI binding types for
the rolldown bump — adds `sourcemapFilenames`/`sourcemapFileNames`,
`preliminarySourcemapFilename`, and the `reserved` mangle option;
removes the module-preload and render-built-url binding interfaces.
- `pnpm-workspace.yaml`: catalog version bumps plus `fresh-import` /
`void` entries and `valibot` `1.4.1` -> `1.4.2`.
- `docs/config/run.md`, `rfcs/pack-command.md`,
`packages/tools/src/local-npm-registry.ts`: oxfmt `0.58.0` reformatting
of empty braces (no behavior change).

## Build status

- `sync-remote-and-build`: success
- `build-upstream`: failure

Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com>
Co-authored-by: MK (fengmk2) <fengmk2@gmail.com>
Co-authored-by: Charles Wang <3612422+wan9chi@users.noreply.github.com>

Author: 3 people

Cargo.lock

@@ -234,7 +234,7 @@ napi-derive = { version = "3.0.0", default-features = false, features = [
 nix = { version = "0.30.1", features = ["dir"] }
 nodejs-built-in-modules = "1.0.0"
 nom = "8.0.0"
-num-bigint = "0.4.6"
+num-bigint = "0.5.1"
 num_cpus = "1.17"
 owo-colors = "4.2.2"
 parking_lot = "0.12.5"
@@ -317,7 +317,7 @@ xxhash-rust = "0.8.15"
 zip = { version = "7.2", default-features = false, features = ["deflate-flate2-zlib-rs"] }
 
 # oxc crates with the same version
-oxc = { version = "0.138.0", features = [
+oxc = { version = "0.139.0", features = [
   "ast_visit",
   "transformer",
   "minifier",
@@ -329,23 +329,23 @@ oxc = { version = "0.138.0", features = [
   "regular_expression",
   "cfg",
 ] }
-oxc_allocator = { version = "0.138.0", features = ["pool"] }
-oxc_ast = "0.138.0"
-oxc_ecmascript = "0.138.0"
-oxc_parser = "0.138.0"
-oxc_span = "0.138.0"
-oxc_napi = "0.138.0"
-oxc_str = "0.138.0"
-oxc_minify_napi = "0.138.0"
-oxc_parser_napi = "0.138.0"
-oxc_transform_napi = "0.138.0"
-oxc_traverse = "0.138.0"
+oxc_allocator = { version = "0.139.0", features = ["pool"] }
+oxc_ast = "0.139.0"
+oxc_ecmascript = "0.139.0"
+oxc_parser = "0.139.0"
+oxc_span = "0.139.0"
+oxc_napi = "0.139.0"
+oxc_str = "0.139.0"
+oxc_minify_napi = "0.139.0"
+oxc_parser_napi = "0.139.0"
+oxc_transform_napi = "0.139.0"
+oxc_traverse = "0.139.0"
 
 # oxc crates in their own repos
 oxc_index = { version = "5", features = ["rayon", "serde"] }
-oxc_resolver = { version = "11.22.0", features = ["yarn_pnp"] }
-oxc_resolver_napi = { version = "11.22.0", default-features = false, features = ["yarn_pnp"] }
-oxc_sourcemap = "8.0.1"
+oxc_resolver = { version = "11.23.0", features = ["yarn_pnp"] }
+oxc_resolver_napi = { version = "11.23.0", default-features = false, features = ["yarn_pnp"] }
+oxc_sourcemap = "8.1.0"
 
 # rolldown crates
 rolldown = { path = "./rolldown/crates/rolldown" }

Cargo.toml

@@ -8,12 +8,8 @@ import { defineConfig } from 'vite-plus';
 export default defineConfig({
   run: {
     enablePrePostScripts: true,
-    cache: {
-      /* ... */
-    },
-    tasks: {
-      /* ... */
-    },
+    cache: {/* ... */},
+    tasks: {/* ... */},
   },
 });
 ```

docs/config/run.md

@@ -144,6 +144,17 @@ export interface MangleOptions {
    * @default false
    */
   keepNames?: boolean | MangleOptionsKeepNames;
+  /**
+   * Names that bindings must not be renamed to, and that bindings already
+   * carrying them keep. Equivalent to terser's `mangle.reserved`.
+   *
+   * Pass `['exports', 'module']` when minifying prebuilt CommonJS / UMD files
+   * that Node consumers `import` directly, so Node's cjs-module-lexer can still
+   * detect the mangled module's named exports.
+   *
+   * @default []
+   */
+  reserved?: Array<string>;
   /** Debug mangled names. */
   debug?: boolean;
 }
@@ -1762,6 +1773,7 @@ export declare class BindingNormalizedOptions {
   get name(): string | null;
   get entryFilenames(): string | undefined;
   get chunkFilenames(): string | undefined;
+  get sourcemapFilenames(): string | undefined;
   get assetFilenames(): string | undefined;
   get dir(): string | null;
   get file(): string | null;
@@ -2591,15 +2603,6 @@ export interface BindingMatchGroup {
   includeDependenciesRecursively?: boolean;
 }
 
-export interface BindingModulePreloadOptions {
-  polyfill: boolean;
-  resolveDependencies?: (
-    filename: string,
-    deps: string[],
-    context: { hostId: string; hostType: 'html' | 'js' },
-  ) => string[];
-}
-
 export interface BindingModules {
   values: Array<BindingRenderedModule>;
   keys: Array<string>;
@@ -2643,6 +2646,7 @@ export interface BindingOutputOptions {
   paths?: Record<string, string> | ((id: string) => string);
   plugins: (BindingBuiltinPlugin | BindingPluginOptions | undefined)[];
   sourcemap?: 'file' | 'inline' | 'hidden';
+  sourcemapFileNames?: string | ((chunk: PreRenderedChunk) => string);
   sourcemapBaseUrl?: string;
   sourcemapIgnoreList?:
     | boolean
@@ -2843,18 +2847,6 @@ export declare const enum BindingRebuildStrategy {
   Never = 2,
 }
 
-export interface BindingRenderBuiltUrlConfig {
-  ssr: boolean;
-  type: 'asset' | 'public';
-  hostId: string;
-  hostType: 'js' | 'css' | 'html';
-}
-
-export interface BindingRenderBuiltUrlRet {
-  relative?: boolean;
-  runtime?: string;
-}
-
 export interface BindingReplacePluginConfig {
   values: Record<string, string>;
   delimiters?: [string, string];
@@ -2863,11 +2855,6 @@ export interface BindingReplacePluginConfig {
   sourcemap?: boolean;
 }
 
-export interface BindingResolveDependenciesContext {
-  hostId: string;
-  hostType: string;
-}
-
 export type BindingResolvedExternal = boolean | string;
 
 export interface BindingResolveOptions {
@@ -3202,6 +3189,7 @@ export interface JsOutputChunk {
   map?: BindingSourcemap;
   sourcemapFilename?: string;
   preliminaryFilename: string;
+  preliminarySourcemapFilename?: string;
 }
 
 /** Error emitted from native side, it only contains kind and message, no stack trace. */

packages/cli/binding/index.d.cts

@@ -414,10 +414,20 @@ async function bundleTsdown() {
   // (a native module) and `postcss` also stay external: `@tsdown/css` pulls them
   // in and they cannot be bundled. Both are core `dependencies`, so they resolve
   // at runtime and CSS bundling works without users installing anything.
+  //
+  // `yuku-codegen` and `yuku-parser` (pulled in by `rolldown-plugin-dts` for dts
+  // generation) are napi packages: their loaders `require` a per-platform
+  // `@yuku-*/binding-<platform>/*.node` relative to their own `__dirname`.
+  // Bundling their JS into a core chunk rebinds `__dirname` to `dist/tsdown/`,
+  // so the native binding no longer resolves. Keep them external and list them
+  // as core `dependencies` so each package's loader resolves its own binding
+  // (declared as optionalDependencies) at runtime.
   const tsdownExternal = [
     ...Object.keys(pkgJson.peerDependencies).filter((name) => !bundledTsdownPackages.has(name)),
     'lightningcss',
     'postcss',
+    'yuku-codegen',
+    'yuku-parser',
   ];
   const isExternal = (id: string) => tsdownExternal.some((e) => id === e || id.startsWith(`${e}/`));
 

packages/core/build.ts

@@ -103,7 +103,9 @@
     "@oxc-project/runtime": "catalog:",
     "@oxc-project/types": "catalog:",
     "lightningcss": "catalog:",
-    "postcss": "^8.5.6"
+    "postcss": "^8.5.6",
+    "yuku-codegen": "^0.5.44",
+    "yuku-parser": "^0.5.44"
   },
   "devDependencies": {
     "@ast-grep/napi": "^0.43.0",
@@ -213,7 +215,7 @@
   },
   "bundledVersions": {
     "vite": "8.1.3",
-    "rolldown": "1.1.4",
-    "tsdown": "0.22.3"
+    "rolldown": "1.1.5",
+    "tsdown": "0.22.4"
   }
 }

packages/core/package.json

@@ -2,7 +2,7 @@
   "rolldown": {
     "repo": "https://github.com/rolldown/rolldown.git",
     "branch": "main",
-    "hash": "6cbd2330dc5ca973b90444973ee04c2dc7ee2f2d"
+    "hash": "f09947ab017d6df74299f691853dcfc4f4f0f86e"
   },
   "vite": {
     "repo": "https://github.com/vitejs/vite.git",

packages/tools/.upstream-versions.json

@@ -228,7 +228,7 @@ const upstreamAgent = new HttpsAgent({ keepAlive: true, maxSockets: 64 });
 // in a pnpm-packed tarball, so long-name (pax header) handling is unnecessary.
 function readPackageJsonFromTarball(tgzBytes: Buffer, sourcePath: string): PackageManifest {
   const tar = gunzipSync(tgzBytes);
-  for (let offset = 0; offset + 512 <= tar.length; ) {
+  for (let offset = 0; offset + 512 <= tar.length;) {
     const rawName = tar.subarray(offset, offset + 100).toString();
     const nulIndex = rawName.indexOf('\0');
     const name = nulIndex === -1 ? rawName : rawName.slice(0, nulIndex);