chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@vitest/ui (source)	^4.0.7 -> ^4.0.8
esbuild	~0.25.12 -> ~0.27.0
pnpm (source)	10.20.0 -> 10.21.0
rollup (source)	^4.52.5 -> ^4.53.1
tsdown	^0.16.0 -> ^0.16.1
vitest (source)	^4.0.7 -> ^4.0.8

---

Release Notes

vitest-dev/vitest (@​vitest/ui)

v4.0.8

Compare Source

   🐞 Bug Fixes

• Workaround noExternal merging bug on Vite 6  -  by @​hi-ogawa in #​8950 (bcb13)
• Missed context.d.ts file  -  by @​termorey in #​8965 (9044d)
• Incorrect error message for non-awaited expect.element()  -  by @​StyleShit in #​8954 (9638d)
• browser: Cleanup frame-ancestors from CSP header at coverage middleware  -  by @​userquin in #​8941 (1f730)
• deps: Update all non-major dependencies  -  by @​sheremet-va in #​8636 (da8b9)
• forks: Do not fail with Windows Defender enabled  -  by @​sheremet-va in #​8967 (c79f4)
• runner: Properly encode Uint8Array body in annotations  -  by @​Livan-pro in #​8951 (997ca)
• spy: Copy static properties if spy is initialised with vi.fn(), fix types for vi.spyOn(obj, class)  -  by @​sheremet-va in #​8956 (75e7f)
• webdriverio: When no argument is passed to the .click interaction command, the webdriver command should also have no argument  -  by @​julienw in #​8937 (069e6)

    View changes on GitHub

evanw/esbuild (esbuild)

v0.27.0

Compare Source

This release deliberately contains backwards-incompatible changes. To avoid automatically picking up releases like this, you should either be pinning the exact version of esbuild in your package.json file (recommended) or be using a version range syntax that only accepts patch upgrades such as ^0.26.0 or ~0.26.0. See npm's documentation about semver for more information.

• Use Uint8Array.fromBase64 if available (#​4286)

  With this release, esbuild's binary loader will now use the new Uint8Array.fromBase64 function unless it's unavailable in the configured target environment. If it's unavailable, esbuild's previous code for this will be used as a fallback. Note that this means you may now need to specify target when using this feature with Node (for example --target=node22) unless you're using Node v25+.

• Update the Go compiler from v1.23.12 to v1.25.4 (#​4208, #​4311)

  This raises the operating system requirements for running esbuild:

  • Linux: now requires a kernel version of 3.2 or later
  • macOS: now requires macOS 12 (Monterey) or later

v0.26.0

Compare Source

• Enable trusted publishing (#​4281)

  GitHub and npm are recommending that maintainers for packages such as esbuild switch to trusted publishing. With this release, a VM on GitHub will now build and publish all of esbuild's packages to npm instead of me. In theory.

  Unfortunately there isn't really a way to test that this works other than to do it live. So this release is that live test. Hopefully this release is uneventful and is exactly the same as the previous one (well, except for the green provenance attestation checkmark on npm that happens with trusted publishing).

pnpm/pnpm (pnpm)

v10.21.0

Compare Source

rollup/rollup (rollup)

v4.53.1

Compare Source

2025-11-07

Bug Fixes

• Fix install script (#​6172)

Pull Requests

• #​6172: fix: move patch-package from postinstall to prepare script (@​mshima)

v4.53.0

Compare Source

2025-11-07

Features

• Improve rendering performance by caching generated variable names (#​5947)

Pull Requests

• #​5947: refactor: store safe variable names in cache for subsequent usage (@​Aslemammad, @​lukastaegert, @​Service account user)
• #​6149: chore(deps): update dependency vite to v7.1.11 [security] (@​renovate[bot], @​Service account user)
• #​6151: fix(deps): update swc monorepo (major) (@​renovate[bot], @​Service account user)
• #​6152: fix(deps): lock file maintenance minor/patch updates (@​renovate[bot], @​Service account user)
• #​6153: chore(deps): lock file maintenance minor/patch updates (@​renovate[bot], @​Service account user)
• #​6155: Fix tests: Do not swallow warnings for multi-format tests (@​lukastaegert, @​Service account user)
• #​6159: chore(deps): update dependency eslint-plugin-unicorn to v62 (@​renovate[bot])
• #​6160: chore(deps): update github artifact actions (major) (@​renovate[bot])
• #​6161: fix(deps): lock file maintenance minor/patch updates (@​renovate[bot], @​lukastaegert)
• #​6164: chore(deps): update dependency @​rollup/plugin-alias to v6 (@​renovate[bot])
• #​6165: chore(deps): update dependency @​rollup/plugin-commonjs to v29 (@​renovate[bot])
• #​6166: fix(deps): update swc monorepo (major) (@​renovate[bot], @​lukastaegert)
• #​6167: chore(deps): lock file maintenance minor/patch updates (@​renovate[bot], @​lukastaegert)

rolldown/tsdown (tsdown)

v0.16.1

Compare Source

   🚀 Features

• Switch unconfig-core & mark unrun stable  -  by @​sxzz in #​585 (339f5)

   🐞 Bug Fixes

• attw: Improve attw execute, output package name  -  by @​sxzz (237f6)
• unused: Set root to cwd  -  by @​sxzz (844c9)

    View changes on GitHub

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.