chore(deps): update github actions by renovate[bot] · Pull Request #9429 · rolldown/rolldown

renovate · 2026-05-17T16:43:21Z

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/create-github-app-token	action	minor	`v3.1.1` → `v3.2.0`
taiki-e/install-action	action	minor	`v2.77.1` → `v2.78.0`	`v2.79.0` (+3)
voidzero-dev/setup-vp	action	minor	`v1.9.0` → `v1.10.0`

Release Notes

actions/create-github-app-token (actions/create-github-app-token)

`v3.2.0`

Compare Source

Features

add support for enterprise-level GitHub Apps (#263) (952a2a7)
support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

deps: bump @actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
validate private-key input (#376) (f24bbd8)

taiki-e/install-action (taiki-e/install-action)

`v2.78.0`: 2.78.0

Compare Source

Support cargo-mutants. (#1812, thanks @jakewimmer)
Update covgate@latest to 0.2.0.
Update cargo-llvm-cov@latest to 0.8.7.
Update uv@latest to 0.11.14.
Update martin@latest to 1.9.1.
Update tombi@latest to 0.11.4.

`v2.77.7`: 2.77.7

Compare Source

Update mise@latest to 2026.5.6.
Update cargo-deny@latest to 0.19.6.

`v2.77.6`: 2.77.6

Compare Source

Fix wasm-pack installation failure.
Update mise@latest to 2026.5.5.
Update release-plz@latest to 0.3.158.
Update just@latest to 1.51.0.

`v2.77.5`: 2.77.5

Compare Source

Update biome@latest to 2.4.15.
Update mise@latest to 2026.5.4.
Update cargo-deny@latest to 0.19.5.

`v2.77.4`: 2.77.4

Compare Source

Update tombi@latest to 0.11.1.
Update cargo-llvm-cov@latest to 0.8.6.
Update uv@latest to 0.11.12.

`v2.77.3`: 2.77.3

Compare Source

Update typos@latest to 1.46.1.
Update rclone@latest to 1.74.1.
Update tombi@latest to 0.11.0.
Update osv-scanner@latest to 2.3.8.
Update mise@latest to 2026.5.3.

`v2.77.2`: 2.77.2

Compare Source

Update martin@latest to 1.9.0.
Update wasm-bindgen@latest to 0.2.121.
Update uv@latest to 0.11.11.
Update mise@latest to 2026.5.1.
Update prek@latest to 0.3.13.
Update tombi@latest to 0.10.6.

voidzero-dev/setup-vp (voidzero-dev/setup-vp)

`v1.10.0`

Compare Source

What's Changed

chore(deps): update pnpm to v10.33.2 by @renovate[bot] in #64
chore(deps): update npm packages by @renovate[bot] in #62
fix: harden install retry with curl pipefail, fast timeouts, and GitHub fallback by @fengmk2 in #67

Full Changelog: voidzero-dev/setup-vp@v1.9.0...v1.10.0

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

Branch creation
- "before 10am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

netlify · 2026-05-17T16:43:35Z

✅ Deploy Preview for rolldown-rs canceled.

Name	Link
🔨 Latest commit	`8c9cf49`
🔍 Latest deploy log	https://app.netlify.com/projects/rolldown-rs/deploys/6a0ba094d5ea22000811ada7

codspeed-hq · 2026-05-17T16:49:29Z

Merging this PR will not alter performance

✅ 4 untouched benchmarks
⏩ 10 skipped benchmarks¹

_{Comparing renovate/github-actions (8c9cf49) with main (db8d4fc)²}

10 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩
No successful run was found on main (ab5ca3f) during the generation of this report, so db8d4fc was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

renovate · 2026-05-18T23:28:58Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@IWANABETHATGUY

## [1.0.2] - 2026-05-20 ### 🚀 Features - devtools: emit package size in PackageGraphReady (#9434) by @IWANABETHATGUY - devtools: classify package dependency types (#9427) by @IWANABETHATGUY - devtools: map packages to modules and chunks (#9426) by @IWANABETHATGUY - devtools: mark used packages (#9423) by @IWANABETHATGUY - devtools: make duplicate packages discoverable (#9422) by @IWANABETHATGUY - devtools: emit package metadata (#9421) by @IWANABETHATGUY - update oxc to 0.132.0 (#9449) by @shulaoda - update oxc to 0.131.0 (#9424) by @shulaoda - allow checks.* to escalate emissions to hard errors (#9388) by @IWANABETHATGUY - dev: support watcher options `include` and `exclude` (#9395) by @h-a-n-a - emit warnings for invalid pure annotations (#9381) by @Kyujenius ### 🐛 Bug Fixes - hash: keep chunk file names stable when an unrelated entry is added (#9444) by @hyf0 - call `codeSplitting.groups[].name` in deterministic order (#9457) by @sapphi-red - dev/lazy: make `resolve_id` idempotent when the resolved id is already a lazy entry (#9439) by @h-a-n-a - chunk-optimization: publish absorbed dynamic-entry namespace cross-chunk (#9448) by @IWANABETHATGUY - treeshake: propagate pure annotation through compound exprs (#9431) by @Dunqing - finalizer: skip redundant init call when barrel executes in same chunk (#9354) by @IWANABETHATGUY - linking: initialize wrapped ESM re-export owners (#9353) by @IWANABETHATGUY - do not inherit __toESM across chunks for named-only external imports (#9333) (#9415) by @IWANABETHATGUY - watcher: don't write output or emit events after close() (#9328) by @situ2001 - chunk-optimization: avoid unsafe dynamic-only merges (#9398) by @IWANABETHATGUY - cjs: rename CJS-wrapped locals that would shadow chunk-scope names (#9392) by @hyf0 - dev/lazy: watch lazy modules added in rebuilds (#9391) by @h-a-n-a ### 🚜 Refactor - rolldown_dev: move dev example to break publish cycle (#9465) by @Boshen - binding: drop unsafe napi string helper, hoist transform ArcStr (#9456) by @hyf0 - ecmascript_utils: split rewrite_ident_reference off JsxExt trait (#9417) by @IWANABETHATGUY - use `ThreadsafeFunction::call_async_catch` (#9390) by @sapphi-red ### 📚 Documentation - devtools: document @rolldown/debug usage and package graph consumption (#9435) by @IWANABETHATGUY - replace `Inter` with system font stack in OG template SVG (#9240) by @yvbopeng - remove `output.comments` warning as all issues have been resolved (#9393) by @sapphi-red - in-depth: clarify @__PURE__ scope and document positions (#9389) by @Kyujenius - readme: remove release candidate notice (#9387) by @shulaoda ### ⚡ Performance - vite-resolve: cache importer existence checks (#9443) by @Brooooooklyn - binding: reduce plugin string clones (#9436) by @Brooooooklyn ### 🧪 Testing - enable `legal_comments_inline` test (#9394) by @sapphi-red ### ⚙️ Miscellaneous Tasks - bump pnpm to v11.1.2 (#9447) by @Boshen - deps: update rust crates (#9461) by @renovate[bot] - deps: update rollup submodule for tests to v4.60.4 (#9453) by @rolldown-guard[bot] - deps: update test262 submodule for tests (#9454) by @rolldown-guard[bot] - deps: update npm packages (#9430) by @renovate[bot] - deps: update github actions (#9429) by @renovate[bot] - deps: update dependency rolldown-plugin-dts to v0.25.1 (#9452) by @renovate[bot] - deps: update rust crates (#9428) by @renovate[bot] - revert allow checks.* to escalate emissions to hard errors (#9388) (#9438) by @IWANABETHATGUY - update mimalloc-safe to 0.1.61 (#9413) by @shulaoda - deny `todo`, `unimplemented`, and `print_stderr` clippy lints (#9412) by @Boshen - deps: update mimalloc-safe to 0.1.60 (#9410) by @shulaoda - remove `pip install setuptools` workaround for node-gyp on macOS (#9370) by @sapphi-red - renovate: disable automerge to require manual approval (#9386) by @shulaoda - deps: update napi (#9385) by @renovate[bot] ### ❤️ New Contributors * @yvbopeng made their first contribution in [#9240](#9240) Co-authored-by: shulaoda <165626830+shulaoda@users.noreply.github.com>

This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [actions/create-github-app-token](https://redirect.github.com/actions/create-github-app-token) | action | minor | `v3.1.1` → `v3.2.0` | | | [taiki-e/install-action](https://redirect.github.com/taiki-e/install-action) | action | minor | `v2.77.1` → `v2.78.0` | `v2.79.0` (+3) | | [voidzero-dev/setup-vp](https://redirect.github.com/voidzero-dev/setup-vp) | action | minor | `v1.9.0` → `v1.10.0` | | --- ### Release Notes <details> <summary>actions/create-github-app-token (actions/create-github-app-token)</summary> ### [`v3.2.0`](https://redirect.github.com/actions/create-github-app-token/releases/tag/v3.2.0) [Compare Source](https://redirect.github.com/actions/create-github-app-token/compare/v3.1.1...v3.2.0) ##### Features - add support for enterprise-level GitHub Apps ([#&rolldown#8203;263](https://redirect.github.com/actions/create-github-app-token/issues/263)) ([952a2a7](https://redirect.github.com/actions/create-github-app-token/commit/952a2a7073df6bfa5f49bc469ec895b6ec1acea4)) - support full repository names in `repositories` input ([#&rolldown#8203;372](https://redirect.github.com/actions/create-github-app-token/issues/372)) ([85eb8dd](https://redirect.github.com/actions/create-github-app-token/commit/85eb8dd41472213aed25d1a126460e0069138ab6)) ##### Bug Fixes - **deps:** bump [@&rolldown#8203;actions/core](https://redirect.github.com/actions/core) from 3.0.0 to 3.0.1 in the production-dependencies group ([#&rolldown#8203;364](https://redirect.github.com/actions/create-github-app-token/issues/364)) ([43e5c34](https://redirect.github.com/actions/create-github-app-token/commit/43e5c345bfd4d4f3ecea019ad0042001a09dd857)) - validate private-key input ([#&rolldown#8203;376](https://redirect.github.com/actions/create-github-app-token/issues/376)) ([f24bbd8](https://redirect.github.com/actions/create-github-app-token/commit/f24bbd89643991c0de27ae823c01791b2c6bafdd)) </details> <details> <summary>taiki-e/install-action (taiki-e/install-action)</summary> ### [`v2.78.0`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.78.0): 2.78.0 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.77.7...v2.78.0) - Support `cargo-mutants`. ([#&rolldown#8203;1812](https://redirect.github.com/taiki-e/install-action/pull/1812), thanks [@&rolldown#8203;jakewimmer](https://redirect.github.com/jakewimmer)) - Update `covgate@latest` to 0.2.0. - Update `cargo-llvm-cov@latest` to 0.8.7. - Update `uv@latest` to 0.11.14. - Update `martin@latest` to 1.9.1. - Update `tombi@latest` to 0.11.4. ### [`v2.77.7`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.77.7): 2.77.7 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.77.6...v2.77.7) - Update `mise@latest` to 2026.5.6. - Update `cargo-deny@latest` to 0.19.6. ### [`v2.77.6`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.77.6): 2.77.6 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.77.5...v2.77.6) - Fix `wasm-pack` installation failure. - Update `mise@latest` to 2026.5.5. - Update `release-plz@latest` to 0.3.158. - Update `just@latest` to 1.51.0. ### [`v2.77.5`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.77.5): 2.77.5 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.77.4...v2.77.5) - Update `biome@latest` to 2.4.15. - Update `mise@latest` to 2026.5.4. - Update `cargo-deny@latest` to 0.19.5. ### [`v2.77.4`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.77.4): 2.77.4 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.77.3...v2.77.4) - Update `tombi@latest` to 0.11.1. - Update `cargo-llvm-cov@latest` to 0.8.6. - Update `uv@latest` to 0.11.12. ### [`v2.77.3`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.77.3): 2.77.3 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.77.2...v2.77.3) - Update `typos@latest` to 1.46.1. - Update `rclone@latest` to 1.74.1. - Update `tombi@latest` to 0.11.0. - Update `osv-scanner@latest` to 2.3.8. - Update `mise@latest` to 2026.5.3. ### [`v2.77.2`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.77.2): 2.77.2 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.77.1...v2.77.2) - Update `martin@latest` to 1.9.0. - Update `wasm-bindgen@latest` to 0.2.121. - Update `uv@latest` to 0.11.11. - Update `mise@latest` to 2026.5.1. - Update `prek@latest` to 0.3.13. - Update `tombi@latest` to 0.10.6. </details> <details> <summary>voidzero-dev/setup-vp (voidzero-dev/setup-vp)</summary> ### [`v1.10.0`](https://redirect.github.com/voidzero-dev/setup-vp/releases/tag/v1.10.0) [Compare Source](https://redirect.github.com/voidzero-dev/setup-vp/compare/v1.9.0...v1.10.0) ##### What's Changed - chore(deps): update pnpm to v10.33.2 by [@&rolldown#8203;renovate](https://redirect.github.com/renovate)\[bot] in [#&rolldown#8203;64](https://redirect.github.com/voidzero-dev/setup-vp/pull/64) - chore(deps): update npm packages by [@&rolldown#8203;renovate](https://redirect.github.com/renovate)\[bot] in [#&rolldown#8203;62](https://redirect.github.com/voidzero-dev/setup-vp/pull/62) - fix: harden install retry with curl pipefail, fast timeouts, and GitHub fallback by [@&rolldown#8203;fengmk2](https://redirect.github.com/fengmk2) in [#&rolldown#8203;67](https://redirect.github.com/voidzero-dev/setup-vp/pull/67) **Full Changelog**: <voidzero-dev/setup-vp@v1.9.0...v1.10.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Asia/Shanghai) - Branch creation - "before 10am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rolldown/rolldown).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: shulaoda <165626830+shulaoda@users.noreply.github.com>

@IWANABETHATGUY

## [1.0.2] - 2026-05-20 ### 🚀 Features - devtools: emit package size in PackageGraphReady (rolldown#9434) by @IWANABETHATGUY - devtools: classify package dependency types (rolldown#9427) by @IWANABETHATGUY - devtools: map packages to modules and chunks (rolldown#9426) by @IWANABETHATGUY - devtools: mark used packages (rolldown#9423) by @IWANABETHATGUY - devtools: make duplicate packages discoverable (rolldown#9422) by @IWANABETHATGUY - devtools: emit package metadata (rolldown#9421) by @IWANABETHATGUY - update oxc to 0.132.0 (rolldown#9449) by @shulaoda - update oxc to 0.131.0 (rolldown#9424) by @shulaoda - allow checks.* to escalate emissions to hard errors (rolldown#9388) by @IWANABETHATGUY - dev: support watcher options `include` and `exclude` (rolldown#9395) by @h-a-n-a - emit warnings for invalid pure annotations (rolldown#9381) by @Kyujenius ### 🐛 Bug Fixes - hash: keep chunk file names stable when an unrelated entry is added (rolldown#9444) by @hyf0 - call `codeSplitting.groups[].name` in deterministic order (rolldown#9457) by @sapphi-red - dev/lazy: make `resolve_id` idempotent when the resolved id is already a lazy entry (rolldown#9439) by @h-a-n-a - chunk-optimization: publish absorbed dynamic-entry namespace cross-chunk (rolldown#9448) by @IWANABETHATGUY - treeshake: propagate pure annotation through compound exprs (rolldown#9431) by @Dunqing - finalizer: skip redundant init call when barrel executes in same chunk (rolldown#9354) by @IWANABETHATGUY - linking: initialize wrapped ESM re-export owners (rolldown#9353) by @IWANABETHATGUY - do not inherit __toESM across chunks for named-only external imports (rolldown#9333) (rolldown#9415) by @IWANABETHATGUY - watcher: don't write output or emit events after close() (rolldown#9328) by @situ2001 - chunk-optimization: avoid unsafe dynamic-only merges (rolldown#9398) by @IWANABETHATGUY - cjs: rename CJS-wrapped locals that would shadow chunk-scope names (rolldown#9392) by @hyf0 - dev/lazy: watch lazy modules added in rebuilds (rolldown#9391) by @h-a-n-a ### 🚜 Refactor - rolldown_dev: move dev example to break publish cycle (rolldown#9465) by @Boshen - binding: drop unsafe napi string helper, hoist transform ArcStr (rolldown#9456) by @hyf0 - ecmascript_utils: split rewrite_ident_reference off JsxExt trait (rolldown#9417) by @IWANABETHATGUY - use `ThreadsafeFunction::call_async_catch` (rolldown#9390) by @sapphi-red ### 📚 Documentation - devtools: document @rolldown/debug usage and package graph consumption (rolldown#9435) by @IWANABETHATGUY - replace `Inter` with system font stack in OG template SVG (rolldown#9240) by @yvbopeng - remove `output.comments` warning as all issues have been resolved (rolldown#9393) by @sapphi-red - in-depth: clarify @__PURE__ scope and document positions (rolldown#9389) by @Kyujenius - readme: remove release candidate notice (rolldown#9387) by @shulaoda ### ⚡ Performance - vite-resolve: cache importer existence checks (rolldown#9443) by @Brooooooklyn - binding: reduce plugin string clones (rolldown#9436) by @Brooooooklyn ### 🧪 Testing - enable `legal_comments_inline` test (rolldown#9394) by @sapphi-red ### ⚙️ Miscellaneous Tasks - bump pnpm to v11.1.2 (rolldown#9447) by @Boshen - deps: update rust crates (rolldown#9461) by @renovate[bot] - deps: update rollup submodule for tests to v4.60.4 (rolldown#9453) by @rolldown-guard[bot] - deps: update test262 submodule for tests (rolldown#9454) by @rolldown-guard[bot] - deps: update npm packages (rolldown#9430) by @renovate[bot] - deps: update github actions (rolldown#9429) by @renovate[bot] - deps: update dependency rolldown-plugin-dts to v0.25.1 (rolldown#9452) by @renovate[bot] - deps: update rust crates (rolldown#9428) by @renovate[bot] - revert allow checks.* to escalate emissions to hard errors (rolldown#9388) (rolldown#9438) by @IWANABETHATGUY - update mimalloc-safe to 0.1.61 (rolldown#9413) by @shulaoda - deny `todo`, `unimplemented`, and `print_stderr` clippy lints (rolldown#9412) by @Boshen - deps: update mimalloc-safe to 0.1.60 (rolldown#9410) by @shulaoda - remove `pip install setuptools` workaround for node-gyp on macOS (rolldown#9370) by @sapphi-red - renovate: disable automerge to require manual approval (rolldown#9386) by @shulaoda - deps: update napi (rolldown#9385) by @renovate[bot] ### ❤️ New Contributors * @yvbopeng made their first contribution in [rolldown#9240](rolldown#9240) Co-authored-by: shulaoda <165626830+shulaoda@users.noreply.github.com>

chore(deps): update github actions

635151e

shulaoda self-assigned this May 18, 2026

Merge branch 'main' into renovate/github-actions

8c9cf49

shulaoda approved these changes May 18, 2026

View reviewed changes

shulaoda merged commit 85a36e0 into main May 18, 2026
55 checks passed

shulaoda deleted the renovate/github-actions branch May 18, 2026 23:35

rolldown-guard Bot mentioned this pull request May 20, 2026

release: v1.0.2 #9478

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update github actions#9429

chore(deps): update github actions#9429
shulaoda merged 2 commits into
mainfrom
renovate/github-actions

renovate Bot commented May 17, 2026

Uh oh!

netlify Bot commented May 17, 2026 •

edited

Loading

Uh oh!

codspeed-hq Bot commented May 17, 2026 •

edited

Loading

Uh oh!

renovate Bot commented May 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented May 17, 2026

Release Notes

v3.2.0

Features

Bug Fixes

v2.78.0: 2.78.0

v2.77.7: 2.77.7

v2.77.6: 2.77.6

v2.77.5: 2.77.5

v2.77.4: 2.77.4

v2.77.3: 2.77.3

v2.77.2: 2.77.2

v1.10.0

What's Changed

Configuration

Uh oh!

netlify Bot commented May 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for rolldown-rs canceled.

Uh oh!

codspeed-hq Bot commented May 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

renovate Bot commented May 18, 2026

Edited/Blocked Notification

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`v3.2.0`

`v2.78.0`: 2.78.0

`v2.77.7`: 2.77.7

`v2.77.6`: 2.77.6

`v2.77.5`: 2.77.5

`v2.77.4`: 2.77.4

`v2.77.3`: 2.77.3

`v2.77.2`: 2.77.2

`v1.10.0`

netlify Bot commented May 17, 2026 •

edited

Loading

codspeed-hq Bot commented May 17, 2026 •

edited

Loading