feat(deps): upgrade upstream dependencies

[voidzero-guard]

Summary

• Automated daily upgrade of upstream dependencies.
• Bumps rolldown to v1.0.1 and vite to v8.0.13, plus vitest 4.1.6, oxc/oxlint/oxfmt, and @vitejs/devtools 0.1.24.
• Switches @rolldown/pluginutils from a workspace build to the published ^1.0.0 package on npm, with matching adjustments in packages/core and packages/tools/src/sync-remote-deps.ts.
• Refreshes snap tests for the new oxlint --debug=OPTIONS flag and the updated rolldown parse-error message; lockfiles, prompts, and the org-tarball test are touched by formatter output only.

Dependency updates

Package	From	To
rolldown	ac5c710	v1.0.1 (2777945)
vite	66f3194	v8.0.13 (a46f11a)
vitest	4.1.5	4.1.6
oxfmt	0.48.0	0.50.0
oxlint	1.63.0	1.65.0
@oxc-project/runtime	0.129.0	0.131.0
@oxc-project/types	0.129.0	0.131.0
oxc-minify	0.129.0	0.131.0
oxc-parser	0.129.0	0.131.0
oxc-transform	0.129.0	0.131.0
@vitejs/devtools	0.1.21	0.1.24

Unchanged dependencies

• tsdown: 0.22.0
• @oxc-node/cli: 0.1.0
• @oxc-node/core: 0.1.0
• oxlint-tsgolint: 0.22.1

Code changes

• pnpm-workspace.yaml — add @rolldown/pluginutils ^1.0.0 to the catalog, remove its workspace override, bump rolldown-plugin-dts to ^0.25.0, valibot to 1.4.0, vitepress-plugin-graphviz to ^0.1.0, and the vitest-dev override to ^4.1.6.
• packages/core/package.json — add @rolldown/pluginutils (from catalog) as a direct dependency, switch ./rolldown/pluginutils and ./rolldown/pluginutils/filter exports to .mjs/.d.mts, and bump bundled vite to 8.0.13 and rolldown to 1.0.1.
• packages/core/build.ts — resolve rolldownPluginUtilsDir from packages/core/node_modules/@rolldown/pluginutils instead of the rolldown subproject.
• packages/tools/src/sync-remote-deps.ts — handle .mjs/.d.mts extensions in pluginutils export rewriting and read pluginutils/package.json from packages/core/node_modules/@rolldown/pluginutils.
• .github/actions/build-upstream/action.yml — drop the pnpm --filter @rolldown/pluginutils build step now that pluginutils ships from npm.
• packages/test/package.json — bump all @vitest/* deps, the vitest-dev dep, and the @vitest/coverage-*/@vitest/ui peer deps to 4.1.6, and update bundled vitest to 4.1.6.
• packages/cli/snap-tests/bin-oxlint-wrapper/snap.txt, packages/cli/snap-tests/command-helper/snap.txt — refresh for the new oxlint --debug=OPTIONS (per-rule timings) flag.
• packages/cli/snap-tests-global/command-staged-broken-config/snap.txt — refresh for the rolldown [PARSE_ERROR] message change.
• packages/cli/src/create/__tests__/org-tarball.spec.ts, packages/prompts/src/group-multi-select.ts, packages/prompts/src/progress-bar.ts, packages/prompts/src/select-key.ts — formatter output hoisting helpers to module scope.
• Cargo.lock, pnpm-lock.yaml — lockfile updates for the bumps above.

Build status

• sync-remote-and-build: failure
• build-upstream: failure

[netlify]

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	307a3aa
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a0a70cd6aec6f00082e8c78

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​oxc-project/​types@​0.131.0
	npm/​@​oxc-project/​runtime@​0.131.0
	npm/​@​vitest/​ui@​4.1.5 ⏵ 4.1.6
	npm/​@​vitejs/​devtools@​0.1.24
	npm/​@​vitest/​coverage-v8@​4.1.5 ⏵ 4.1.6
	npm/​@​types/​node@​24.12.4
	npm/​@​vitest/​coverage-istanbul@​4.1.5 ⏵ 4.1.6
	npm/​@​vitest/​browser-preview@​4.1.5 ⏵ 4.1.6
	npm/​@​vitest/​browser-webdriverio@​4.1.5 ⏵ 4.1.6
	npm/​unrun@​0.3.0
	npm/​oxfmt@​0.50.0
	npm/​terser@​5.47.1
	npm/​eslint-plugin-n@​18.0.1
	npm/​oxc-transform@​0.131.0
	npm/​oxc-parser@​0.131.0

View full report