[dependabot]

Bumps the npm-version group with 2 updates: @rollup/rollup-linux-x64-gnu and vite-plus.

Updates @rollup/rollup-linux-x64-gnu from 4.68.0 to 4.68.1

Release notes

Sourced from @​rollup/rollup-linux-x64-gnu's releases.

v4.68.1

4.68.1

2026-11-09

Bug Fixes

• Improve namespace object generation in cyclic imports (#6644)
• Warn about deleting or reassigning namespace members but make those operations catchable runtime errors (#6645)
• Do not generate invalid code for non-esm output when exporting destructing declarations with defaults (#6648)

Pull Requests

• #6638: docs: add missing options to the config file example (@​Aryapatel-007, @​lukastaegert)
• #6639: List --interop modes in CLI help instead of --no-interop (@​ZainnQureshii, @​lukastaegert)
• #6643: docs: update the ES modules sentence in the introduction (@​vigohan95)
• #6644: Defer namespace bindings initialized later in a cycle (@​mayankdhingra02)
• #6645: Preserve namespace property references in delete expressions (@​mayankdhingra02, @​lukastaegert)
• #6648: Fix invalid output for exported destructuring declarations with defaults (@​trleo, @​lukastaegert)

Changelog

Sourced from @​rollup/rollup-linux-x64-gnu's changelog.

4.68.1

2026-11-09

Bug Fixes

• Improve namespace object generation in cyclic imports (#6644)
• Warn about deleting or reassigning namespace members but make those operations catchable runtime errors (#6645)
• Do not generate invalid code for non-esm output when exporting destructing declarations with defaults (#6648)

Pull Requests

• #6638: docs: add missing options to the config file example (@​Aryapatel-007, @​lukastaegert)
• #6639: List --interop modes in CLI help instead of --no-interop (@​ZainnQureshii, @​lukastaegert)
• #6643: docs: update the ES modules sentence in the introduction (@​vigohan95)
• #6644: Defer namespace bindings initialized later in a cycle (@​mayankdhingra02)
• #6645: Preserve namespace property references in delete expressions (@​mayankdhingra02, @​lukastaegert)
• #6648: Fix invalid output for exported destructuring declarations with defaults (@​trleo, @​lukastaegert)

Commits

• d1728b6 4.68.1
• 4cd5590 Defer namespace bindings initialized later in a cycle (#6644)
• 6c83ced List --interop modes in CLI help instead of --no-interop (#6639)
• 8b1d2b3 Preserve namespace property references in delete expressions (#6645)
• 6be8a51 Fix invalid output for exported destructuring declarations with defaults (#6648)
• ca871b2 docs: update the ES modules sentence in the introduction (#6643)
• 73fae6e docs: add missing options to the config file example (#6638)
• See full diff in compare view

Updates vite-plus from 1.5.0 to 1.5.1

Release notes

Sourced from vite-plus's releases.

vite-plus v1.5.1

Vite+ 1.5.1 fixes two high-severity security issues in package-manager downloads and vp env use, restores interactive input in vp run tasks, fixes vp migrate config merges, and adds a reference page for each package command.

Features

• Upgrade the bundled Vite and Rolldown (#3390), by @​voidzero-guard[bot] and @​fengmk2:
  • vite@8.3.5 to vite@8.3.7. A pnpm install no longer turns every cached build into a cache miss, because Vite tells Vite Task to ignore node_modules/.modules.yaml. It also fixes named imports from Node.js built-ins and reloads in bundled dev mode, subpath imports (#) in the dependency optimizer, SSR builds with build.ssr: true, and chunks shared with workers.
  • rolldown@1.2.16 to rolldown@1.2.18, with module source maps that keep only the sources and names that they trace.
  • @voidzero-dev/vite-plus-core requires postcss@^8.5.32, as the bundled Vite does.

Fixes & Enhancements

• Security: Vite+ verifies the pnpm that it downloads for its own setup against a hash in the CLI, and checks a downloaded pnpm, Yarn 2+, or bun against the integrity hash in the project's packageManager field instead of the hash that the registry reports. A registry set in a project's .npmrc can no longer make Vite+ run a package manager that does not match (GHSA-5qr3-w62x-jmwx, high). Mirrors and private registries that serve the same package still pass. Each pinned version gets its own cache directory, so a project with a pinned package manager downloads it once more after the upgrade. Unpinned installs keep their current location (#3400), by @​fengmk2 and @​arkmarta.
• Security: vp env use and other dist-tag lookups, such as pnpm@latest, accept only a valid semver version from the registry, so a registry set in a project's .npmrc can no longer put shell commands into the statements that the vp env use shell wrapper runs (GHSA-p79r-mf8q-r78h, high) (#3395), by @​fengmk2 and @​arkmarta.
• Scripts that vp run starts get a blocking stdin again when the run block of vite.config.ts is not statically analyzable (for example, a task command held in a constant), so interactive prompts such as vp update --interactive wait for input instead of failing with EAGAIN (#3361), by @​everton-dgn.
• vp migrate changes only the return statements of a defineConfig callback, so functions inside the config, such as Rolldown codeSplitting.groups[].name callbacks, keep their return values and the build no longer fails. When a callback return cannot receive the merged settings, migration keeps the standalone config files and asks for a manual merge. Pack and task cache migration also recognize configs wrapped in parentheses, as, satisfies, <T>, or ! (#3325, #3372), by @​jong-kyung.
• vp create react-router passes --no-git-init to create-react-router, so the generator's initial commit no longer stops the Vite+ setup when no Git identity is configured (#3363), by @​chbaefront.
• env.fish calls fish built-ins through builtin, so vp env use changes the Node.js version even when a user function has the name of a built-in such as count (#3353), by @​naokihaba.
• Shell completion suggests full command names before aliases, so vp i<Tab> offers install and vp up<Tab> offers update. An alias stays available when no full name matches (#3337), by @​nekomoyi.
• Completion for vp run and vpr skips comment keys such as "# docs #" in package.json scripts, matches task names that contain :, and shows each task's command as its description in Zsh and Fish (#3354), by @​nekomoyi.
• vp pm dist-tag rm works with Yarn Berry, because Vite+ passes remove to yarn npm tag (#3358), by @​jong-kyung.

Docs

• Add a Package Management section to the guide, with a reference page for each of the 38 package commands that lists its options, package-manager support, version requirements, and npm fallbacks. Help output for package commands and the old package management and install URLs point to the new pages (docs) (#3105), by @​jong-kyung.
• Show the README logo that matches the GitHub theme, so the logo stays visible after a theme change (#3350), by @​fengmk2.

Chore

• Build Linux native bindings against the napi-cross glibc 2.17 sysroot with @napi-rs/cli@3.10.12, let the linker reject unresolved symbols, and run Linux CI on ubuntu-latest again. Let the dependency upgrade workflow change workflow files (#3349, #3384), by @​fengmk2.
• Refine contributor guidance: AGENTS.md separates the vite-plus package from the global vp CLI and replaces CLAUDE.md, and the Node.js version RFCs describe .nvmrc support (#3388, #3383), by @​liangmiQwQ and @​hyunbinseo.
• Resolve the docs theme aliases from import.meta.dirname, so the docs dev server no longer warns about __dirname (#3379), by @​liangmiQwQ.
• Fold the .node-version parse tests into one table (#3355), by @​Brooooooklyn.

Bundled Versions

Tool	Version	Source	Changelog
vite	8.3.7	5def936	8.3.6, 8.3.7
rolldown	1.2.18	f9a49d6	1.2.18
oxc-node	1.0.1	7ff14c3	unchanged
tsdown	0.23.4	npm	unchanged
vitest	5.1.0	npm	unchanged
oxlint	1.91.0	npm	unchanged
oxlint-tsgolint	7.0.2005	npm	unchanged
oxfmt	0.76.0	npm	unchanged

Upgrade

vp upgrade
</tr></table> 

... (truncated)

Commits

• e5defe1 release: v1.5.1 (#3401)
• a110977 fix(pm): verify and content-key managed package-manager installs (#3400)
• 37cb983 fix(cli): restore blocking stdin after loading a dynamic config (#3361)
• bb2d43e fix(create): skip React Router Git initialization (#3363)
• a32a8ce fix(build): use the napi-cross sysroot for native Linux builds (#3349)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions