[dependabot]

Bumps the npm-production group with 1 update: @rollup/rollup-linux-x64-gnu.

Updates @rollup/rollup-linux-x64-gnu from 4.64.0 to 4.64.5

Release notes

Sourced from @​rollup/rollup-linux-x64-gnu's releases.

v4.64.5

4.64.5

2026-10-10

Bug Fixes

• Prevent cycles when using indirect top-level await for dynamic imports (#6516)

Pull Requests

• #6516: fix: prevent cycles for indirectly awaited dynamic imports (@​ryanchou1994, @​lukastaegert)

v4.64.4

4.64.4

2026-10-10

Bug Fixes

• Support the Rollup WASM build on big-endian hosts (#6559)

Pull Requests

• #6559: fix: read the AST buffer correctly on big-endian hosts (@​pkubaj, @​lukastaegert)
• #6566: Update dtolnay/rust-toolchain digest to 89b1218 (@​renovate[bot], @​lukastaegert)
• #6567: Update minor/patch updates (@​renovate[bot])
• #6568: Update dependency eslint-plugin-unicorn to v77 (@​renovate[bot], @​lukastaegert)
• #6569: Improve PR testing instructions comments (@​lukastaegert)

v4.64.3

4.64.3

2026-10-08

Bug Fixes

• Fix a performance regression when bundling code with deeply nested property calls (#6565)

Pull Requests

• #6565: Fix path-dependent explosion when including call arguments of reassigned variables (@​lukastaegert)

v4.64.2

4.64.2

2026-10-07

Bug Fixes

... (truncated)

Changelog

Sourced from @​rollup/rollup-linux-x64-gnu's changelog.

4.64.5

2026-10-10

Bug Fixes

• Prevent cycles when using indirect top-level await for dynamic imports (#6516)

Pull Requests

• #6516: fix: prevent cycles for indirectly awaited dynamic imports (@​ryanchou1994, @​lukastaegert)

4.64.4

2026-10-10

Bug Fixes

• Support the Rollup WASM build on big-endian hosts (#6559)

Pull Requests

• #6559: fix: read the AST buffer correctly on big-endian hosts (@​pkubaj, @​lukastaegert)
• #6566: Update dtolnay/rust-toolchain digest to 89b1218 (@​renovate[bot], @​lukastaegert)
• #6567: Update minor/patch updates (@​renovate[bot])
• #6568: Update dependency eslint-plugin-unicorn to v77 (@​renovate[bot], @​lukastaegert)
• #6569: Improve PR testing instructions comments (@​lukastaegert)

4.64.3

2026-10-08

Bug Fixes

• Fix a performance regression when bundling code with deeply nested property calls (#6565)

Pull Requests

• #6565: Fix path-dependent explosion when including call arguments of reassigned variables (@​lukastaegert)

4.64.2

2026-10-07

Bug Fixes

• Fix a regression where certain CoreJS helpers were wrongly tree-shaken (#6562)
• Do not show errors from closeBundle if there were also build errors (#6554)

Pull Requests

... (truncated)

Commits

• 05a2938 4.64.5
• d45f8e8 fix: prevent cycles for indirectly awaited dynamic imports (#6516)
• 9568144 4.64.4
• c3e3b46 fix: read the AST buffer correctly on big-endian hosts (#6559)
• 7207ba8 Improve PR testing instructions comments (#6569)
• 00ed55e Update dependency eslint-plugin-unicorn to v77 (#6568)
• 244f013 Update dtolnay/rust-toolchain digest to 89b1218 (#6566)
• 89fb3b6 Update minor/patch updates (#6567)
• eea952f 4.64.3
• f1f7c4a Fix path-dependent explosion when including call arguments of reassigned vari...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[github-actions]

Non-blocking: this entry doesn't match package.json, which still lists @rollup/rollup-linux-x64-gnu only under optionalDependencies: "*". That's a common Dependabot lockfile artifact.

The bump also does nothing for builds. rollup is still 4.64.0 and pins its native binary exactly, so npm adds a nested node_modules/rollup/node_modules/@rollup/rollup-linux-x64-gnu@4.64.0 (line ~10347). Rollup resolves that nested copy first, so the root 4.64.5 copy is never loaded.

Consider closing this PR and bumping rollup and the native package together. Alternatively, regenerate the lockfile with npm install so the root dependencies matches package.json.

[bens-agent]

Superseded by #133, which is now on main. It bumped rollup to ^4.64.5, and the lockfile on main resolves both rollup and @rollup/rollup-linux-x64-gnu to 4.64.5. There is no nested 4.64.0 copy, and the root dependencies block has no stray entry. That's the "bump rollup and the native package together" outcome suggested here, so this PR has nothing left to do.

---

Generated by Claude Code

[github-actions]

AI review: approve for 41773f1

Approving. This Dependabot PR changes only package-lock.json: it moves the root @rollup/rollup-linux-x64-gnu from 4.64.0 to 4.64.5. Nothing in src, dist or CI changes, and nothing in it is a security risk.

There's one non-blocking problem, which I posted as an inline comment at package-lock.json:14:

• Lockfile no longer matches package.json: the lockfile's root dependencies now lists the package at "4.64.5". package.json doesn't, and still declares it only as optionalDependencies: "*".
• The bump has no effect on builds: rollup is still 4.64.0 and requires exactly 4.64.0 of the native binary. npm therefore added a nested 4.64.0 copy inside rollup's own folder, and rollup loads that one, so the 4.64.5 copy is never used.

The fix is to bump rollup and the native package together, or regenerate the lockfile with npm install.

I couldn't check whether CI passes on this PR because running gh pr checks needed approval.

There were no earlier review threads or conversation to account for.

Review run

[dependabot]

Looks like @rollup/rollup-linux-x64-gnu is no longer updatable, so this is no longer needed.