chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@rollup/plugin-typescript (source)	12.1.2 -> 12.1.3
pnpm (source)	10.11.0 -> 10.12.1
rollup (source)	4.41.0 -> 4.43.0

---

Release Notes

rollup/plugins (@​rollup/plugin-typescript)

v12.1.3

2025-06-17

Bugfixes

• fix: fixes #​1652 compile when source exists anywhere in the working directory (#​1653)

pnpm/pnpm (pnpm)

v10.12.1

Minor Changes

• Experimental. Added support for global virtual stores. When enabled, node_modules contains only symlinks to a central virtual store, rather to node_modules/.pnpm. By default, this central store is located at <store-path>/links (you can find the store path by running pnpm store path).

  In the central virtual store, each package is hard linked into a directory whose name is the hash of its dependency graph. This allows multiple projects on the system to symlink shared dependencies from this central location, significantly improving installation speed when a warm cache is available.

  This is conceptually similar to how NixOS manages packages, using dependency graph hashes to create isolated and reusable package directories.

  To enable the global virtual store, set enableGlobalVirtualStore: true in your root pnpm-workspace.yaml, or globally via:

  pnpm config -g set enable-global-virtual-store true

  NOTE: In CI environments, where caches are typically cold, this setting may slow down installation. pnpm automatically disables the global virtual store when running in CI.

  Related PR: #​8190

• The pnpm update command now supports updating catalog: protocol dependencies and writes new specifiers to pnpm-workspace.yaml.
• Added two new CLI options (--save-catalog and --save-catalog-name=<name>) to pnpm add to save new dependencies as catalog entries. catalog: or catalog:<name> will be added to package.json and the package specifier will be added to the catalogs or catalog[<name>] object in pnpm-workspace.yaml #​9425.
• Semi-breaking. The keys used for side-effects caches have changed. If you have a side-effects cache generated by a previous version of pnpm, the new version will not use it and will create a new cache instead #​9605.
• Added a new setting called ci for explicitly telling pnpm if the current environment is a CI or not.

Patch Changes

• Sort versions printed by pnpm patch using semantic versioning rules.
• Improve the way the error message displays mismatched specifiers. Show differences instead of 2 whole objects #​9598.
• Revert #​9574 to fix a regression #​9596.

v10.11.1

Compare Source

Patch Changes

• Fix an issue in which pnpm deploy --legacy creates unexpected directories when the root package.json has a workspace package as a peer dependency #​9550.
• Dependencies specified via a URL that redirects will only be locked to the target if it is immutable, fixing a regression when installing from GitHub releases. (#​9531)
• Installation should not exit with an error if strictPeerDependencies is true but all issues are ignored by peerDependencyRules #​9505.
• Use pnpm_config_ env variables instead of npm_config_ #​9571.
• Fix a regression (in v10.9.0) causing the --lockfile-only flag on pnpm update to produce a different pnpm-lock.yaml than an update without the flag.
• Let pnpm deploy work in repos with overrides when inject-workspace-packages=true #​9283.
• Fixed the problem of path loss caused by parsing URL address. Fixes a regression shipped in pnpm v10.11 via #​9502.
• pnpm -r --silent run should not print out section #​9563.

rollup/rollup (rollup)

v4.43.0

Compare Source

2025-06-11

Features

• Provide new fs option and this.fs API to replace file system (#​5944)

Pull Requests

• #​5944: feat(options): Add an option for overriding the file system module in the JS API (@​EggDice, @​lukastaegert)

v4.42.0

Compare Source

2025-06-06

Features

• Add option to allow the input to be located in the output in watch mode (#​5966)

Pull Requests

• #​5966: feat: watch mode add allowInputInsideOutputPath option (@​btea, @​lukastaegert)

v4.41.2

Compare Source

2025-06-06

Bug Fixes

• Detect named export usages in dynamic imports with then and non-arrow function expressions (#​5977)
• Do not replace usages of constant variables with their values for readability (#​5968)

Pull Requests

• #​5968: fix: preserve constant identifiers in unary expressions instead of magic numbers (@​OmkarJ13, @​lukastaegert)
• #​5969: chore(deps): update dependency yargs-parser to v22 (@​renovate[bot], @​lukastaegert)
• #​5970: chore(deps): lock file maintenance minor/patch updates (@​renovate[bot])
• #​5971: chore(deps): lock file maintenance (@​renovate[bot])
• #​5976: Update README.md (@​ftlno, @​lukastaegert)
• #​5977: fix: consider function expression in thenable when tree-shaking dynamic imports (@​TrickyPi)
• #​5981: fix(deps): lock file maintenance minor/patch updates (@​renovate[bot])
• #​5982: Debug/fix watch pipeline (@​lukastaegert)

v4.41.1

Compare Source

2025-05-24

Bug Fixes

• If a plugin calls this.resolve with skipSelf: true, subsequent calls when handling this by the same plugin with same parameters will return null to avoid infinite recursions (#​5945)

Pull Requests

• #​5945: Avoid recursively calling a plugin's resolveId hook with same id and importer (@​younggglcy, @​lukastaegert)
• #​5963: fix(deps): update swc monorepo (major) (@​renovate[bot])
• #​5964: fix(deps): lock file maintenance minor/patch updates (@​renovate[bot])

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sourcery-ai]

Reviewer's Guide

Upgrade rollup from v4.41.0 to v4.41.1: the PR bumps the dependency in package.json and regenerates pnpm-lock.yaml to reflect the new version specifiers, integrity hashes, and updated plugin optionalDependencies.

Sequence Diagram: Rollup v4.41.1 this.resolve Behavior with skipSelf: true

sequenceDiagram
    participant P as "Plugin"
    participant R as "Rollup (v4.41.1)"

    P->>R: resolve(id, importer, { skipSelf: true })
    R-->>P: result1

    P->>R: resolve(id, importer, { skipSelf: true }) # Subsequent call by same plugin with same id & importer
    R-->>P: null

Loading

File-Level Changes

Change	Details	Files
Rollup dependency bumped to v4.41.1	Updated rollup version in package.json Adjusted rollup specifier and version under importer in pnpm-lock.yaml	package.json pnpm-lock.yaml
Lockfile entries regenerated for rollup and its plugins	Updated resolution integrity hashes for all platform-specific rollup packages Updated optionalDependencies version for @rollup/plugin-terser, @rollup/plugin-typescript, @rollup/pluginutils	pnpm-lock.yaml

Possibly linked issues

• #0: The PR updates the rollup dependency to v4.41.1, which is listed as an open update in the issue.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.