chore: update dependency tsdown to ^0.21.8

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
tsdown (source)	^0.16.8 → ^0.21.8

---

Release Notes

rolldown/tsdown (tsdown)

v0.21.8

Compare Source

   🚀 Features

• Upgrade rolldown  -  by @​sxzz (7f887)
• attw: Improve ignoreRules type to autocomplete known values  -  by @​mrlubos in #​892 (c8f5c)
• create-tsdown: Add Vite Plus template option  -  by @​sxzz (daed0)
• exports: Add extensions option for subpath export keys  -  by @​SinhSinhAn and @​sxzz in #​899 (1bb7a)
• target: Add support for baseline-widely-available target  -  by @​sxzz in #​896 (d6a16)

   🐞 Bug Fixes

• Export type only for cjs dts re-export  -  by @​sxzz (25510)
• Exclude shim file from bundled dependency hint  -  by @​sxzz in #​909 (3f8de)
• dts: Skip cjs dts reexport for non-entry chunks  -  by @​sxzz (5fee2)

    View changes on GitHub

v0.21.7

Compare Source

   🚀 Features

• Add module option for attw and publint to allow passing imported modules directly  -  by @​sxzz (31e90)

   🐞 Bug Fixes

• deps: Add skipNodeModulesBundle dep subpath e2e tests and fix docs  -  by @​sxzz (deff7)

    View changes on GitHub

v0.21.6

Compare Source

   🚀 Features

• Upgrade rolldown to v1.0.0-rc.12  -  by @​sxzz (51292)
• config:
  • Pass root config to workspace config functions  -  by @​sxzz (76169)
  • Use mergeConfig for workspace config merging and support variadic overrides  -  by @​sxzz (148aa)
• dts:
  • Add cjsReexport option to eliminate dual module type hazard  -  by @​mandarini and @​sxzz in #​856 (875c1)
• exports:
  • Add bin option to auto-generate package.json bin field  -  by @​sxzz in #​869 (7ebd6)

   🐞 Bug Fixes

• css:
  • Compile preprocessor langs in virtual CSS modules  -  by @​sxzz in #​865 (7b2e0)
  • Strip .module from CSS output filenames  -  by @​sxzz in #​866 (03ade)
  • Default splitting to true in unbundle mode for CSS inject  -  by @​sxzz in #​867 (a4da6)
  • Split CSS plugin into pre/post phases for scoped CSS support  -  by @​sxzz in #​870 (ff0c4)
• entry:
  • Correctly output relative paths in logger output  -  by @​sxzz (00050)

    View changes on GitHub

v0.21.5

Compare Source

   🚀 Features

• Update rolldown to 1.0.0-rc.10  -  by @​wChenonly in #​845 (41411)
• Support typescript v6  -  by @​ocavue in #​858 (bffc4)

   🐞 Bug Fixes

• css:
  • Run final minification on merged CSS output  -  by @​sxzz in #​853 (475df)
  • Don't override internal importer  -  by @​Laupetin in #​860 (af40e)
  • Use aliased exports for CSS module keys  -  by @​wChenonly and @​sxzz in #​840 (bb6de)
• deps:
  • External optionalDependencies by default  -  by @​sxzz (cd24d)
  • Resolve subpath extensions for packages without exports field  -  by @​sxzz in #​863 (c5150)
  • Correctly resolve root @types packages for dts deep imports  -  by @​brc-dd and @​sxzz in #​852 (0b276)

    View changes on GitHub

v0.21.4

Compare Source

   🚀 Features

• css: Add CSS modules support  -  by @​sxzz in #​834 (2a88a)

   🐞 Bug Fixes

• exports: Preserve CRLF line endings in package.json  -  by @​sxzz (a4d4e)

    View changes on GitHub

v0.21.3

Compare Source

   🚀 Features

• copy: Add support for watching copy source files  -  by @​schplitt in #​721 (7c23a)

   🐞 Bug Fixes

• css: Watch inline CSS files in watch mode  -  by @​sxzz (2051a)
• exports: Sort inlined dependencies by package name  -  by @​sxzz (0ec71)
• publint: Support Yarn v1  -  by @​sxzz (4a291)
• unbundle: Root should be lowest common ancestor of entry files  -  by @​sxzz (f1823)

    View changes on GitHub

v0.21.2

Compare Source

   🚨 Breaking Changes

• exe: Add exe.outDir for separate executable output dir, defaults to build  -  by @​sxzz (d49ef)

Note: Executable is still an experimental feature and does not follow SemVer. Breaking changes may occur in any release.

   🚀 Features

• Add root option for controlling output directory structure  -  by @​sxzz (bad2d)
• deps: Rename onlyAllowBundle to onlyBundle  -  by @​peaklabs-dev and @​sxzz in #​819 (cbd7b)

   🐞 Bug Fixes

• css: Skip data URIs and external URLs in CSS url() rebasing  -  by @​sxzz (13907)

    View changes on GitHub

v0.21.1

Compare Source

   🚨 Breaking Changes

• css: Move all CSS support to @tsdown/css package  -  by @​sxzz in #​809 (1b1a1)

[!IMPORTANT]
If you are using CSS features (e.g., CSS imports), you now need to manually install the @tsdown/css package:

npm install @​tsdown/css -D
# or
pnpm add @​tsdown/css -D

Note: CSS support is still an experimental feature and does not follow SemVer. Breaking changes may occur in any release.

   🚀 Features

• css:
  • Add css.inject option to preserve CSS imports in JS output  -  by @​sxzz and Claude Haiku 4.5 in #​808 (ad745)
  • Support ?inline query for CSS imports  -  by @​sxzz in #​810 (b7379)
  • Support node_modules package resolution  -  by @​sxzz and Claude Haiku 4.5 in #​812 (b06b4)

   🐞 Bug Fixes

• Generate correct filename for sass files when dts is enabled  -  by @​ocavue in #​802 (848a7)
• css:
  • Handle virtual module IDs from framework plugins  -  by @​sxzz (c421f)
  • Ignore css imports with URL query  -  by @​ocavue and @​sxzz in #​806 (c1d23)

    View changes on GitHub

v0.21.0

Compare Source

v0.21.0 - Notable Changes

Breaking Changes

Dependency options renamed to deps namespace

The dependency-related options have been moved under a new deps namespace with clearer names:

• external -> deps.neverBundle
• noExternal -> deps.alwaysBundle
• inlineOnly -> deps.onlyAllowBundle
• skipNodeModulesBundle -> deps.skipNodeModulesBundle

Before:

export default defineConfig({
  external: ['vue'],
  noExternal: ['lodash'],
})

After:

export default defineConfig({
  deps: {
    neverBundle: ['vue'],
    alwaysBundle: ['lodash'],
  },
})

The old options still work but are deprecated and will emit warnings.

failOnWarn default changed from 'ci-only' to false

If you relied on the previous behavior where warnings would fail the build in CI environments, you now need to explicitly set failOnWarn: true or failOnWarn: 'ci-only' in your config.

Node.js < 22.18.0 deprecated

tsdown now emits a deprecation warning when running on Node.js versions below 22.18.0. Plan to upgrade your Node.js version accordingly.

New Features

Experimental Node.js SEA executable bundling (exe)

tsdown can now bundle your TypeScript project into a standalone executable using Node.js Single Executable Applications (SEA). A new @tsdown/exe package provides cross-platform executable building support. See the exe documentation for details.

export default defineConfig({
  exe: true, // or { useCodeCache: true, useSnapshot: true }
})

Full CSS pipeline with @tsdown/css

CSS handling has been reimplemented as a native Rolldown plugin and extracted into the @tsdown/css package, providing a complete CSS pipeline with Lightning CSS and PostCSS support via the css.transformer option. See the CSS documentation for details.

inlinedDependencies field in package.json

When using the exports feature, tsdown now auto-generates an inlinedDependencies field in your package.json, listing dependencies that are bundled into the output.

Object option for customExports

customExports now supports an object format for more fine-grained control over the generated exports field.

Migration Guide

1. Update dependency options: Rename external -> deps.neverBundle, noExternal -> deps.alwaysBundle, etc.
2. Check failOnWarn: If you need warnings to fail the build in CI, explicitly set failOnWarn: 'ci-only' or failOnWarn: true.
3. Upgrade Node.js: Ensure you're running Node.js >= 22.18.0 to avoid deprecation warnings.

Links

• tsdown Documentation
• v0.21.0-beta.1 Release
• v0.21.0-beta.2 Release
• v0.21.0-beta.3 Release
• v0.21.0-beta.4 Release
• v0.21.0-beta.5 Release
• Full diff from v0.20.3

---

   🚨 Breaking Changes

• Change failOnWarn default from 'ci-only' to false  -  by @​sxzz (ad8db)
• exe: Require Node >=25.7 and default format to esm  -  by @​sxzz in #​798 (0173c)

   🚀 Features

• Rename dependency options to deps namespace  -  by @​sxzz (7f509)
• Upgrade rolldown  -  by @​sxzz (7a528)
• Deprecate Node.js versions below 22.18.0  -  by @​sxzz (439f1)
• Support bundling .node files by default  -  by @​sxzz (944e9)
• css:
  • Implement full CSS pipeline as Rolldown plugin  -  by @​sxzz in #​787 (dbe3c)
  • Extract CSS pipeline into @tsdown/css package  -  by @​sxzz in #​790 (e4cbe)
  • Add PostCSS support with css.transformer option  -  by @​sxzz in #​791 (35bef)
  • Default css.transformer to lightningcss  -  by @​sxzz in #​797 (288a5)
• exe:
  • Add experimental Node.js SEA executable bundling  -  by @​sxzz in #​777 (418d5)
  • Add cross-platform executable building via @tsdown/exe  -  by @​sxzz in #​786 (b6833)
  • Support latest and latest-lts for nodeVersion  -  by @​sxzz (ce7ab)
• exports:
  • Support object option for customExports  -  by @​Joery-M and @​sxzz in #​769 (7fb72)
  • Add inlinedDependencies field to package.json  -  by @​sxzz in #​785 (5c71f)
• migrate:
  • Migrate external/noExternal to deps namespace  -  by @​sxzz (c59e7)

   🐞 Bug Fixes

• Apply failOnWarn to rolldown logs  -  by @​sxzz (149dc)
• Debounce onSuccess in watch mode to prevent duplicate execution  -  by @​sxzz (af748)
• Don't fail on PLUGIN_TIMINGS warnings when failOnWarn is enabled  -  by @​sxzz (9872a)
• Resolve css files in node_modules  -  by @​ocavue, @​sxzz and Rei in #​795 (d8a1f)
• config: Handle known Node.js bug in nativeImport error handling  -  by @​sxzz (e4230)
• copy: Don't warn if no files specified  -  by @​adamlohner, @​cursoragent and @​sxzz in #​780 (afaab)
• css: Remove empty js chunks  -  by @​ocavue and @​sxzz in #​799 (1183a)
• exe: Use runtime semver check for ESM SEA default format  -  by @​sxzz (5321c)
• exports: Include non-entry chunks in exports when all is true  -  by @​sxzz (79492)
• hooks: Set cwd for onSuccess  -  by @​sxzz (c114a)
• node-protocol: Respect alias and tsconfig paths when stripping node: prefix  -  by @​lazuee in #​773 (b1dd2)
• watch: Re-glob entry files on create/delete events  -  by @​sxzz (a1969)

    View changes on GitHub

v0.20.3

Compare Source

   🐞 Bug Fixes

• package: Ignore scripts when packing  -  by @​sxzz (0b10b)

    View changes on GitHub

v0.20.2

Compare Source

   🚀 Features

• Upgrade rolldown to 1.0.0-rc.3  -  by @​sxzz (0beea)
• dep: Keep inlineOnly clean with hint message on unused  -  by @​jycouet and @​sxzz in #​725 (13f1c)
• pkg: Optimize attw and publint packing  -  by @​sxzz in #​736 (375cf)

   🐞 Bug Fixes

• Throw error when skipNodeModulesBundle and noExternal are used together  -  by @​sxzz in #​746 (656d5)
• External type only packages @types/*  -  by @​kalvenschraut (0be7c)
• exports: Move import before require  -  by @​sxzz (3027a)

    View changes on GitHub

v0.20.1

Compare Source

   🚀 Features

• inline-only: Show warnings if bundled deps  -  by @​sxzz (1e0e7)

    View changes on GitHub

v0.20.0

Compare Source

   🚨 Breaking Changes

• Upgrade dts plugin, remove dts.resolve option  -  by @​sxzz (16655)

   🚀 Features

• Add option to disable legacy CJS warning  -  by @​sxzz (9fada)
• Apply inlineOnly option for dts files  -  by @​sxzz (7d89d)
• Upgrade rolldown to 1.0.0-beta.60  -  by @​sxzz (bb3ee)
• Upgrade rolldown to rc 1  -  by @​sxzz (1959f)
• entry: Support mixed array and object entries  -  by @​sxzz (a8083)

   🐞 Bug Fixes

• Optional parseEnv  -  by @​sxzz (be1b6)
• Reload config on restart  -  by @​sxzz (1756b)
• Config extensions typo  -  by @​aryaemami59 in #​722 (d2bb7)
• windows: Normalize path separators in build output  -  by @​ryuapp in #​719 (c4525)

   🏎 Performance

• Native filter for external plugin  -  by @​sxzz (8764e)

    View changes on GitHub

v0.19.0

Compare Source

   🚨 Breaking Changes

• Rename debugLogs to debug  -  by @​sxzz (bb4e7)
• Remove deprecated silent option  -  by @​sxzz (59015)
• devtools:
  • Rename debug to devtools, rename debug.devtools to devtools.ui  -  by @​sxzz (63e6f)
• exports:
  • Add legacy option, remove main & module fields if pure ESM  -  by @​sxzz (16841)
  • Exclude extension name for exports.exclude  -  by @​sxzz (53d38)
  • Only auto-fill types when exports.legacy  -  by @​lishaduck and @​sxzz in #​685 (7be6b)

   🚀 Features

• Add typeAssert util back  -  by @​sxzz (1d385)
• Generate CSS exports when css.splitting is disabled  -  by @​jinghaihan and @​sxzz in #​680 (b737c)
• Upgrade rolldown to 1.0.0-beta.58  -  by @​sxzz (48036)
• Expose enableDebug  -  by @​sxzz (2d922)
• Expose resolveUserConfig  -  by @​sxzz (c9acb)
• Upgrade rolldown to 1.0.0-beta.59  -  by @​sxzz (d564f)
• Clear console on rebuild start  -  by @​sxzz (78efd)
• migrate: Add monorepo support  -  by @​lauigi and @​sxzz in #​659 (efba2)

   🐞 Bug Fixes

• Print blank line only when the log level is info  -  by @​tomgao365 in #​689 (96d82)
• attw: Add --ignore-scripts to avoid lifecycle output  -  by @​Doctor-wu in #​661 (1c8b1)
• cjs: Update version check for require ESM support  -  by @​sxzz (beeff)

   🏎 Performance

• Optimize hot paths  -  by @​sxzz (7925d)

    View changes on GitHub

v0.18.4

Compare Source

   🚀 Features

• Export mergeConfig  -  by @​sxzz (ccd17)
• Warn deprecated removeNodeProtocol  -  by @​sxzz (90cd6)
• css: Add CSS code splitting support  -  by @​jinghaihan and @​sxzz in #​654 (0525f)
• entry: Support multiple patterns with same base  -  by @​sxzz (cee1b)
• exports: Add packageJson option  -  by @​sxzz (6d220)

    View changes on GitHub

v0.18.3

Compare Source

   🚀 Features

• Upgrade rolldown to 1.0.0-beta.57  -  by @​sxzz (525c0)
• Add envFile & envPrefix option  -  by @​toto6038 and @​sxzz in #​664 (d5493)
• attw: Add ignoreRules option to filter specified rule  -  by @​zyyv and Copilot in #​665 (450b0)

   🐞 Bug Fixes

• Inline PackageJson type  -  by @​sxzz (dfc43)

    View changes on GitHub

v0.18.2

Compare Source

   🚀 Features

• Support globs for noExternal / inlineOnly / exports.exclude  -  by @​sxzz and @​TheAlexLichter (84b68)
• entry: Support glob negation patterns in object entry  -  by @​Doctor-wu and @​sxzz in #​662 (8ed1b)

   🐞 Bug Fixes

• Preserve import cache for node_modules  -  by @​sxzz (426ab)
• skipNodeModulesBundle for monorepo  -  by @​sxzz (9a34f)
• attw: Show full entrypoint  -  by @​sxzz (c89c4)
• clean: Remove dot files  -  by @​sxzz (0430b)

    View changes on GitHub

v0.18.1

Compare Source

   🚀 Features

• Support glob patterns in object entry  -  by @​sxzz (bcb7a)

export default defineConfig({
  entry: {
    '*': './src/*.ts',
    'data-loaders': './src/data-loaders/entries/index.ts',
    'data-loaders/*': './src/data-loaders/entries/!(index).ts',
    'volar/*': './src/volar/entries/*.ts',
  },
}

• Upgrade rolldown to 1.0.0-beta.55  -  by @​sxzz (5be3e)
• Mark exports option as a stable feature  -  by @​sxzz (ce9e0)

   🐞 Bug Fixes

• Keep banner / footer as-is  -  by @​sxzz (f67e0)

    View changes on GitHub

v0.18.0

Compare Source

   🚨 Breaking Changes

• copy: Rework, sync behavior of rollup-plugin-copy  -  by @​sxzz (e864b)

v0.17.4

Compare Source

   🚨 Breaking Changes

• copy: Sync behavior of rollup-plugin-copy  -  by @​sxzz (e864b)

   🚀 Features

• exports: Add exclude option  -  by @​TheAlexLichter and @​sxzz in #​340 (9e634)
• shortcuts: Case insensitive  -  by @​btea in #​649 (019af)

   🐞 Bug Fixes

• Resolve cwd from user config  -  by @​sxzz (bc066)

    View changes on GitHub

v0.17.3

Compare Source

   🚀 Features

• copy: Support glob in copy  -  by @​kricsleo and @​sxzz in #​637 (c1fd4)
  • This may be a breaking change, as the behavior has changed again in v0.17.4. Please upgrade to v0.17.4 and verify the issue.

   🐞 Bug Fixes

• Print error stack  -  by @​sxzz (1c5b6)
• Add config name to rebuilt message  -  by @​sxzz (bfdc6)
• Call hooks for each format  -  by @​sxzz (19bdd)
• Merge input & output options  -  by @​sxzz (14181)

    View changes on GitHub

v0.17.2

Compare Source

   🐞 Bug Fixes

• Empty clean array  -  by @​sxzz (eae7f)

    View changes on GitHub

v0.17.1

Compare Source

   🐞 Bug Fixes

• Respect clean on watch mode  -  by @​sxzz (bfbfb)

    View changes on GitHub

v0.17.0

Compare Source

   🚨 Breaking Changes

Notable features: https://bsky.app/profile/sxzz.dev/post/3m6xi7e7d5k2b

• Rolldown native watcher  -  by @​sxzz in #​329 (1c4f8)
• Enable failOnWarn by default in CI  -  by @​sxzz in #​617 (245e7)
• Remove unconfig from configLoader  -  by @​sxzz (9d6a7)
• Support exports, publint, attw for multi-configs  -  by @​sxzz (f889a)
• refactor!(attw): rename profile value from esmOnly to esm-only  -  by @​sxzz (85c10f3)

   🚀 Features

• Export WatchPlugin  -  by @​sxzz (4ccb2)
• Add write option  -  by @​sxzz (64fea)
• Add chunks on build:done hook  -  by @​sxzz (eb45c)
• Override options by format  -  by @​sxzz (482f6)
• Upgrade rolldown to 1.0.0-beta.53  -  by @​sxzz (a04f2)
• migrate:
  • Migrate optionalDependencies  -  by @​sxzz (22fd9)
  • Use ast-grep for config file  -  by @​Doctor-wu and @​sxzz in #​620 (b0b34)

   🐞 Bug Fixes

• Move require before import  -  by @​sxzz (85c0e)
• copy: Call function  -  by @​sxzz (e4197)
• exports: Merge multi-config outputs  -  by @​pyyupsk and @​sxzz in #​625 (73984)
• migrate: Build before publish  -  by @​sxzz (bf0f5)
• workspace: Cwd defaults to config dirname, support filter for all configs  -  by @​sxzz (24f27)

   🏎 Performance

• Reload config via import-without-cache  -  by @​sxzz (0b7e4)
• Use native loader for bun  -  by @​sxzz (36dbf)

    View changes on GitHub

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Progress: resolved 1, reused 0, downloaded 0, added 0
 ERR_PNPM_TRUST_DOWNGRADE  High-risk trust downgrade for "@voxpelli/config-array-find-files@1.2.2" (possible package takeover)

This error happened while installing a direct dependency of /tmp/renovate/repos/github/eslint/config-inspector

Trust checks are based solely on publish date, not semver. A package cannot be installed if any earlier-published version had stronger trust evidence. Earlier versions had provenance attestation, but this version has no trust evidence. A trust downgrade may indicate a supply chain incident.