Merge pull request #199 from rollup/sync-ae871d76

docs(en): merge rollup/master into rollup-docs-cn/master @ ae871d7

Author: waynzh

.github/actions/install-and-cache-node-deps/action.yml

@@ -5,7 +5,7 @@ runs:
   steps:
     - name: Restore Node dependencies cache
       id: cache-node-modules
-      uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+      uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
       with:
         path:  |
           node_modules
@@ -24,7 +24,7 @@ runs:
       shell: bash
     - name: Save Node dependencies cache
       if: steps.cache-node-modules.outputs.cache-hit != 'true' && github.ref == 'refs/heads/master'
-      uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+      uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
       with:
         path: |
           node_modules

.github/workflows/build-and-tests.yml

@@ -213,7 +213,7 @@ jobs:
         if: ${{ matrix.settings.target != 'x86_64-pc-windows-gnu' }}
         with:
           node-version: 24.10.0
-      - uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2
+      - uses: msys2/setup-msys2@cafece8e6baf9247cf9b1bf95097b0b983cc558d # v2
         if: ${{ matrix.settings.target == 'x86_64-pc-windows-gnu' }}
         with:
           msystem: ${{ matrix.settings.msystem }}
@@ -227,16 +227,16 @@ jobs:
           path-type: inherit
           release: false
       - name: Install Toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
           toolchain: nightly-2025-07-25
           components: ${{ matrix.settings.build-std && 'rust-src' || '' }}
           targets: ${{ !matrix.settings.build-std && matrix.settings.target || '' }}
       - name: Setup OpenHarmony SDK
         if: ${{ contains(matrix.settings.target, 'ohos') }}
-        uses: openharmony-rs/setup-ohos-sdk@3c181b3244cec76aaec289ab84fb00f55f2fce3f # v0.2.4
+        uses: openharmony-rs/setup-ohos-sdk@eb82b94ef522b07269679195c2512f22e922ef3b # v1.0.0
       - name: Restore Cargo cache
-        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         if: matrix.settings.cache-cargo != false
         with:
           path: |
@@ -252,7 +252,7 @@ jobs:
         with:
           version: 0.14.1
       - name: Install cargo-zigbuild
-        uses: taiki-e/install-action@de6bbd1333b8f331563d54a051e542c7dfef81c3 # v2.68.34
+        uses: taiki-e/install-action@328a871ad8f62ecac78390391f463ccabc974b72 # v2.69.9
         if: ${{ matrix.settings.cross == 'zig' }}
         env:
           GITHUB_TOKEN: ${{ github.token }}
@@ -284,7 +284,7 @@ jobs:
         shell: bash
       - name: Save Cargo cache
         if: github.ref == 'refs/heads/master' && matrix.settings.cache-cargo != false
-        uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: |
             ~/.cargo/registry/index/
@@ -323,7 +323,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Restore Cargo cache
-        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: |
             ~/.cargo/registry/index/
@@ -350,7 +350,7 @@ jobs:
 
       - name: Save Cargo cache
         if: github.ref == 'refs/heads/master'
-        uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: |
             ~/.cargo/registry/index/
@@ -534,7 +534,7 @@ jobs:
         env:
           CI: true
       - name: Upload coverage
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
         if: matrix.coverage
         with:
           fail_ci_if_error: true

.github/workflows/performance-report.yml

@@ -35,12 +35,12 @@ jobs:
         with:
           ref: ${{matrix.settings.ref}}
       - name: Install Toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
           toolchain: nightly-2025-07-25
           components: rust-src
       - name: Restore Cargo cache
-        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: |
             ~/.cargo/registry/index/
@@ -77,12 +77,12 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Install Toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
           toolchain: nightly-2025-07-25
           components: rust-src
       - name: Restore Cargo cache
-        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: |
             ~/.cargo/registry/index/

.github/workflows/repl-artefacts.yml

@@ -35,12 +35,12 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Install Toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
           toolchain: nightly-2025-07-25
           components: rust-src
       - name: Restore Cargo cache
-        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: |
             ~/.cargo/registry/index/
@@ -61,7 +61,7 @@ jobs:
           npm exec -- concurrently -c green,blue,yellow 'npm:build:napi -- --release' 'npm run build:wasm' 'npm:build:cjs' &&
           npm run build:copy-native && npm run build:bootstrap
       - name: Upload "${{ github.event.number }}/rollup.browser.js" to bucket
-        uses: zdurham/s3-upload-github-action@master
+        uses: zdurham/s3-upload-github-action@161dfa6991b9d88a97f02f4aeb5dcd26ea7e03cd # master
         with:
           args: --cache-control max-age=300,public
         env:
@@ -72,7 +72,7 @@ jobs:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
       - name: Upload "${{ github.event.number }}/rollup.browser.js.map" to bucket
-        uses: zdurham/s3-upload-github-action@master
+        uses: zdurham/s3-upload-github-action@161dfa6991b9d88a97f02f4aeb5dcd26ea7e03cd # master
         with:
           args: --cache-control max-age=300,public
         env:
@@ -83,7 +83,7 @@ jobs:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
       - name: Upload "${{ github.event.number }}/bindings_wasm_bg.wasm" to bucket
-        uses: zdurham/s3-upload-github-action@master
+        uses: zdurham/s3-upload-github-action@161dfa6991b9d88a97f02f4aeb5dcd26ea7e03cd # master
         with:
           args: --cache-control max-age=300,public
         env:

CHANGELOG.md

@@ -1,5 +1,68 @@
 # rollup changelog
 
+## 4.60.1
+
+_2026-03-30_
+
+### Bug Fixes
+
+- Resolve a situation where side effect imports could be dropped due to a caching issue (#6286)
+
+### Pull Requests
+
+- [#6286](https://github.com/rollup/rollup/pull/6286): fix: skip dropping side-effects on namespaceReexportsByName cache hit (#6274) (@littlegrayss, @TrickyPi)
+- [#6317](https://github.com/rollup/rollup/pull/6317): chore(deps): pin dependencies (@renovate[bot], @lukastaegert)
+- [#6318](https://github.com/rollup/rollup/pull/6318): chore(deps): update msys2/setup-msys2 digest to cafece8 (@renovate[bot], @lukastaegert)
+- [#6319](https://github.com/rollup/rollup/pull/6319): chore(deps): update minor/patch updates (@renovate[bot], @lukastaegert)
+- [#6320](https://github.com/rollup/rollup/pull/6320): chore(deps): pin dependency typescript to v5 (@renovate[bot], @lukastaegert)
+- [#6321](https://github.com/rollup/rollup/pull/6321): chore(deps): update openharmony-rs/setup-ohos-sdk action to v1 (@renovate[bot], @lukastaegert)
+- [#6322](https://github.com/rollup/rollup/pull/6322): fix(deps): update swc monorepo (major) (@renovate[bot], @lukastaegert)
+- [#6323](https://github.com/rollup/rollup/pull/6323): chore(deps): lock file maintenance (@renovate[bot])
+- [#6324](https://github.com/rollup/rollup/pull/6324): chore(deps): lock file maintenance (@renovate[bot], @lukastaegert)
+
+## 4.60.0
+
+_2026-03-22_
+
+### Features
+
+- Support source phase imports as long as they are external (#6279)
+
+### Pull Requests
+
+- [#6279](https://github.com/rollup/rollup/pull/6279): feat: external only Source Phase imports support (@guybedford, @lukastaegert)
+
+## 4.59.1
+
+_2026-03-21_
+
+### Bug Fixes
+
+- Fix a crash when using lazy dynamic imports with moduleSideEffects:false (#6306)
+
+### Pull Requests
+
+- [#6281](https://github.com/rollup/rollup/pull/6281): fix(deps): update minor/patch updates (@renovate[bot], @lukastaegert)
+- [#6282](https://github.com/rollup/rollup/pull/6282): chore(deps): update github artifact actions (major) (@renovate[bot], @lukastaegert)
+- [#6283](https://github.com/rollup/rollup/pull/6283): chore(deps): update dependency nyc to v18 (@renovate[bot], @lukastaegert)
+- [#6284](https://github.com/rollup/rollup/pull/6284): fix(deps): update swc monorepo (major) (@renovate[bot])
+- [#6285](https://github.com/rollup/rollup/pull/6285): chore(deps): lock file maintenance (@renovate[bot])
+- [#6290](https://github.com/rollup/rollup/pull/6290): chore(deps): update minor/patch updates (@renovate[bot], @lukastaegert)
+- [#6291](https://github.com/rollup/rollup/pull/6291): chore(deps): update dependency @shikijs/vitepress-twoslash to v4 (@renovate[bot])
+- [#6292](https://github.com/rollup/rollup/pull/6292): chore(deps): lock file maintenance (@renovate[bot])
+- [#6297](https://github.com/rollup/rollup/pull/6297): chore(deps): update minor/patch updates (@renovate[bot])
+- [#6298](https://github.com/rollup/rollup/pull/6298): chore(deps): lock file maintenance (@renovate[bot])
+- [#6299](https://github.com/rollup/rollup/pull/6299): chore(deps): lock file maintenance (@renovate[bot])
+- [#6300](https://github.com/rollup/rollup/pull/6300): docs: update packagephobia link (@bluwy)
+- [#6301](https://github.com/rollup/rollup/pull/6301): chore(deps): update dependency lint-staged to ^16.3.3 (@renovate[bot])
+- [#6306](https://github.com/rollup/rollup/pull/6306): fix: fix chunk assignment for deoptimized module with dynamic import (@JoaoBrlt, @lukastaegert)
+- [#6307](https://github.com/rollup/rollup/pull/6307): chore(deps): update minor/patch updates (@renovate[bot])
+- [#6308](https://github.com/rollup/rollup/pull/6308): chore(deps): update dependency lru-cache to v11 (@renovate[bot])
+- [#6309](https://github.com/rollup/rollup/pull/6309): chore(deps): update dependency vite to v8 (@renovate[bot])
+- [#6310](https://github.com/rollup/rollup/pull/6310): chore(deps): lock file maintenance (@renovate[bot])
+- [#6311](https://github.com/rollup/rollup/pull/6311): chore(deps): lock file maintenance (@renovate[bot])
+- [#6312](https://github.com/rollup/rollup/pull/6312): chore(deps): lock file maintenance (@renovate[bot])
+
 ## 4.59.0
 
 _2026-02-22_

audit-resolve.json

@@ -14,6 +14,16 @@
       "decision": "ignore",
       "madeAt": 1772778003517,
       "expiresAt": 1775369996393
+    },
+    "1115519|@rollup/plugin-terser>serialize-javascript": {
+      "decision": "ignore",
+      "madeAt": 1774678997033,
+      "expiresAt": 1777270978460
+    },
+    "1115519|mocha>diff>serialize-javascript": {
+      "decision": "ignore",
+      "madeAt": 1774678997033,
+      "expiresAt": 1777270978460
     }
   },
   "rules": {},

browser/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rollup/browser",
-  "version": "4.59.0",
+  "version": "4.60.1",
   "description": "Next-generation ES module bundler browser build",
   "main": "dist/rollup.browser.js",
   "module": "dist/es/rollup.browser.js",

docs/configuration-options/index.md

@@ -58,6 +58,8 @@ rollup -i src/main.js ... -e foo,bar,baz
 
 当创建 `iife` 或 `umd` 格式的 bundle 时，你需要通过 [`output.globals`](#output-globals) 选项提供全局变量名，以替换掉外部引入。
 
+请注意，[source phase 导入](../es-module-syntax/index.md#source-phase-import)（`import source x from 'y'`）必须是外部的。如果 source phase 导入解析到非外部模块，Rollup 将抛出错误。
+
 如果一个相对引入，即以 `./` 或 `../` 开头，被标记为 `external`，rollup 将在内部将该模块 ID 解析为绝对路径，以便引入的不同外部模块可以合并。当写入生成的 bundle 后，这些引入模块将再次被转换为相对引入。例如：
 
 ```js

docs/es-module-syntax/index.md

@@ -66,6 +66,18 @@ import('./modules.js').then(({ default: DefaultExport, NamedExport }) => {
 
 这对于代码分解应用程序和动态使用模块非常有用。
 
+### Source Phase 导入 {#source-phase-import}
+
+使用 [Source Phase Imports 提案](https://github.com/tc39/proposal-source-phase-imports) 导入模块的 Source Phase 表示，而不执行它。
+
+这对于通过模块系统导入编译好的 WebAssembly 模块非常有用，而无需依赖 fetch API：
+
+```js
+import source myModule from './module.wasm';
+```
+
+Source phase 导入必须是[外部的](../configuration-options/index.md#external) —— 如果 source phase 导入解析到非外部模块，Rollup 将抛出错误。在 `es` 输出格式中，它们会被保留为 `import source` 声明。其他输出格式（`cjs`、`amd`、`iife`、`umd`、`system`）不支持 source phase 导入，如果存在则会抛出错误。
+
 ## 导出 {#exporting}
 
 ### 具名导出 {#named-exports}