Merge branch 'master' of https://github.com/rollup/rollup into sync-cca6454c

Author: docschina-bot

.github/workflows/build-and-tests.yml

@@ -252,7 +252,7 @@ jobs:
         with:
           version: 0.14.1
       - name: Install cargo-zigbuild
-        uses: taiki-e/install-action@7ea35f098a7369cd23488403f58be9c491a6c55f # v2.77.0
+        uses: taiki-e/install-action@c070f87102a1c75b3183910f391c1cb887fe13c8 # v2.77.6
         if: ${{ matrix.settings.cross == 'zig' }}
         env:
           GITHUB_TOKEN: ${{ github.token }}

CHANGELOG.md

@@ -1,5 +1,22 @@
 # rollup changelog
 
+## 4.60.4
+
+_2026-05-14_
+
+### Bug Fixes
+
+- Improve stability of chunk hashes (#6362)
+
+### Pull Requests
+
+- [#6362](https://github.com/rollup/rollup/pull/6362): fix: stabilize chunk assignment across parallel file reads (@sonukapoor, @Sonu Kapoor, @TrickyPi, @lukastaegert)
+- [#6370](https://github.com/rollup/rollup/pull/6370): fix(deps): update minor/patch updates (@renovate[bot])
+- [#6371](https://github.com/rollup/rollup/pull/6371): chore(deps): update dependency lru-cache to v11 (@renovate[bot], @lukastaegert)
+- [#6372](https://github.com/rollup/rollup/pull/6372): chore(deps): update react monorepo to v19 (major) (@renovate[bot])
+- [#6373](https://github.com/rollup/rollup/pull/6373): chore(deps): lock file maintenance (@renovate[bot], @lukastaegert)
+- [#6375](https://github.com/rollup/rollup/pull/6375): Resolve vulnerabilities (@lukastaegert)
+
 ## 4.60.3
 
 _2026-05-04_

audit-resolve.json

@@ -2,48 +2,28 @@
   "decisions": {
     "1112706|mocha>diff": {
       "decision": "ignore",
-      "madeAt": 1775969901927,
-      "expiresAt": 1778561884409
+      "madeAt": 1778736367601,
+      "expiresAt": 1781328337045
     },
     "1113686|mocha>diff>serialize-javascript": {
       "decision": "ignore",
-      "madeAt": 1775969896563,
-      "expiresAt": 1778561884409
+      "madeAt": 1778736362001,
+      "expiresAt": 1781328337045
     },
     "1113686|@rollup/plugin-terser>serialize-javascript": {
       "decision": "ignore",
-      "madeAt": 1775969896563,
-      "expiresAt": 1778561884409
-    },
-    "1115519|@rollup/plugin-terser>serialize-javascript": {
-      "decision": "ignore",
-      "madeAt": 1774678997033,
-      "expiresAt": 1777270978460
-    },
-    "1115519|mocha>diff>serialize-javascript": {
-      "decision": "ignore",
-      "madeAt": 1774678997033,
-      "expiresAt": 1777270978460
+      "madeAt": 1778736362001,
+      "expiresAt": 1781328337045
     },
     "1115723|@rollup/plugin-terser>serialize-javascript": {
       "decision": "ignore",
-      "madeAt": 1777881312934,
-      "expiresAt": 1780473295252
+      "madeAt": 1778737445950,
+      "expiresAt": 1781329420005
     },
     "1115723|mocha>diff>serialize-javascript": {
       "decision": "ignore",
-      "madeAt": 1777881312934,
-      "expiresAt": 1780473295252
-    },
-    "1116970|@mermaid-js/mermaid-cli>@mermaid-js/layout-elk>mermaid>uuid": {
-      "decision": "ignore",
-      "madeAt": 1777608910885,
-      "expiresAt": 1780200878843
-    },
-    "1116970|nyc>istanbul-lib-processinfo>uuid": {
-      "decision": "ignore",
-      "madeAt": 1777608910885,
-      "expiresAt": 1780200878843
+      "madeAt": 1778737445950,
+      "expiresAt": 1781329420005
     }
   },
   "rules": {},

browser/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rollup/browser",
-  "version": "4.60.3",
+  "version": "4.60.4",
   "description": "Next-generation ES module bundler browser build",
   "main": "dist/rollup.browser.js",
   "module": "dist/es/rollup.browser.js",
@@ -23,7 +23,7 @@
   },
   "homepage": "https://rollupjs.org/",
   "dependencies": {
-    "@types/estree": "1.0.8"
+    "@types/estree": "1.0.9"
   },
   "files": [
     "dist/**/*.wasm",