docs(en): merge rollup/master into rollup-docs-cn/master @ fe50d862

.github/actions/install-and-cache-node-deps/action.yml

@@ -5,7 +5,7 @@ runs:
   steps:
     - name: Restore Node dependencies cache
       id: cache-node-modules
-      uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+      uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
       with:
         path:  |
           node_modules
@@ -24,7 +24,7 @@ runs:
       shell: bash
     - name: Save Node dependencies cache
       if: steps.cache-node-modules.outputs.cache-hit != 'true' && github.ref == 'refs/heads/master'
-      uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+      uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
       with:
         path: |
           node_modules

.github/workflows/build-and-tests.yml

@@ -213,7 +213,7 @@ jobs:
         if: ${{ matrix.settings.target != 'x86_64-pc-windows-gnu' }}
         with:
           node-version: 24.10.0
-      - uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2
+      - uses: msys2/setup-msys2@cafece8e6baf9247cf9b1bf95097b0b983cc558d # v2
         if: ${{ matrix.settings.target == 'x86_64-pc-windows-gnu' }}
         with:
           msystem: ${{ matrix.settings.msystem }}
@@ -227,16 +227,16 @@ jobs:
           path-type: inherit
           release: false
       - name: Install Toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
           toolchain: nightly-2025-07-25
           components: ${{ matrix.settings.build-std && 'rust-src' || '' }}
           targets: ${{ !matrix.settings.build-std && matrix.settings.target || '' }}
       - name: Setup OpenHarmony SDK
         if: ${{ contains(matrix.settings.target, 'ohos') }}
-        uses: openharmony-rs/setup-ohos-sdk@3c181b3244cec76aaec289ab84fb00f55f2fce3f # v0.2.4
+        uses: openharmony-rs/setup-ohos-sdk@eb82b94ef522b07269679195c2512f22e922ef3b # v1.0.0
       - name: Restore Cargo cache
-        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         if: matrix.settings.cache-cargo != false
         with:
           path: |
@@ -252,7 +252,7 @@ jobs:
         with:
           version: 0.14.1
       - name: Install cargo-zigbuild
-        uses: taiki-e/install-action@de6bbd1333b8f331563d54a051e542c7dfef81c3 # v2.68.34
+        uses: taiki-e/install-action@328a871ad8f62ecac78390391f463ccabc974b72 # v2.69.9
         if: ${{ matrix.settings.cross == 'zig' }}
         env:
           GITHUB_TOKEN: ${{ github.token }}
@@ -284,7 +284,7 @@ jobs:
         shell: bash
       - name: Save Cargo cache
         if: github.ref == 'refs/heads/master' && matrix.settings.cache-cargo != false
-        uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: |
             ~/.cargo/registry/index/
@@ -323,7 +323,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Restore Cargo cache
-        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: |
             ~/.cargo/registry/index/
@@ -350,7 +350,7 @@ jobs:
 
       - name: Save Cargo cache
         if: github.ref == 'refs/heads/master'
-        uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: |
             ~/.cargo/registry/index/
@@ -534,7 +534,7 @@ jobs:
         env:
           CI: true
       - name: Upload coverage
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
         if: matrix.coverage
         with:
           fail_ci_if_error: true

.github/workflows/performance-report.yml

@@ -35,12 +35,12 @@ jobs:
         with:
           ref: ${{matrix.settings.ref}}
       - name: Install Toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
           toolchain: nightly-2025-07-25
           components: rust-src
       - name: Restore Cargo cache
-        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: |
             ~/.cargo/registry/index/
@@ -77,12 +77,12 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Install Toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
           toolchain: nightly-2025-07-25
           components: rust-src
       - name: Restore Cargo cache
-        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: |
             ~/.cargo/registry/index/

.github/workflows/repl-artefacts.yml

@@ -35,12 +35,12 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Install Toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
           toolchain: nightly-2025-07-25
           components: rust-src
       - name: Restore Cargo cache
-        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: |
             ~/.cargo/registry/index/
@@ -61,7 +61,7 @@ jobs:
           npm exec -- concurrently -c green,blue,yellow 'npm:build:napi -- --release' 'npm run build:wasm' 'npm:build:cjs' &&
           npm run build:copy-native && npm run build:bootstrap
       - name: Upload "${{ github.event.number }}/rollup.browser.js" to bucket
-        uses: zdurham/s3-upload-github-action@master
+        uses: zdurham/s3-upload-github-action@161dfa6991b9d88a97f02f4aeb5dcd26ea7e03cd # master
         with:
           args: --cache-control max-age=300,public
         env:
@@ -72,7 +72,7 @@ jobs:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
       - name: Upload "${{ github.event.number }}/rollup.browser.js.map" to bucket
-        uses: zdurham/s3-upload-github-action@master
+        uses: zdurham/s3-upload-github-action@161dfa6991b9d88a97f02f4aeb5dcd26ea7e03cd # master
         with:
           args: --cache-control max-age=300,public
         env:
@@ -83,7 +83,7 @@ jobs:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
       - name: Upload "${{ github.event.number }}/bindings_wasm_bg.wasm" to bucket
-        uses: zdurham/s3-upload-github-action@master
+        uses: zdurham/s3-upload-github-action@161dfa6991b9d88a97f02f4aeb5dcd26ea7e03cd # master
         with:
           args: --cache-control max-age=300,public
         env:

CHANGELOG.md

@@ -1,5 +1,48 @@
 # rollup changelog
 
+## 4.60.0
+
+_2026-03-22_
+
+### Features
+
+- Support source phase imports as long as they are external (#6279)
+
+### Pull Requests
+
+- [#6279](https://github.com/rollup/rollup/pull/6279): feat: external only Source Phase imports support (@guybedford, @lukastaegert)
+
+## 4.59.1
+
+_2026-03-21_
+
+### Bug Fixes
+
+- Fix a crash when using lazy dynamic imports with moduleSideEffects:false (#6306)
+
+### Pull Requests
+
+- [#6281](https://github.com/rollup/rollup/pull/6281): fix(deps): update minor/patch updates (@renovate[bot], @lukastaegert)
+- [#6282](https://github.com/rollup/rollup/pull/6282): chore(deps): update github artifact actions (major) (@renovate[bot], @lukastaegert)
+- [#6283](https://github.com/rollup/rollup/pull/6283): chore(deps): update dependency nyc to v18 (@renovate[bot], @lukastaegert)
+- [#6284](https://github.com/rollup/rollup/pull/6284): fix(deps): update swc monorepo (major) (@renovate[bot])
+- [#6285](https://github.com/rollup/rollup/pull/6285): chore(deps): lock file maintenance (@renovate[bot])
+- [#6290](https://github.com/rollup/rollup/pull/6290): chore(deps): update minor/patch updates (@renovate[bot], @lukastaegert)
+- [#6291](https://github.com/rollup/rollup/pull/6291): chore(deps): update dependency @shikijs/vitepress-twoslash to v4 (@renovate[bot])
+- [#6292](https://github.com/rollup/rollup/pull/6292): chore(deps): lock file maintenance (@renovate[bot])
+- [#6297](https://github.com/rollup/rollup/pull/6297): chore(deps): update minor/patch updates (@renovate[bot])
+- [#6298](https://github.com/rollup/rollup/pull/6298): chore(deps): lock file maintenance (@renovate[bot])
+- [#6299](https://github.com/rollup/rollup/pull/6299): chore(deps): lock file maintenance (@renovate[bot])
+- [#6300](https://github.com/rollup/rollup/pull/6300): docs: update packagephobia link (@bluwy)
+- [#6301](https://github.com/rollup/rollup/pull/6301): chore(deps): update dependency lint-staged to ^16.3.3 (@renovate[bot])
+- [#6306](https://github.com/rollup/rollup/pull/6306): fix: fix chunk assignment for deoptimized module with dynamic import (@JoaoBrlt, @lukastaegert)
+- [#6307](https://github.com/rollup/rollup/pull/6307): chore(deps): update minor/patch updates (@renovate[bot])
+- [#6308](https://github.com/rollup/rollup/pull/6308): chore(deps): update dependency lru-cache to v11 (@renovate[bot])
+- [#6309](https://github.com/rollup/rollup/pull/6309): chore(deps): update dependency vite to v8 (@renovate[bot])
+- [#6310](https://github.com/rollup/rollup/pull/6310): chore(deps): lock file maintenance (@renovate[bot])
+- [#6311](https://github.com/rollup/rollup/pull/6311): chore(deps): lock file maintenance (@renovate[bot])
+- [#6312](https://github.com/rollup/rollup/pull/6312): chore(deps): lock file maintenance (@renovate[bot])
+
 ## 4.59.0
 
 _2026-02-22_

audit-resolve.json

@@ -14,6 +14,16 @@
       "decision": "ignore",
       "madeAt": 1772778003517,
       "expiresAt": 1775369996393
+    },
+    "1115519|@rollup/plugin-terser>serialize-javascript": {
+      "decision": "ignore",
+      "madeAt": 1774678997033,
+      "expiresAt": 1777270978460
+    },
+    "1115519|mocha>diff>serialize-javascript": {
+      "decision": "ignore",
+      "madeAt": 1774678997033,
+      "expiresAt": 1777270978460
     }
   },
   "rules": {},

browser/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rollup/browser",
-  "version": "4.59.0",
+  "version": "4.60.0",
   "description": "Next-generation ES module bundler browser build",
   "main": "dist/rollup.browser.js",
   "module": "dist/es/rollup.browser.js",

docs/configuration-options/index.md

@@ -58,7 +58,13 @@ rollup -i src/main.js ... -e foo,bar,baz
 
 当创建 `iife` 或 `umd` 格式的 bundle 时，你需要通过 [`output.globals`](#output-globals) 选项提供全局变量名，以替换掉外部引入。
 
+<<<<<<< HEAD
 如果一个相对引入，即以 `./` 或 `../` 开头，被标记为 `external`，rollup 将在内部将该模块 ID 解析为绝对路径，以便引入的不同外部模块可以合并。当写入生成的 bundle 后，这些引入模块将再次被转换为相对引入。例如：
+=======
+Note that [source phase imports](../es-module-syntax/index.md#source-phase-import) (`import source x from 'y'`) are required to be external. Rollup will raise an error if a source phase import resolves to a module that is not external.
+
+If a relative import, i.e. starting with `./` or `../`, is marked as "external", rollup will internally resolve the id to an absolute file system location so that different imports of the external module can be merged. When the resulting bundle is written, the import will again be converted to a relative import. Example:
+>>>>>>> fe50d862804c1f157f0ae378a3c555b8b3ef6ce7
 
 ```js
 // 输入

docs/es-module-syntax/index.md

@@ -66,7 +66,23 @@ import('./modules.js').then(({ default: DefaultExport, NamedExport }) => {
 
 这对于代码分解应用程序和动态使用模块非常有用。
 
+<<<<<<< HEAD
 ## 导出 {#exporting}
+=======
+### Source Phase Import
+
+Import the Source Phase representation of a module without executing it, using the [Source Phase Imports Proposal](https://github.com/tc39/proposal-source-phase-imports).
+
+This is useful for importing compiled WebAssembly modules through the module system without relying on the fetch API:
+
+```js
+import source myModule from './module.wasm';
+```
+
+Source phase imports must be [external](../configuration-options/index.md#external) — Rollup will raise an error if a source phase import resolves to a non-external module. They are preserved as `import source` declarations in `es` output format. Other output formats (`cjs`, `amd`, `iife`, `umd`, `system`) do not support source phase imports and will raise an error if one is present.
+
+## Exporting
+>>>>>>> fe50d862804c1f157f0ae378a3c555b8b3ef6ce7
 
 ### 具名导出 {#named-exports}