docs(en): merge rollup/master into rollup-docs-cn/master @ 5e0066d9

.github/workflows/build-and-tests.yml

@@ -31,7 +31,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout Commit
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
@@ -207,7 +207,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout Commit
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         if: ${{ matrix.settings.target != 'x86_64-pc-windows-gnu' }}
@@ -252,7 +252,7 @@ jobs:
         with:
           version: 0.14.1
       - name: Install cargo-zigbuild
-        uses: taiki-e/install-action@920ab1831fbf4fb3ef75c8ead83556c918bb7290 # v2.79.8
+        uses: taiki-e/install-action@fd2f5e3d644b484055ebf4268f474c565f148f25 # v2.81.9
         if: ${{ matrix.settings.cross == 'zig' }}
         env:
           GITHUB_TOKEN: ${{ github.token }}
@@ -320,7 +320,7 @@ jobs:
 
     steps:
       - name: Checkout Commit
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Restore Cargo cache
         uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
@@ -338,7 +338,7 @@ jobs:
         uses: ./.github/actions/install-and-cache-node-deps
 
       - name: Build (OpenBSD)
-        uses: cross-platform-actions/action@0c165ad7eb2d6a7e8552d6af5aad2bbedfc646b0 # v1.1.0
+        uses: cross-platform-actions/action@be3d7e9ff5c8770b9c51b1a8c8c5446e1cad7cf9 # v1.2.0
         with:
           operating_system: ${{ matrix.os.name }}
           architecture: ${{ matrix.os.architecture }}
@@ -406,7 +406,7 @@ jobs:
     timeout-minutes: 120
     steps:
       - name: Checkout Commit
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Install and Cache Node Dependencies
         uses: ./.github/actions/install-and-cache-node-deps
       - name: Build JS
@@ -505,7 +505,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout Commit
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
@@ -534,7 +534,7 @@ jobs:
         env:
           CI: true
       - name: Upload coverage
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         if: matrix.coverage
         with:
           fail_ci_if_error: true
@@ -558,7 +558,7 @@ jobs:
     if: startsWith(github.ref_name, 'v4')
     steps:
       - name: Checkout Commit
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           # Necessary to find the commits included in the release
           fetch-depth: 0

.github/workflows/clean-cache.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Cleanup
         run: |
           gh extension install actions/gh-actions-cache

.github/workflows/performance-report.yml

@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Commit
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{matrix.settings.ref}}
       - name: Install Toolchain
@@ -73,7 +73,7 @@ jobs:
     name: Report Performance
     steps:
       - name: Checkout Commit
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Install Toolchain

.github/workflows/repl-artefacts-upload.yml

@@ -81,7 +81,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Configure AWS credentials via OIDC
         if: ${{ steps.check.outputs.has-artefacts == 'true' }}
-        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
           aws-region: ${{ secrets.AWS_REGION }}

.github/workflows/repl-artefacts.yml

@@ -24,7 +24,7 @@ jobs:
     name: Build
     steps:
       - name: Checkout Commit
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Install Toolchain

CHANGELOG.md

@@ -1,5 +1,40 @@
 # rollup changelog
 
+## 4.62.0
+
+_2026-06-13_
+
+### Features
+
+- Ensure that shared dependencies between manual chunks and entry points receive a serparate chunk (#6374)
+
+### Pull Requests
+
+- [#6374](https://github.com/rollup/rollup/pull/6374): Extract the static dependencies imported by manual chunks into separate chunks (@TrickyPi, @lukastaegert)
+- [#6405](https://github.com/rollup/rollup/pull/6405): fix(deps): update minor/patch updates (@renovate[bot])
+- [#6406](https://github.com/rollup/rollup/pull/6406): chore(deps): pin dependency concurrently to v9 (@renovate[bot], @lukastaegert)
+- [#6407](https://github.com/rollup/rollup/pull/6407): chore(deps): lock file maintenance minor/patch updates (@renovate[bot])
+- [#6409](https://github.com/rollup/rollup/pull/6409): chore(deps): update minor/patch updates to v6.2.0 (@renovate[bot])
+- [#6410](https://github.com/rollup/rollup/pull/6410): chore(deps): lock file maintenance minor/patch updates (@renovate[bot])
+- [#6412](https://github.com/rollup/rollup/pull/6412): fix(deps): update minor/patch updates (@renovate[bot])
+- [#6413](https://github.com/rollup/rollup/pull/6413): chore(deps): update dependency eslint-plugin-unicorn to v65 (@renovate[bot])
+- [#6414](https://github.com/rollup/rollup/pull/6414): chore(deps): lock file maintenance minor/patch updates (@renovate[bot], @lukastaegert)
+
+## 4.61.1
+
+_2026-06-04_
+
+### Bug Fixes
+
+- Avoid extraneous newlines when adding headers via plugins (#6403)
+- Fix a rare issue where starting Rollup would hang on Windows (#6404)
+
+### Pull Requests
+
+- [#6402](https://github.com/rollup/rollup/pull/6402): Improve documentation for manualPureFunctions (@lukastaegert)
+- [#6403](https://github.com/rollup/rollup/pull/6403): Does not add an extra leading line feed for addons (@TrickyPi)
+- [#6404](https://github.com/rollup/rollup/pull/6404): fix: set report.excludeNetwork=true before getReport() to avoid blocking PTR lookups (@jdz321, @lukastaegert)
+
 ## 4.61.0
 
 _2026-06-01_

audit-resolve.json

@@ -2,18 +2,18 @@
   "decisions": {
     "1112706|mocha>diff": {
       "decision": "ignore",
-      "madeAt": 1778736367601,
-      "expiresAt": 1781328337045
+      "madeAt": 1781330012106,
+      "expiresAt": 1783921936247
     },
     "1113686|mocha>diff>serialize-javascript": {
       "decision": "ignore",
-      "madeAt": 1778736362001,
-      "expiresAt": 1781328337045
+      "madeAt": 1781329994282,
+      "expiresAt": 1783921936247
     },
     "1113686|@rollup/plugin-terser>serialize-javascript": {
       "decision": "ignore",
-      "madeAt": 1778736362001,
-      "expiresAt": 1781328337045
+      "madeAt": 1781329994282,
+      "expiresAt": 1783921936247
     },
     "1115723|@rollup/plugin-terser>serialize-javascript": {
       "decision": "ignore",
@@ -39,6 +39,11 @@
       "decision": "ignore",
       "madeAt": 1779422109125,
       "expiresAt": 1782014081308
+    },
+    "1120422|concurrently>shell-quote": {
+      "decision": "ignore",
+      "madeAt": 1781330008448,
+      "expiresAt": 1783921936247
     }
   },
   "rules": {},

browser/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rollup/browser",
-  "version": "4.61.0",
+  "version": "4.62.0",
   "description": "Next-generation ES module bundler browser build",
   "main": "dist/rollup.browser.js",
   "module": "dist/es/rollup.browser.js",

docs/configuration-options/index.md

@@ -2594,7 +2594,33 @@ styled()(); // 去除
 styled().div(); // 去除
 ```
 
+<<<<<<< HEAD
 #### treeshake.moduleSideEffects {#treeshake-modulesideeffects}
+=======
+::: warning
+
+If you pass arguments to such a pure function, those arguments are still checked for direct side effects like mutating a variable or calling a global function, in which case the call to the pure function is retained. But be aware that we do not check if those arguments are called and whether such a call could have side effects.
+
+```js
+// rollup.config.js
+export default {
+	treeshake: {
+		manualPureFunctions: ['lib.nested']
+	}
+	// ...
+};
+
+import lib from 'lib';
+
+lib.nested(console.log('effect')); // retained
+lib.nested(() => console.log('effect')); // will be removed
+lib.nested.forEach(() => console.log('effect')); // will also be removed
+```
+
+:::
+
+#### treeshake.moduleSideEffects
+>>>>>>> 5e0066d92defee0097f10fb814e63f60b2a7b612
 
 |  |  |
 | --: | :-- |

native.js

@@ -6,12 +6,18 @@ const { spawnSync } = require('node:child_process');
 const getReportHeader = () => {
 	try {
 		if (platform !== 'win32') {
-			return report.getReport().header;
+			// Avoid blocking reverse DNS (PTR) lookups on open TCP socket handles.
+			// See: https://github.com/nodejs/node/issues/55576
+			const previousExcludeNetwork = report.excludeNetwork;
+			report.excludeNetwork = true;
+			const header = report.getReport().header;
+			report.excludeNetwork = previousExcludeNetwork;
+			return header;
 		}
 
 		// This is needed because report.getReport() crashes the process on Windows sometimes.
 		const script =
-			"console.log(JSON.stringify(require('node:process').report.getReport().header));";
+			"const r=require('node:process').report;r.excludeNetwork=true;console.log(JSON.stringify(r.getReport().header));";
 		const child = spawnSync(process.execPath, ['-p', script], {
 			encoding: 'utf8',
 			timeout: 3000,