Packages

rollup

4.64.12MIT
  • 4.64.12 is the latest, published 20 October 2026.
  • 2 security advisories, all fixed.
  • 4.x: 185 releases since 5 October 2023, 22 in the last 90 days.

Security advisories

Grouped by the version that fixes them, so one upgrade reads as one step.

Releases in the last 90 days

Feed of releases and advisories

Every stable release, newest first. Notes are quoted as the maintainers published them.

  1. 4.64.12

    20 October 2026
    2026-10-20

    2026-10-20

    Bug Fixes

    • Allow generating logs from transform hooks at position 0

    • Properly handle global or sticky regular expressions for file names

    Pull Requests

    • Fix transform diagnostics at position zero

    • Match stateful external regular expressions consistently

  2. 4.64.10

    18 October 2026
    2026-10-18

    2026-10-18

    Bug Fixes

    • Avoid breaking lazy loading when a dynamic import only contains reexports from a manual chunk

    • Ensure HTML entities in JSX are properly decoded in the output

    Pull Requests

    • Track manual chunk dependencies when merging small chunks (@ybai08, @lukastaegert)

    • Use decoded values for JSX string attributes

  3. 4.64.9

    17 October 2026
    2026-10-17

    2026-10-17

    Bug Fixes

    • Ensure export live-bindings are properly maintained for aliased exports

    • Retain typed array constructor calls if the argument has iteration side effects

    Pull Requests

    • Fix live bindings for aliased reassigned exports (@oxura, @lukastaegert)

    • Retain typed array constructors that iterate their argument (@joshuablac, @lukastaegert)

  4. 4.64.8

    17 October 2026
    2026-10-17

    2026-10-17

    Bug Fixes

    • Ensure chunk hashes change when sourcemap comments change

    • Resolve some relative import resolution edge cases

    Pull Requests

    • include sourcemap comments in chunk hashes (@snoopuppy582, @wangxpych, @lukastaegert)

    • browser: match node's join and relative for "." and ".." segments (@luantaraschi, @lukastaegert)

    • Update dtolnay/rust-toolchain digest to 686976e

    • Update minor/patch updates

    • Update swc monorepo (major) (@renovate[bot], @lukastaegert)

  5. 4.64.7

    15 October 2026
    2026-10-15

    2026-10-15

    Bug Fixes

    • Fix an issue where watching not-yet-created files from plugins did not work if several shared a directory

    Pull Requests

    • Report creation of missing watch files sharing a directory on Linux

  6. 4.64.6

    13 October 2026
    2026-10-13

    2026-10-13

    Bug Fixes

    • Do not tree-shake side effects in class instance fields

    • Extend top-level-await detection to handle asynchronous for...of loops and async disposal

    Pull Requests

    • Retain instance field initializers with side effects when instantiating a class (@SulimanAbdulrazzaq, @lukastaegert)

    • Recognize top-level asynchronous loops and disposal

    • Align lock file maintenance with other updates

    • Make addWatchFile watch test robust against watcher start-up timing

  7. 4.64.5

    10 October 2026
    2026-10-10

    2026-10-10

    Bug Fixes

    • Prevent cycles when using indirect top-level await for dynamic imports

    Pull Requests

    • prevent cycles for indirectly awaited dynamic imports (@ryanchou1994, @lukastaegert)

  8. 4.64.4

    10 October 2026
    2026-10-10

    2026-10-10

    Bug Fixes

    • Support the Rollup WASM build on big-endian hosts

    Pull Requests

    • read the AST buffer correctly on big-endian hosts (@pkubaj, @lukastaegert)

    • Update dtolnay/rust-toolchain digest to 89b1218 (@renovate[bot], @lukastaegert)

    • Update minor/patch updates

    • Improve PR testing instructions comments

  9. 4.64.3

    8 October 2026
    2026-10-08

    2026-10-08

    Bug Fixes

    • Fix a performance regression when bundling code with deeply nested property calls

    Pull Requests

    • Fix path-dependent explosion when including call arguments of reassigned variables

  10. 4.64.2

    7 October 2026
    2026-10-07

    2026-10-07

    Bug Fixes

    • Fix a regression where certain CoreJS helpers were wrongly tree-shaken

    • Do not show errors from closeBundle if there were also build errors

    Pull Requests

    • Preserve build errors when closeBundle fails (@Jo2234, @lukastaegert)

    • Rework REPL artefacts and performance report workflows

    • Do not resolve values of assigned variables returned on all paths

Show 12 earlier releases

  1. 4.64.1

    7 October 2026
    2026-10-07

    2026-10-07

    Bug Fixes

    • Slightly improve performance when rendering ES output

    Pull Requests

    • Avoid repeated export name scans when rendering ES chunks (@irontaek, @lukastaegert)

  2. 4.64.0

    2 October 2026
    2026-10-02

    2026-10-02

    Features

    • Improve try-catch deoptimization to cover calling methods on objects

    Bug Fixes

    • Fix a situation where some feature-detections of core-js were not triggering properly

    Pull Requests

    • Retain callbacks of helper methods called from try statements

    • Run additional tests as part of the coverage job

    • Update msys2/setup-msys2 digest to ec48f7c (@renovate[bot], @lukastaegert)

    • Update minor/patch updates

    • Update Rust crate swc_compiler_base to v65

  3. 4.63.6

    1 October 2026
    2026-10-01

    2026-10-01

    Bug Fixes

    • Ensure external reexports are always imported when used in a reified dynamic namespace

    Pull Requests

    • Update minor/patch updates

    • Import external re-exports used by shared-chunk namespace objects

  4. 4.63.5

    24 September 2026
    2026-09-24

    2026-09-24

    Bug Fixes

    • Fix an issue where watch mode would hang instead of terminating when closing via Ctrl+C

    • Avoid starting overlapping watch mode runs when plugins invalidate files at the wrong time

    • Fix many edge cases where watch mode events were not properly emitted to listeners, especially when errors occur

    Pull Requests

    • Terminate watch mode via natural process exit when possible

    • Protect cc pin against renovate lock file maintenance

    • watch: prevent overlapping runs and other run lifecycle bugs

  5. 4.63.4

    19 September 2026
    2026-09-19

    2026-09-19

    Bug Fixes

    • Ensure meta information of the cached module is exposed in shouldTransformCachedModule

    • Do not create invalid code if import attribute values contain special characters

    Pull Requests

    • expose cached module meta during cache checks (@ychampion, @lukastaegert)

    • Escape quotes and backslashes in import attribute values (@dylanpulver, @lukastaegert)

    • Improve agent instructions

    • Request Copilot code review via workflow

  6. 4.63.3

    14 September 2026
    2026-09-14

    2026-09-14

    Bug Fixes

    • Make sure that the internal shims for basename and extname in the browser build fully match NodeJS

    • Always report and recover from failures on invalidation in watch mode

    • Respect windows line terminators when tree-shaking in situations where line-breaks need to be removed to prevent automatic semicolon insertion

    Pull Requests

    • browser: match node's basename and extname (@luantaraschi, @lukastaegert)

    • watch: await the rerun so listener failures surface as ERROR events (@yoominho91, @irontaek, @lukastaegert)

    • Remove the whole CRLF pair when suppressing ASI

  7. 4.63.2

    12 September 2026
    2026-09-12

    2026-09-12

    Bug Fixes

    • Fix a bug when filtering logs for nested properties via the CLI

    Pull Requests

    • pin mocha to v11 (@renovate[bot], @lukastaegert)

    • Fix nested log filters for primitive values (@jakezwang, @lukastaegert)

  8. 4.63.1

    28 August 2026
    2026-08-28

    2026-08-28

    Bug Fixes

    • Revert function return value tracking until the most recent issue is understood

    Pull Requests

    • Revert improve function return value tracking

  9. 4.63.0

    25 August 2026
    2026-08-25

    2026-08-25

    Features

    • Allow to analyze function return values in many more cases

    Pull Requests

    • improve function return value tracking (@cyyynthia, @lukastaegert)

    • Remove unused rendered module sources map (@yoominho91, @irontaek, @lukastaegert)

  10. 4.62.5

    20 August 2026
    2026-08-20

    2026-08-20

    Bug Fixes

    • Resolve an issue where compact mode could result in invalid module concatenations

    Pull Requests

    • Keep the semicolon added after a replaced default export (@Jaybhade, @lukastaegert)

  11. 4.62.4

    1 August 2026
    2026-08-01

    2026-08-01

    Bug Fixes

    • Resolve a regression when using Rollup on older Linux distributions

  12. 4.62.3

    26 July 2026
    2026-07-26

    2026-07-26

    Bug Fixes

    • Sanitize illegal characters preserved modules input base

    Pull Requests

    • make isLegal idempotent by not using a global-flag regex (@spokodev, @lukastaegert)

    • Sanitize input base before computing preserved module chunk names (@MahinAnowar, @lukastaegert)

    • Fix build:docs after rollup update

All 879 releases

Major versions

  • 4.xsince 5 October 2023 · latest 4.64.12 · 185 releases
  • 3.xsince 11 October 2022 · latest 3.30.0 · 83 releases
  • 2.xsince 6 March 2020 · latest 2.80.0 · 217 releases
  • 1.xsince 28 December 2018 · latest 1.32.1 · 121 releases
  • 0.xsince 14 May 2015 · latest 0.68.2 · 273 releases

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 20 October 2026. Releases and advisories last read 20 October 2026.

Know when your own dependencies move

Inlinr tracks your coding time automatically. Switch dependency tracking on for a project and it reads that repository's manifest to show what is behind and what has been deprecated — off by default, one project at a time.

See what Inlinr doesAll packages