chore(deps-dev): bump rollup from 4.63.1 to 4.63.4

[dependabot]

Bumps rollup from 4.63.1 to 4.63.4.

Release notes

Sourced from rollup's releases.

v4.63.4

4.63.4

2026-09-19

Bug Fixes

• Ensure meta information of the cached module is exposed in shouldTransformCachedModule (#6442)
• Do not create invalid code if import attribute values contain special characters (#6502)

Pull Requests

• #6429: ci: collect Rust coverage from JS tests in dedicated job (@​lukastaegert)
• #6442: fix: expose cached module meta during cache checks (@​ychampion, @​lukastaegert)
• #6496: docs: name the parameter runHook actually takes (@​darkdi, @​lukastaegert)
• #6502: Escape quotes and backslashes in import attribute values (@​dylanpulver, @​lukastaegert)
• #6517: Improve agent instructions (@​lukastaegert)
• #6518: fix(deps): update minor/patch updates (@​renovate[bot])
• #6519: Request Copilot code review via workflow (@​lukastaegert)

v4.63.3

4.63.3

2026-09-14

Bug Fixes

• Make sure that the internal shims for basename and extname in the browser build fully match NodeJS (#6473)
• Always report and recover from failures on invalidation in watch mode (#6506)
• Respect windows line terminators when tree-shaking in situations where line-breaks need to be removed to prevent automatic semicolon insertion (#6514)

Pull Requests

• #6473: fix(browser): match node's basename and extname (@​luantaraschi, @​lukastaegert)
• #6506: fix(watch): await the rerun so listener failures surface as ERROR events (@​yoominho91, @​irontaek, @​lukastaegert)
• #6514: Remove the whole CRLF pair when suppressing ASI (@​NgoQuocViet2001)
• #6515: chore(deps): lock file maintenance (@​renovate[bot])

v4.63.2

4.63.2

2026-09-12

Bug Fixes

• Fix a bug when filtering logs for nested properties via the CLI (#6511)

Pull Requests

• #6498: chore(deps): lock file maintenance (@​renovate[bot])

... (truncated)

Changelog

Sourced from rollup's changelog.

4.63.4

2026-09-19

Bug Fixes

• Ensure meta information of the cached module is exposed in shouldTransformCachedModule (#6442)
• Do not create invalid code if import attribute values contain special characters (#6502)

Pull Requests

• #6429: ci: collect Rust coverage from JS tests in dedicated job (@​lukastaegert)
• #6442: fix: expose cached module meta during cache checks (@​ychampion, @​lukastaegert)
• #6496: docs: name the parameter runHook actually takes (@​darkdi, @​lukastaegert)
• #6502: Escape quotes and backslashes in import attribute values (@​dylanpulver, @​lukastaegert)
• #6517: Improve agent instructions (@​lukastaegert)
• #6518: fix(deps): update minor/patch updates (@​renovate[bot])
• #6519: Request Copilot code review via workflow (@​lukastaegert)

4.63.3

2026-09-14

Bug Fixes

• Make sure that the internal shims for basename and extname in the browser build fully match NodeJS (#6473)
• Always report and recover from failures on invalidation in watch mode (#6506)
• Respect windows line terminators when tree-shaking in situations where line-breaks need to be removed to prevent automatic semicolon insertion (#6514)

Pull Requests

• #6473: fix(browser): match node's basename and extname (@​luantaraschi, @​lukastaegert)
• #6506: fix(watch): await the rerun so listener failures surface as ERROR events (@​yoominho91, @​irontaek, @​lukastaegert)
• #6514: Remove the whole CRLF pair when suppressing ASI (@​NgoQuocViet2001)
• #6515: chore(deps): lock file maintenance (@​renovate[bot])

4.63.2

2026-09-12

Bug Fixes

• Fix a bug when filtering logs for nested properties via the CLI (#6511)

Pull Requests

• #6498: chore(deps): lock file maintenance (@​renovate[bot])
• #6503: fix(deps): update minor/patch updates (@​renovate[bot])
• #6504: chore(deps): update dependency eslint-plugin-unicorn to v74 (@​renovate[bot])
• #6505: pin mocha to v11 (@​renovate[bot], @​lukastaegert)

... (truncated)

Commits

• ba78d57 4.63.4
• 67c3379 Escape quotes and backslashes in import attribute values (#6502)
• 35f6053 fix: expose cached module meta during cache checks (#6442)
• b7ae5e2 Request Copilot code review via workflow (#6519)
• 504824c fix(deps): update minor/patch updates (#6518)
• 05980cf Improve agent instructions (#6517)
• 942a0a8 ci: collect Rust coverage from JS tests in dedicated job (#6429)
• e8c8dd6 docs: name the parameter runHook actually takes (#6496)
• 250deca 4.63.3
• 01ab3f8 fix(watch): await the rerun so listener failures surface as ERROR events (#6506)
• Additional commits viewable in compare view

[dhensby]

@dependabot rebase

[dhensby]

Approved.

Scope. The diff changes package.json and package-lock.json only. rollup moves ^4.63.1 to ^4.63.4, a devDependency. The lockfile also moves the 25 optional platform binaries, which rollup pins to its own version.

Rebase. Dependabot rebased this pull request after #284 and #286 merged. The new head re-resolved to 4.63.4, not the 4.63.3 in the title. The moving set was re-derived against the live base on the new head. It contains rollup and its platform binaries only, with zero references to js-yaml and @types/node, so #284 and #286 cannot be reverted.

Supply chain. The publisher is GitHub Actions with OIDC, and the oidcConfigId is identical to 4.63.1. The dependency set is unchanged (@types/estree@1.0.9). engines is unchanged (node >=18.0.0, npm >=8.0.0). There are no install hooks. The only script change adds two development coverage scripts, test:coverage:rust and build:napi:coverage, which never run for a registry install.

CI. All 14 checks pass at head 97116e1b, including the full runaction matrix across windows-2022 and windows-2025 for SQL Server 2016, 2017, 2019, 2022 and latest. Release is skipped, as expected on a pull request.