build(deps-dev): bump rollup from 4.63.1 to 4.63.5

[dependabot]

Bumps rollup from 4.63.1 to 4.63.5.

Release notes

Sourced from rollup's releases.

v4.63.5

4.63.5

2026-09-24

Bug Fixes

• Fix an issue where watch mode would hang instead of terminating when closing via Ctrl+C (#6521)
• Avoid starting overlapping watch mode runs when plugins invalidate files at the wrong time (#6526)
• Fix many edge cases where watch mode events were not properly emitted to listeners, especially when errors occur (#6526)

Pull Requests

• #6520: Lock file maintenance (@​renovate[bot], @​lukastaegert)
• #6521: Terminate watch mode via natural process exit when possible (@​lukastaegert)
• #6523: Protect cc pin against renovate lock file maintenance (@​lukastaegert)
• #6525: docs: fix typos 'interations' and 'coresponding' (@​haimingZZ)
• #6526: fix(watch): prevent overlapping runs and other run lifecycle bugs (@​lukastaegert)

v4.63.4

4.63.4

2026-09-19

Bug Fixes

• Ensure meta information of the cached module is exposed in shouldTransformCachedModule (#6442)
• Do not create invalid code if import attribute values contain special characters (#6502)

Pull Requests

• #6429: ci: collect Rust coverage from JS tests in dedicated job (@​lukastaegert)
• #6442: fix: expose cached module meta during cache checks (@​ychampion, @​lukastaegert)
• #6496: docs: name the parameter runHook actually takes (@​darkdi, @​lukastaegert)
• #6502: Escape quotes and backslashes in import attribute values (@​dylanpulver, @​lukastaegert)
• #6517: Improve agent instructions (@​lukastaegert)
• #6518: fix(deps): update minor/patch updates (@​renovate[bot])
• #6519: Request Copilot code review via workflow (@​lukastaegert)

v4.63.3

4.63.3

2026-09-14

Bug Fixes

• Make sure that the internal shims for basename and extname in the browser build fully match NodeJS (#6473)
• Always report and recover from failures on invalidation in watch mode (#6506)
• Respect windows line terminators when tree-shaking in situations where line-breaks need to be removed to prevent automatic semicolon insertion (#6514)

... (truncated)

Changelog

Sourced from rollup's changelog.

4.63.5

2026-09-24

Bug Fixes

• Fix an issue where watch mode would hang instead of terminating when closing via Ctrl+C (#6521)
• Avoid starting overlapping watch mode runs when plugins invalidate files at the wrong time (#6526)
• Fix many edge cases where watch mode events were not properly emitted to listeners, especially when errors occur (#6526)

Pull Requests

• #6520: Lock file maintenance (@​renovate[bot], @​lukastaegert)
• #6521: Terminate watch mode via natural process exit when possible (@​lukastaegert)
• #6523: Protect cc pin against renovate lock file maintenance (@​lukastaegert)
• #6525: docs: fix typos 'interations' and 'coresponding' (@​haimingZZ)
• #6526: fix(watch): prevent overlapping runs and other run lifecycle bugs (@​lukastaegert)

4.63.4

2026-09-19

Bug Fixes

• Ensure meta information of the cached module is exposed in shouldTransformCachedModule (#6442)
• Do not create invalid code if import attribute values contain special characters (#6502)

Pull Requests

• #6429: ci: collect Rust coverage from JS tests in dedicated job (@​lukastaegert)
• #6442: fix: expose cached module meta during cache checks (@​ychampion, @​lukastaegert)
• #6496: docs: name the parameter runHook actually takes (@​darkdi, @​lukastaegert)
• #6502: Escape quotes and backslashes in import attribute values (@​dylanpulver, @​lukastaegert)
• #6517: Improve agent instructions (@​lukastaegert)
• #6518: fix(deps): update minor/patch updates (@​renovate[bot])
• #6519: Request Copilot code review via workflow (@​lukastaegert)

4.63.3

2026-09-14

Bug Fixes

• Make sure that the internal shims for basename and extname in the browser build fully match NodeJS (#6473)
• Always report and recover from failures on invalidation in watch mode (#6506)
• Respect windows line terminators when tree-shaking in situations where line-breaks need to be removed to prevent automatic semicolon insertion (#6514)

Pull Requests

• #6473: fix(browser): match node's basename and extname (@​luantaraschi, @​lukastaegert)

... (truncated)

Commits

• 3722484 4.63.5
• 9156d5b fix(watch): prevent overlapping runs and other run lifecycle bugs (#6526)
• 87fbbf6 Protect cc pin against renovate lock file maintenance (#6523)
• 30f0442 docs: fix typos 'interations' and 'coresponding' (#6525)
• b54c4c2 Lock file maintenance (#6520)
• c28de6f Terminate watch mode via natural process exit when possible (#6521)
• ba78d57 4.63.4
• 67c3379 Escape quotes and backslashes in import attribute values (#6502)
• 35f6053 fix: expose cached module meta during cache checks (#6442)
• b7ae5e2 Request Copilot code review via workflow (#6519)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)