build: update all non-major dependencies (main)

[angular-robot]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@oxc-project/types (source)	0.153.0 → 0.154.0
@rollup/wasm-node (source)	4.64.5 → 4.64.6
oxc-parser (source)	0.153.0 → 0.154.0
postcss (source)	8.5.29 → 8.5.30
rollup (source)	4.64.5 → 4.64.6
undici (source)	8.11.2 → 8.12.0

---

• If you want to rebase/retry this PR, check this box

---

Release Notes

rollup/rollup (@​rollup/wasm-node)

v4.64.6

Compare Source

2026-10-13

Bug Fixes

• Do not tree-shake side effects in class instance fields (#​6551)
• Extend top-level-await detection to handle asynchronous for...of loops and async disposal (#​6563)

Pull Requests

• #​6551: Retain instance field initializers with side effects when instantiating a class (@​SulimanAbdulrazzaq, @​lukastaegert)
• #​6563: Recognize top-level asynchronous loops and disposal (@​TrickyPi)
• #​6570: Lock file maintenance (@​renovate[bot])
• #​6571: Align lock file maintenance with other updates (@​lukastaegert)
• #​6573: Make addWatchFile watch test robust against watcher start-up timing (@​lukastaegert)

oxc-project/oxc (oxc-parser)

v0.154.0

💥 BREAKING CHANGES

• 7730e14 ast: [BREAKING] Refactor comment attachment storage (#​27512) (camc314)
• c904b61 ast: [BREAKING] Add comment attachment storage (#​27393) (camc314)

postcss/postcss (postcss)

v8.5.30

Compare Source

• Fix broken map on </style> escaping (by @​Rufflet).

nodejs/undici (undici)

v8.12.0

Compare Source

What's Changed

• fix(cookies): ignore a numeric expires outside the Date range by @​xia-chao in #​5832
• fix(http2): pause bodyTimeout while applying backpressure by @​jasnell in #​5884
• fix(cache): track cached response abort state by @​mcollina in #​5820
• fix(deduplicate): make terminal callbacks exception-safe by @​mcollina in #​5838
• fix(decompress): stop inflating compress and x-compress by @​luantaraschi in #​5665
• fix(cache): evict least recently used entries in MemoryCacheStore by @​jasnell in #​5869
• fix(eventsource): fix redirect targets in eventsource by @​jasnell in #​5878
• fix(redirect): fix throwOnMaxRedirect edge by @​jasnell in #​5879
• fix: normalize HTTP/2 headers for legacy dispatch handlers by @​Knowzzz in #​5867
• fix(session cache): fix bug in tls session caching by @​jasnell in #​5882
• docs: fix relative links broken by the README move by @​v1teka in #​5843
• fix(redirect): add error code to max redirects error by @​mcollina in #​5895
• fix(eventsource): fix retry wrap bug by @​jasnell in #​5875
• fix(retry): keep request headers when resuming a download by @​jasnell in #​5870
• fix(proxyagent): correct handling of the host header by @​jasnell in #​5868
• fix(http1): fix handling of 204/304 responses by @​jasnell in #​5864
• test: add unexpected disconnect guards to two more h2 tests by @​zeexzeex in #​5825
• fix(cache): preserve 304 response event order with async stores by @​marcopiraccini in #​5797
• fix(dns): handle a null pick, and stop failing over to an expired record by @​datrixlab in #​5791
• fix: keep a header named proto across features by @​luantaraschi in #​5688
• ci: exclude tests from CodeQL analysis by @​mcollina in #​5905
• fix(pool): ensure that removed clients don't pick up requests by @​jasnell in #​5881
• feat: Added @​perseveranza-pets/milo as alternative experimental HTTP parser by @​ShogunPanda in #​5492
• extractBody fixes 2 by @​KhafraDev in #​5926
• reenable cachestorage wpts by @​KhafraDev in #​5907
• fix(fetch): parse language tag in filename* parameters by @​fallintoplace in #​5908
• fix(client): preserve tracked response header field boundaries by @​ronag in #​5940
• fix(http1): fixup strictContentLength handling by @​jasnell in #​5897
• feat(cache): compress big sqlite cache entries with zstd by @​mcollina in #​5744
• fix(eventsource): enforce maxEventSize on unterminated lines by @​mcollina in #​5814
• limit zstd window size to 8 MB by @​KhafraDev in #​5955
• test: add unexpected disconnect guards to http2-body.js by @​GhostCoder6969 in #​5914
• test: fix "specifiy" typo in cache interceptor test by @​ump45nose in #​5922
• Wpt/wpt runner fixes by @​KhafraDev in #​5959
• fix(h2): unref a session detached by GOAWAY with no open streams by @​kjsik11 in #​5960
• feat: Throw an error when WebAssembly is not available. by @​ShogunPanda in #​5966
• chore: Vendor milo 0.9.0. by @​ShogunPanda in #​5954
• build(deps-dev): bump ws from 8.21.3 to 8.22.0 by @​dependabot[bot] in #​5968
• build(deps-dev): bump undici from 6.28.0 to 6.29.0 by @​dependabot[bot] in #​5933
• fix(typemap): .md -> .html by @​avivkeller in #​5602
• build(deps): bump js-yaml from 4.1.1 to 4.3.2 by @​dependabot[bot] in #​5810
• build(deps): bump brace-expansion by @​dependabot[bot] in #​5934
• build(deps-dev): bump fast-check from 4.10.1 to 4.10.2 by @​dependabot[bot] in #​5921
• test(fetch): settle h2 internal stream errors by @​Yahiro025 in #​5927
• docs(errors): clarify timeout error codes and related options by @​theamodhshetty in #​4856
• fix(interceptor): limit response error body size by @​mcollina in #​5942
• build(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 by @​dependabot[bot] in #​5946
• build(deps): bump hendrikmuhs/ccache-action from 1.2.23 to 1.2.24 by @​dependabot[bot] in #​5951
• build(deps): bump github/codeql-action/analyze from 4.37.9 to 4.38.2 by @​dependabot[bot] in #​5952
• build(deps): bump github/codeql-action/autobuild from 4.37.9 to 4.38.2 by @​dependabot[bot] in #​5950
• build(deps): bump github/codeql-action/init from 4.37.9 to 4.38.2 by @​dependabot[bot] in #​5948
• build(deps): bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.2 by @​dependabot[bot] in #​5947
• build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​5630
• fix(http1): reset connections for no-body transfer encoding by @​mcollina in #​5941
• fix: exclude experimental milo from node.js core bundle by @​mcollina in #​5935
• test: re-enable HTTP/2 churn test on Node.js 26 by @​mcollina in #​5961
• test: keep the h2c unix socket path within sun_path limits by @​mcollina in #​5978
• fix(cache): preserve abort reasons after completion by @​domenic in #​5958
• test: update milo paths in bundle-parser test by @​mcollina in #​5979
• fix(cache): always treat zero-lifetime entries as stale by @​mcollina in #​5980
• build(deps): bump step-security/harden-runner from 2.21.0 to 2.21.1 by @​dependabot[bot] in #​5949
• fix(websocket,eventsource): keep receive limits behind dispatcher wrappers by @​jasnell in #​5896
• fix(http2): enforce max concurrent streams by @​jasnell in #​5885
• docs: sync WG collaborators with nodejs/undici team by @​mcollina in #​5991
• build(deps-dev): bump @​fastify/busboy from 3.2.2 to 3.2.3 by @​dependabot[bot] in #​6005
• fix: ignore missing release ref during cleanup by @​mcollina in #​5891
• fix: reject unsupported FormData request bodies by @​mcollina in #​5913
• split wpt out of npm test by @​mcollina in #​5588

New Contributors

• @​xia-chao made their first contribution in #​5832
• @​jasnell made their first contribution in #​5884
• @​Knowzzz made their first contribution in #​5867
• @​v1teka made their first contribution in #​5843
• @​datrixlab made their first contribution in #​5791
• @​fallintoplace made their first contribution in #​5908
• @​GhostCoder6969 made their first contribution in #​5914
• @​ump45nose made their first contribution in #​5922

Full Changelog: nodejs/undici@v8.11.2...v8.12.0

[gemini-code-assist]

Code Review

This pull request updates several dependencies across multiple package.json files, including upgrading rollup and @rollup/wasm-node to 4.64.6, oxc-parser and @oxc-project/types to 0.154.0, and postcss to 8.5.30. I have no feedback to provide.