fix(deps): synchronize upstream requirements and remove unused dependencies

.claude/agents/cargo-workspace-merger.md

@@ -41,16 +41,25 @@ Merge a child Cargo workspace (located in a subdirectory) into a parent root Car
 - From the child's `[workspace.dependencies]`, only include those that are actually used by the crates
 - Check for conflicts with existing root workspace dependencies:
   - Same dependency, same version: Skip (already exists)
-  - Same dependency, different version: Flag for manual resolution and suggest keeping the newer version
+  - Same dependency, different version: Use the requirement from the pinned upstream source, preserving documented integration constraints
 - Exclude dev-only dependencies that aren't needed for the merged crates
 
+For Rolldown and `oxc-node`, compare the pinned manifests with root `[workspace.dependencies]`. Rolldown declares workspace dependencies; `oxc-node` declares direct, build, and target-specific dependencies. Synchronize shared dependencies used by the vendored crates with upstream requirements. If both sources use a dependency, select a requirement compatible with both. Preserve root features and documented minimum versions, including `napi`'s security minimum. The shared `oxc` version follows Rolldown; keep the existing `patch-oxc-node.ts` integration. Do not import versions used only by upstream development tools into unrelated project crates.
+
 ### Step 5: Update Root Cargo.toml
 
 - Add all crate path references to `[workspace.dependencies]`
 - Add filtered workspace dependencies to `[workspace.dependencies]`
 - Maintain alphabetical ordering within sections for cleanliness
 - Preserve any existing comments and formatting
 
+When synchronizing Rolldown or `oxc-node`, update the root Cargo dependency exclusion in `.github/renovate.json`:
+
+- Keep `matchPackageNames` aligned with the shared registry dependencies used by the vendored crates. Exclude dependencies used only by upstream development tools from this list.
+- Use the `package` name for renamed crates and keep the list in alphabetical order.
+- Keep the rule limited to the `cargo` manager and root `Cargo.toml`. Project-only crates and other manifests must remain enabled.
+- Leave `oxc` crates covered by the existing pattern rule. `.github/workflows/upgrade-deps.yml` manages these dependencies with the upstream sources.
+
 ## Output Format
 
 Provide:
@@ -66,7 +75,7 @@ Provide:
 - Ensure no duplicate entries are created
 - Validate that merged dependencies don't break existing crates
 - After modifications, suggest running `cargo check --workspace` to verify the merge
-- Use highest compatible semver versions (if not pinned) and merge features in crates
+- Check shared requirements against the pinned upstream sources and preserve the features needed by each crate
 
 ## Important Considerations
 

.github/renovate.json

@@ -8,6 +8,7 @@
     "bench/fixtures/**",
     "crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/**",
     "packages/cli/src/__tests__/fixtures/**",
+    "oxc-node/**",
     "rolldown/**",
     "vite/**"
   ],
@@ -119,76 +120,37 @@
       "enabled": false
     },
     {
-      "description": "Ignore root catalog dependencies imported from rolldown/pnpm-workspace.yaml and vite/pnpm-workspace.yaml by sync-remote in .github/workflows/upgrade-deps.yml. Keep this list aligned with the upstream catalogs; independent package.json dependencies remain enabled.",
+      "description": "Ignore root catalog dependencies imported from rolldown/pnpm-workspace.yaml and vite/pnpm-workspace.yaml by sync-remote in .github/workflows/upgrade-deps.yml. Keep this list aligned with used upstream catalog entries; independent package.json dependencies remain enabled.",
       "matchManagers": ["npm"],
       "matchFileNames": ["pnpm-workspace.yaml"],
       "matchPackageNames": [
-        "@babel/core",
-        "@babel/preset-env",
-        "@babel/preset-typescript",
         "@emnapi/core",
         "@emnapi/runtime",
-        "@jridgewell/trace-mapping",
         "@napi-rs/cli",
         "@napi-rs/wasm-runtime",
-        "@pnpm/find-workspace-packages",
         "@rolldown/pluginutils",
-        "@rollup/plugin-commonjs",
-        "@rollup/plugin-node-resolve",
-        "@types/babel__core",
-        "@types/connect",
-        "@types/fs-extra",
-        "@types/lodash-es",
         "@types/node",
-        "@types/semver",
-        "@types/serve-static",
-        "@types/ws",
-        "acorn",
-        "astring",
         "cac",
-        "chalk",
-        "change-case",
-        "connect",
         "consola",
-        "dedent",
-        "diff",
         "emnapi",
-        "esbuild",
-        "estree-toolkit",
         "execa",
-        "fast-glob",
-        "follow-redirects",
         "fresh-import",
-        "fs-extra",
         "glob",
-        "lodash-es",
-        "micromatch",
         "pathe",
-        "react",
-        "react-dom",
-        "remark-parse",
         "remeda",
         "rolldown-plugin-dts",
         "rollup",
         "semver",
-        "serve-static",
         "signal-exit",
         "source-map",
-        "tinybench",
-        "tinyexec",
-        "tsx",
         "typescript",
-        "unified",
         "valibot",
-        "vue",
-        "web-tree-sitter",
-        "ws",
-        "zx"
+        "yaml"
       ],
       "enabled": false
     },
     {
-      "description": "Ignore root workspace crates shared with rolldown/Cargo.toml and merged by .github/workflows/upgrade-deps.yml. Keep this list aligned with Rolldown's registry dependencies, using package names for renamed crates; project-only crates and other manifests remain enabled.",
+      "description": "Ignore root workspace crates used by vendored Rolldown or oxc-node crates and synchronized by .github/workflows/upgrade-deps.yml. Keep this list aligned with their registry dependencies, using package names for renamed crates; project-only crates, upstream development tools, and other manifests remain enabled.",
       "matchManagers": ["cargo"],
       "matchFileNames": ["Cargo.toml"],
       "matchPackageNames": [
@@ -211,9 +173,9 @@
         "form_urlencoded",
         "futures",
         "glob",
+        "globstar",
         "heck",
         "idna_adapter",
-        "ignore",
         "indexmap",
         "infer",
         "insta",
@@ -239,26 +201,22 @@
         "petgraph",
         "phf",
         "pnp",
-        "prettyplease",
-        "proc-macro2",
-        "quote",
         "rayon",
         "regex",
         "regress",
         "rolldown-ariadne",
         "rolldown-notify",
         "rolldown-notify-debouncer-full",
         "rustc-hash",
+        "saphyr",
         "schemars",
         "self_cell",
         "serde",
         "serde_json",
-        "serde_yaml",
         "simdutf8",
         "smallvec",
         "sugar_path",
         "supports-color",
-        "syn",
         "terminal_size",
         "testing_macros",
         "tokio",

.github/scripts/__tests__/upgrade-deps.spec.ts

@@ -44,7 +44,9 @@ test.each([false, true])(
     const workspacePath = join(tempDir, 'pnpm-workspace.yaml');
     writeFileSync(
       workspacePath,
-      readFileSync(workspacePath, 'utf8').replace(/  lint-staged: .+/, '  lint-staged: ^16.2.6'),
+      readFileSync(workspacePath, 'utf8')
+        .replace(/  lint-staged: .+/, '  lint-staged: ^16.2.6')
+        .replace(/^  oxc-(?:minify|transform): .+\n/gm, ''),
     );
 
     vi.spyOn(process, 'cwd').mockReturnValue(tempDir);
@@ -81,6 +83,12 @@ test.each([false, true])(
       if (url === 'https://registry.npmjs.org/oxlint-tsgolint/latest') {
         return Response.json({ version: '7.0.2004' });
       }
+      if (
+        url === 'https://registry.npmjs.org/oxc-minify/latest' ||
+        url === 'https://registry.npmjs.org/oxc-transform/latest'
+      ) {
+        throw new Error('Unused root catalog packages must not be updated');
+      }
       if (url.startsWith('https://registry.npmjs.org/') && url.endsWith('/latest')) {
         return Response.json({ version: '1.2.3' });
       }
@@ -130,6 +138,8 @@ test.each([false, true])(
     expect(versions['@oxlint/plugins'].new).toBe('1.88.0');
     expect(versions['@oxlint/plugins'].new).toBe(versions.oxlint.new);
     expect(versions['oxlint-tsgolint'].new).toBe('7.0.2004');
+    expect(versions).not.toHaveProperty('oxc-minify');
+    expect(versions).not.toHaveProperty('oxc-transform');
     expect(versions['oxc-node']).toEqual(
       failInstall
         ? { old: pinnedOxcNode, new: pinnedOxcNode }

.github/scripts/upgrade-deps.ts

@@ -65,9 +65,7 @@ type PnpmWorkspaceVersions = {
   oxlintTsgolint: string;
   oxcProjectRuntime: string;
   oxcProjectTypes: string;
-  oxcMinify: string;
   oxcParser: string;
-  oxcTransform: string;
 };
 
 type PnpmWorkspaceEntry = {
@@ -370,24 +368,12 @@ async function updatePnpmWorkspace(versions: PnpmWorkspaceVersions): Promise<voi
       replacement: `'@oxc-project/types': =${versions.oxcProjectTypes}`,
       newVersion: versions.oxcProjectTypes,
     },
-    {
-      name: 'oxc-minify',
-      pattern: /oxc-minify: =([\d.]+(?:-[\w.]+)?)/,
-      replacement: `oxc-minify: =${versions.oxcMinify}`,
-      newVersion: versions.oxcMinify,
-    },
     {
       name: 'oxc-parser',
       pattern: /oxc-parser: =([\d.]+(?:-[\w.]+)?)/,
       replacement: `oxc-parser: =${versions.oxcParser}`,
       newVersion: versions.oxcParser,
     },
-    {
-      name: 'oxc-transform',
-      pattern: /oxc-transform: =([\d.]+(?:-[\w.]+)?)/,
-      replacement: `oxc-transform: =${versions.oxcTransform}`,
-      newVersion: versions.oxcTransform,
-    },
   ];
 
   for (const { name, pattern, replacement, newVersion } of entries) {
@@ -552,9 +538,7 @@ async function upgradeDependencies(): Promise<void> {
     oxlintTsgolintVersion,
     oxcProjectRuntimeVersion,
     oxcProjectTypesVersion,
-    oxcMinifyVersion,
     oxcParserVersion,
-    oxcTransformVersion,
   ] = await Promise.all([
     getLatestNpmVersionForMajor('vitest', SUPPORTED_VITEST_MAJOR),
     getLatestNpmVersion('tsdown'),
@@ -568,9 +552,7 @@ async function upgradeDependencies(): Promise<void> {
     getLatestNpmVersion('oxlint-tsgolint'),
     getLatestNpmVersion('@oxc-project/runtime'),
     getLatestNpmVersion('@oxc-project/types'),
-    getLatestNpmVersion('oxc-minify'),
     getLatestNpmVersion('oxc-parser'),
-    getLatestNpmVersion('oxc-transform'),
   ]);
 
   console.log(`vitest: ${vitestVersion}`);
@@ -585,9 +567,7 @@ async function upgradeDependencies(): Promise<void> {
   console.log(`oxlint-tsgolint: ${oxlintTsgolintVersion}`);
   console.log(`@oxc-project/runtime: ${oxcProjectRuntimeVersion}`);
   console.log(`@oxc-project/types: ${oxcProjectTypesVersion}`);
-  console.log(`oxc-minify: ${oxcMinifyVersion}`);
   console.log(`oxc-parser: ${oxcParserVersion}`);
-  console.log(`oxc-transform: ${oxcTransformVersion}`);
 
   await updateUpstreamVersions();
   await updatePnpmWorkspace({
@@ -602,9 +582,7 @@ async function upgradeDependencies(): Promise<void> {
     oxlintTsgolint: oxlintTsgolintVersion,
     oxcProjectRuntime: oxcProjectRuntimeVersion,
     oxcProjectTypes: oxcProjectTypesVersion,
-    oxcMinify: oxcMinifyVersion,
     oxcParser: oxcParserVersion,
-    oxcTransform: oxcTransformVersion,
   });
   await updateVitestVersionConstant(vitestVersion);
   // Keep the selected versions available if installation or upstream sync fails.

.github/workflows/upgrade-deps.yml

@@ -112,12 +112,14 @@ jobs:
               Official Vitest packages must use that version. Do not bypass the cap.
             - Sync-remote tool: `pnpm tool sync-remote` (source in
               `packages/tools/src/sync-remote-deps.ts`) — clones rolldown/vite into the
-              working tree, merges their pnpm-workspace catalogs into the root
-              `pnpm-workspace.yaml`, and syncs the root `Cargo.toml` oxc crate
+              working tree, imports only their build roots and bundled packages,
+              and keeps catalog entries referenced by the retained workspace packages.
+              It updates `pnpm-workspace.yaml` and syncs the root `Cargo.toml` oxc crate
               versions to match `rolldown/Cargo.toml`.
             - Build-upstream action: `./.github/actions/build-upstream/action.yml`
-            - Package manager: `pnpm`. Do not downgrade a dependency selected by the
-              upgrade script. Use the latest version that its compatibility policy allows.
+            - Package manager: `pnpm`. Preserve toolchain versions selected by the
+              upgrade script under its compatibility policy. Other shared dependencies
+              follow the pinned upstream requirements.
             - After changing tsdown or rolldown-plugin-dts, run
               `node .github/scripts/upgrade-deps.ts --sync-bundled-deps`, then
               `pnpm install --no-frozen-lockfile`. Core's external `yuku-parser` must
@@ -135,15 +137,11 @@ jobs:
             ### Fixups to perform (in order)
             1. If the `Upgrade dependencies and sync upstream` outcome above is `failure`,
                fix it FIRST — nothing else will work until the merged workspace is correct.
-               Read the failed command in the upgrade log and re-run it. The most common cause is a
-               cross-major semver conflict in the merged catalog, e.g.
-               `Incompatible semver ranges for <pkg>: ^X vs ^Y`. The merger refuses to
-               auto-resolve cross-major conflicts for packages outside its synced list
-               (oxc-* and tinybench). For passthrough deps that vp does NOT import
-               directly (e.g. `diff`, `acorn`, `astring`, anything only present in
-               `rolldown/scripts/package.json` or vite's internals), bump vp's
-               `pnpm-workspace.yaml` catalog entry to match the rolldown/vite version,
-               then re-run `pnpm tool sync-remote` until it exits 0. Complete the remaining
+               Read the failed command in the upgrade log and re-run it. Resolve
+               catalog conflicts against the pinned Rolldown and Vite sources.
+               `sync-remote` follows their requirements for imported dependencies;
+               preserve its explicit Oxc, Vitest, and TypeScript integration policies.
+               Re-run `pnpm tool sync-remote` until it exits 0. Complete the remaining
                upgrade operations: `pnpm dedupe`,
                `node .github/scripts/upgrade-deps.ts --sync-bundled-deps`, then
                `pnpm install --no-frozen-lockfile` before building or testing.
@@ -157,8 +155,12 @@ jobs:
                from `rolldown/Cargo.toml`, bump it to match (the oxc same-version
                family follows rolldown's umbrella `oxc` version), run `cargo update`,
                and rebuild.
-            3. If the rolldown hash changed, follow `.claude/agents/cargo-workspace-merger.md`
-               to resync the workspace.
+            3. Follow `.claude/agents/cargo-workspace-merger.md` to synchronize shared root
+               Rust dependency requirements with both pinned upstream sources and
+               update their Renovate exclusions. Preserve documented integration
+               constraints and refresh `Cargo.lock` after the manifest changes.
+               Keep the root catalog exclusion in `.github/renovate.json` aligned with
+               used dependencies imported from the Rolldown and Vite catalogs.
             4. If `CLI_HELP_DIFF_CHANGED` is `true`, read the upstream help diff at
                `$CLI_HELP_DIFF_REPORT`, then follow
                `.claude/skills/sync-upstream-cli-help/SKILL.md` to update the mirrored