# What changed in rollup

> 66 changes in rollup 4 from its official release notes, upgrade guides and advisories: 1 breaking, 1 deprecations, 1 security, 2 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/rollup/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## rollup 4

### Breaking changes

- Rollup throws if the generated bundle contains paths that would leave the output directory. (3.30.0, 4.59.0) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.59.0), [release notes](https://github.com/rollup/rollup/releases/tag/v3.30.0)

### Security

- Rollup 4 has Arbitrary File Write via Path Traversal (3.30.0, 4.59.0) — [security advisory](https://github.com/advisories/GHSA-MW96-CPMX-2VGC)

### Deprecations

- Returning import attributes from load or transform hooks is deprecated and will no longer be supported with Rollup 5. (4.57.0) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.57.0)

### New APIs and options

- Rollup supports source phase imports as long as they are external. (4.60.0) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.60.0)
- Import attributes are now available in plugin hooks that did not provide them before. (4.57.0) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.57.0)

### Performance

- Rendering ES output is slightly faster by avoiding repeated export name scans when rendering ES chunks. (4.64.1) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.64.1)
- Unused Symbol.hasInstance, Symbol.dispose and Symbol.asyncDispose properties can now be tree-shaken. (4.54.0) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.54.0)
- Caching generated variable names improves rendering performance. (4.53.0) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.53.0)

### Behavior and default changes

- Try-catch deoptimization now covers calling methods on objects, retaining callbacks of helper methods called from try statements. (4.64.0) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.64.0)
- Rollup can analyze function return values in more cases, which may affect build-time analysis. (4.63.0) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.63.0)
- Static dependencies shared between manual chunks and entry points are extracted into separate chunks. (4.62.0) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.62.0)
- Entry modules are sorted to make chunk hash names deterministic. (4.61.0) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.61.0)
- Rollup also supports the annotation before variable declarations that declare function expressions. (4.58.0) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.58.0)
- Rollup tracks object property inclusions of dynamic namespace members. (4.56.0) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.56.0)

### Fixes and other changes

- Live-bindings are now properly maintained for aliased exports. (4.64.9) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.64.9)
- Typed array constructor calls are retained when their argument has iteration side effects. (4.64.9) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.64.9)
- Chunk hashes now change when sourcemap comments change, avoiding stale hashes when those comments are modified. (4.64.8) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.64.8)
- Fixes some relative import resolution edge cases, matching Node's join and relative behavior for "." and ".." segments in the browser. (4.64.8) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.64.8)
- Fixes watching not-yet-created files from plugins when several share a directory. (4.64.7) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.64.7)
- Side effects in class instance field initializers are retained when instantiating a class, avoiding incorrect tree-shaking. (4.64.6) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.64.6)
- Detection now recognizes top-level asynchronous for...of loops and async disposal. (4.64.6) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.64.6)
- Prevents cycles when using indirect top-level await for dynamic imports. (4.64.5) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.64.5)
- The Rollup WASM build is supported on big-endian hosts. (4.64.4) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.64.4)
- Fixes a performance regression when bundling code with deeply nested property calls. (4.64.3) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.64.3)
- When build errors occur, errors from closeBundle no longer replace them. (4.64.2) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.64.2)
- Certain CoreJS helpers are no longer wrongly tree-shaken. (4.64.2) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.64.2)
- Fixes cases where some core-js feature-detections were not triggering properly. (4.64.0) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.64.0)
- External re-exports used in a reified dynamic namespace are now always imported. (4.63.6) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.63.6)
- Watch mode now terminates when closed via Ctrl+C instead of hanging. (4.63.5) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.63.5)
- Watch mode no longer starts overlapping runs when plugins invalidate files at the wrong time. (4.63.5) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.63.5)
- Watch mode events are now emitted to listeners correctly in edge cases, especially when errors occur. (4.63.5) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.63.5)
- Quotes and backslashes in import attribute values are escaped so Rollup does not generate invalid code. (4.63.4) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.63.4)
- Cached module meta information is now exposed in shouldTransformCachedModule, allowing plugins to access it during cache checks. (4.63.4) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.63.4)
- The browser shims for basename and extname now fully match NodeJS. (4.63.3) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.63.3)
- Tree-shaking respects Windows line terminators when removing line breaks needed to prevent automatic semicolon insertion. (4.63.3) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.63.3)
- Failures on invalidation are always reported and recovered from in watch mode. (4.63.3) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.63.3)
- Fixes filtering logs by nested properties via the CLI when those properties have primitive values. (4.63.2) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.63.2)
- Function return value tracking was reverted until the most recent issue is understood. (4.63.1) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.63.1)
- Fixes invalid module concatenations that could result from compact mode. (4.62.5) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.62.5)
- Resolves a regression when using Rollup on older Linux distributions and enforces glibc ≤ 2.28 compatibility. (4.62.4) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.62.4)
- Illegal characters in the preserved modules input base are sanitized before computing preserved module chunk names. (4.62.3) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.62.3)
- When using minChunkSize with hoisting disabled, Rollup no longer adds spurious side-effect-free external imports to chunks. (4.62.2) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.62.2)
- Fix an issue where getLogFilter would match additional logs. (4.62.1) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.62.1)
- Preserve multipart file extensions when deconflicting output chunks by inserting conflict numbers before the first extension. (4.62.1) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.62.1)
- Avoids extraneous newlines when adding headers via plugins. (4.61.1) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.61.1)
- Fixes a rare issue where starting Rollup would hang on Windows. (4.61.1) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.61.1)
- Chunk assignment is stabilized across parallel file reads, improving the stability of chunk hashes. (4.60.4) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.60.4)
- Fixes variable rendering when generating different formats from the same build. (4.60.2) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.60.2)
- Fixes a caching issue that could cause side effect imports to be dropped. (4.60.1) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.60.1)
- Fixes a crash when using lazy dynamic imports with moduleSideEffects:false. (4.59.1) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.59.1)
- Ensures exports of a dynamic import are fully included when called from a try...catch. (4.57.1) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.57.1)
- Fixes a heap corruption issue on Windows. (4.57.1) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.57.1)
- Rollup handles methods that access dynamically imported namespace members via this. (4.56.0) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.56.0)
- Fixes the semicolon insertion position in JSX variable declarations. (4.55.3) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.55.3)
- Manual chunks are sorted by module execution order to reduce circular dependency issues. (4.55.2) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.55.2)
- Fixes the artifact reference for OpenBSD, so developers can use the correct release artifact. (4.55.1) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.55.1)
- Namespace properties referenced only from a try-catch are included. (4.54.0) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.54.0)
- Well-known-Symbol-valued properties are no longer tree-shaken except in select cases. (4.54.0) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.54.0)
- Fixes the semicolon insertion position when using JSX. (4.53.5) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.53.5)
- Generates spec-compliant sourcemaps when sources content is excluded by setting sourcesContent to undefined instead of null. (4.53.5) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.53.5)
- Rollup no longer removes Symbol.asyncDispose properties with (await) using declarations. (4.53.4) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.53.4)
- Rollup no longer removes Symbol.dispose properties with (await) using declarations. (4.53.4) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.53.4)
- Fixes assignments being wrongly tree-shaken when they mutate a value. (4.53.3) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.53.3)
- Fixes an error that flagged too many modules as having an unused external import. (4.53.3) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.53.3)
- Rollup no longer throws when using invalid escape sequences in template literals. (4.53.2) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.53.2)
- Sourcemap debugIds are now always valid UUIDs, avoiding invalid-length identifiers. (4.52.5) — [release notes](https://github.com/rollup/rollup/releases/tag/v4.52.5)