Merge pull request #159 from rollup/sync-ae1d14b7

docs(en): merge rollup/master into rollup-docs-cn/master @ ae1d14b

Author: waynzh

Diff for: CHANGELOG.md

@@ -1,5 +1,36 @@
 # rollup changelog
 
+## 4.26.0
+
+_2024-11-13_
+
+### Features
+
+- Allow to avoid `await bundle.close()` via explicit resource management in TypeScript (#5721)
+
+### Pull Requests
+
+- [#5721](https://github.com/rollup/rollup/pull/5721): feat: support `using` for `RollupBuild` (@shulaoda)
+
+## 4.25.0
+
+_2024-11-09_
+
+### Features
+
+- Add `output.sourcemapDebugIds` option to add matching debug ids to sourcemaps and code for tools like Sentry or Rollbar (#5712)
+
+### Bug Fixes
+
+- Make it easier to manually reproduce base16 hashes by using a more standard base16 conversion algorithm (#5719)
+
+### Pull Requests
+
+- [#5712](https://github.com/rollup/rollup/pull/5712): feat: Add support for injecting Debug IDs (@timfish)
+- [#5717](https://github.com/rollup/rollup/pull/5717): fix(deps): update swc monorepo (major) (@renovate[bot])
+- [#5718](https://github.com/rollup/rollup/pull/5718): chore(deps): lock file maintenance minor/patch updates (@renovate[bot])
+- [#5719](https://github.com/rollup/rollup/pull/5719): Use a less surprising base-16 encoding (@lukastaegert)
+
 ## 4.24.4
 
 _2024-11-04_
@@ -97,6 +128,30 @@ _2024-09-27_
 - [#5682](https://github.com/rollup/rollup/pull/5682): chore(deps): update dependency @rollup/plugin-typescript to v12 (@renovate[bot])
 - [#5684](https://github.com/rollup/rollup/pull/5684): chore(deps): lock file maintenance minor/patch updates (@renovate[bot])
 
+## 2.79.2
+
+_2024-09-26_
+
+### Bug Fixes
+
+- Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)
+
+### Pull Requests
+
+- [#5671](https://github.com/rollup/rollup/pull/5671): Fix DOM Clobbering CVE (@lukastaegert)
+
+## 3.29.5
+
+_2024-09-21_
+
+### Bug Fixes
+
+- Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)
+
+### Pull Requests
+
+- [#5671](https://github.com/rollup/rollup/pull/5671): Fix DOM Clobbering CVE (@lukastaegert)
+
 ## 4.22.4
 
 _2024-09-21_

Diff for: browser/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rollup/browser",
-  "version": "4.24.4",
+  "version": "4.26.0",
   "description": "Next-generation ES module bundler browser build",
   "main": "dist/rollup.browser.js",
   "module": "dist/es/rollup.browser.js",

Diff for: cli/help.md

@@ -71,6 +71,7 @@ Basic options:
 --shimMissingExports        Create shim variables for missing exports
 --silent                    Don't print warnings
 --sourcemapBaseUrl <url>    Emit absolute sourcemap URLs with given base
+--sourcemapDebugIds         Emit unique debug ids in source and sourcemaps
 --sourcemapExcludeSources   Do not include source code in source maps
 --sourcemapFile <file>      Specify bundle position for source maps
 --sourcemapFileNames <pattern> Name pattern for emitted sourcemaps

Diff for: cli/run/build.ts

@@ -30,7 +30,7 @@ export default async function build(
 		stderr(cyan(`\n${bold(inputFiles!)} → ${bold(files.join(', '))}...`));
 	}
 
-	const bundle = await rollup(inputOptions as any);
+	await using bundle = await rollup(inputOptions as any);
 	if (useStdout) {
 		const output = outputOptions[0];
 		if (output.sourcemap && output.sourcemap !== 'inline') {
@@ -48,7 +48,6 @@ export default async function build(
 	}
 
 	await Promise.all(outputOptions.map(bundle.write));
-	await bundle.close();
 	if (!silent) {
 		warnings.flush();
 		stderr(green(`created ${bold(files.join(', '))} in ${bold(ms(Date.now() - start))}`));

Diff for: docs/command-line-interface/index.md

@@ -109,6 +109,7 @@ export default {
 		preserveModulesRoot,
 		sourcemap,
 		sourcemapBaseUrl,
+		sourcemapDebugIds,
 		sourcemapExcludeSources,
 		sourcemapFile,
 		sourcemapFileNames,
@@ -439,6 +440,7 @@ export default {
 --shimMissingExports        为丢失的导出创建卡扣变量
 --silent                    不打印警告
 --sourcemapBaseUrl <url>    使用给定的基本 URL 发出绝对源映射 URL
+--sourcemapDebugIds         在源代码和源映射中生成唯一的 debug ID
 --sourcemapExcludeSources   在源映射中不包括源代码
 --sourcemapFile <file>      指定源映射的包位置
 --sourcemapFileNames <pattern> 编译后 sourcemap 的命名模式

Diff for: docs/configuration-options/index.md

@@ -1744,6 +1744,16 @@ export default {
 
 默认情况下，Rollup 生成的 sourcemap 使用相对 URL 路径来引用它们描述的文件。该选项可提供一个绝对基础 URL 路径，例如 `https://example.com`，sourcemap 将使用绝对 URL 路径来代替。
 
+### output.sourcemapDebugIds
+
+|        |                                                |
+| -----: | :--------------------------------------------- |
+| 类型： | `boolean`                                      |
+|  CLI： | `--sourcemapDebugIds`/`--no-sourcemapDebugIds` |
+| 默认： | `false`                                        |
+
+如果设为 `true`，将在源代码和 sourcemap 中生成唯一的 ID，这有助于在不同的构建中识别 sourcemap。有关详细信息，请参阅 [TC39 sourcemap debug ID 提案](https://github.com/tc39/source-map/blob/main/proposals/debug-id.md)。
+
 ### output.sourcemapExcludeSources {#output-sourcemapexcludesources}
 
 |        |                                                            |

Diff for: docs/javascript-api/index.md

@@ -53,7 +53,12 @@ async function build() {
 	let bundle;
 	let buildFailed = false;
 	try {
-		// 启动一次打包
+		// 新建一个 bundle。如果你使用的是 TypeScript 或支持该特性的运行时，
+		// 你可以这样写：
+		//
+		// await using bundle = await rollup(inputOptions);
+		//
+		// 这样做就不需要在下面显式地关闭释放 bundle。
 		bundle = await rollup(inputOptions);
 
 		// 一个文件名数组，表示此产物所依赖的文件
@@ -208,6 +213,7 @@ const outputOptions = {
 	preserveModulesRoot,
 	sourcemap,
 	sourcemapBaseUrl,
+	sourcemapDebugIds,
 	sourcemapExcludeSources,
 	sourcemapFile,
 	sourcemapFileNames,

Diff for: package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "rollup",
-  "version": "4.24.4",
+  "version": "4.26.0",
   "description": "Next-generation ES module bundler",
   "main": "dist/rollup.js",
   "module": "dist/es/rollup.js",

Diff for: package.json

@@ -6,7 +6,7 @@ const CHARACTERS_BASE64: &[u8; 64] =
 
 const CHARACTERS_BASE36: &[u8; 36] = b"abcdefghijklmnopqrstuvwxyz0123456789";
 
-const CHARACTERS_BASE16: &[u8; 16] = b"abcdef0123456789";
+const CHARACTERS_BASE16: &[u8; 16] = b"0123456789abcdef";
 
 pub fn xxhash_base64_url(input: &[u8]) -> String {
   to_string(&xxh3_128(input).to_le_bytes(), 64, CHARACTERS_BASE64).unwrap()

Diff for: rust/xxhash/src/lib.rs

@@ -38,6 +38,9 @@ import type {
 	RollupWatcher
 } from './types';
 
+// @ts-expect-error TS2540: the polyfill of `asyncDispose`.
+Symbol.asyncDispose ??= Symbol('Symbol.asyncDispose');
+
 export default function rollup(rawInputOptions: RollupOptions): Promise<RollupBuild> {
 	return rollupInternal(rawInputOptions, null);
 }
@@ -95,6 +98,9 @@ export async function rollupInternal(
 			await graph.pluginDriver.hookParallel('closeBundle', []);
 		},
 		closed: false,
+		async [Symbol.asyncDispose]() {
+			await this.close();
+		},
 		async generate(rawOutputOptions: OutputOptions) {
 			if (result.closed) return error(logAlreadyClosed());
 

Diff for: src/rollup/rollup.ts

@@ -782,6 +782,7 @@ export interface OutputOptions {
 	sourcemapFileNames?: string | ((chunkInfo: PreRenderedChunk) => string);
 	sourcemapIgnoreList?: boolean | SourcemapIgnoreListOption;
 	sourcemapPathTransform?: SourcemapPathTransformOption;
+	sourcemapDebugIds?: boolean;
 	strict?: boolean;
 	systemNullSetters?: boolean;
 	validate?: boolean;
@@ -836,6 +837,7 @@ export interface NormalizedOutputOptions {
 	sourcemapFileNames: string | ((chunkInfo: PreRenderedChunk) => string) | undefined;
 	sourcemapIgnoreList: SourcemapIgnoreListOption;
 	sourcemapPathTransform: SourcemapPathTransformOption | undefined;
+	sourcemapDebugIds: boolean;
 	strict: boolean;
 	systemNullSetters: boolean;
 	validate: boolean;
@@ -916,6 +918,7 @@ export interface RollupBuild {
 	cache: RollupCache | undefined;
 	close: () => Promise<void>;
 	closed: boolean;
+	[Symbol.asyncDispose](): Promise<void>;
 	generate: (outputOptions: OutputOptions) => Promise<RollupOutput>;
 	getTimings?: () => SerializedTimings;
 	watchFiles: string[];

Diff for: src/rollup/types.d.ts

@@ -279,6 +279,7 @@ async function mergeOutputOptions(
 		sanitizeFileName: getOption('sanitizeFileName'),
 		sourcemap: getOption('sourcemap'),
 		sourcemapBaseUrl: getOption('sourcemapBaseUrl'),
+		sourcemapDebugIds: getOption('sourcemapDebugIds'),
 		sourcemapExcludeSources: getOption('sourcemapExcludeSources'),
 		sourcemapFile: getOption('sourcemapFile'),
 		sourcemapFileNames: getOption('sourcemapFileNames'),

Diff for: src/utils/options/mergeOptions.ts

@@ -94,6 +94,7 @@ export async function normalizeOutputOptions(
 					: defaultSanitizeFileName,
 		sourcemap: config.sourcemap || false,
 		sourcemapBaseUrl: getSourcemapBaseUrl(config),
+		sourcemapDebugIds: config.sourcemapDebugIds || false,
 		sourcemapExcludeSources: config.sourcemapExcludeSources || false,
 		sourcemapFile: config.sourcemapFile,
 		sourcemapFileNames: getSourcemapFileNames(config, unsetOptions),

Diff for: src/utils/options/normalizeOutputOptions.ts

@@ -347,6 +347,9 @@ function addChunksToBundle(
 		const finalFileName = replacePlaceholders(fileName, hashesByPlaceholder);
 		let finalSourcemapFileName = null;
 		if (map) {
+			if (options.sourcemapDebugIds) {
+				updatedCode += calculateDebugIdAndGetComment(updatedCode, map);
+			}
 			finalSourcemapFileName = sourcemapFileName
 				? replacePlaceholders(sourcemapFileName, hashesByPlaceholder)
 				: `${finalFileName}.map`;
@@ -365,6 +368,9 @@ function addChunksToBundle(
 			hashesByPlaceholder.size > 0 ? replacePlaceholders(code, hashesByPlaceholder) : code;
 		let finalSourcemapFileName = null;
 		if (map) {
+			if (options.sourcemapDebugIds) {
+				updatedCode += calculateDebugIdAndGetComment(updatedCode, map);
+			}
 			finalSourcemapFileName = sourcemapFileName
 				? replacePlaceholders(sourcemapFileName, hashesByPlaceholder)
 				: `${fileName}.map`;
@@ -402,3 +408,18 @@ function emitSourceMapAndGetComment(
 	}
 	return sourcemap === 'hidden' ? '' : `//# ${SOURCEMAPPING_URL}=${url}\n`;
 }
+
+function calculateDebugIdAndGetComment(code: string, map: SourceMap & { debugId?: string }) {
+	const hash = hasherByType.hex(code);
+	const debugId = [
+		hash.slice(0, 8),
+		hash.slice(8, 12),
+		'4' + hash.slice(12, 15),
+		((parseInt(hash.slice(15, 16), 16) & 3) | 8).toString(16) + hash.slice(17, 20),
+		hash.slice(20, 32)
+	].join('-');
+
+	map.debugId = debugId;
+
+	return '//# debugId=' + debugId + '\n';
+}

Diff for: src/utils/renderChunks.ts

@@ -0,0 +1,5 @@
+define(['./dep-9748f597e7f841'], (function (dep) { 'use strict';
+
+	console.log('main1');
+
+}));

Diff for: test/chunking-form/samples/hashing/base-16/_expected/amd/dep-829e49d80e8138.js renamed to test/chunking-form/samples/hashing/base-16/_expected/amd/dep-9748f597e7f841.js

@@ -0,0 +1,5 @@
+define(['./dep-9748f597e7f841'], (function (dep) { 'use strict';
+
+	console.log('main2');
+
+}));

Diff for: test/chunking-form/samples/hashing/base-16/_expected/amd/main1-32c81258.js

@@ -1,5 +1,5 @@
 'use strict';
 
-require('./dep-56610f0f1f4a63.js');
+require('./dep-8e72f6a548dc1a.js');
 
 console.log('main1');

Diff for: test/chunking-form/samples/hashing/base-16/_expected/amd/main1-c7c1549b.js

@@ -1,5 +1,5 @@
 'use strict';
 
-require('./dep-56610f0f1f4a63.js');
+require('./dep-8e72f6a548dc1a.js');
 
 console.log('main2');

Diff for: test/chunking-form/samples/hashing/base-16/_expected/amd/main2-b28d1351.js

@@ -0,0 +1,3 @@
+import './dep-ea4271148a0859.js';
+
+console.log('main1');

Diff for: test/chunking-form/samples/hashing/base-16/_expected/amd/main2-fe4f34dc.js

@@ -0,0 +1,3 @@
+import './dep-ea4271148a0859.js';
+
+console.log('main2');

Diff for: test/chunking-form/samples/hashing/base-16/_expected/amd/test-52f952ec201fb87af2.txt renamed to test/chunking-form/samples/hashing/base-16/_expected/amd/test-b85fb84286751ed058.txt

@@ -1,4 +1,4 @@
-System.register(['./dep-bacfaa81397007.js'], (function () {
+System.register(['./dep-fc1ce55215e47e.js'], (function () {
 	'use strict';
 	return {
 		setters: [null],

Diff for: test/chunking-form/samples/hashing/base-16/_expected/cjs/dep-56610f0f1f4a63.js renamed to test/chunking-form/samples/hashing/base-16/_expected/cjs/dep-8e72f6a548dc1a.js

@@ -1,4 +1,4 @@
-System.register(['./dep-bacfaa81397007.js'], (function () {
+System.register(['./dep-fc1ce55215e47e.js'], (function () {
 	'use strict';
 	return {
 		setters: [null],

Diff for: test/chunking-form/samples/hashing/base-16/_expected/cjs/main1-f180bb4c.js renamed to test/chunking-form/samples/hashing/base-16/_expected/cjs/main1-2af756cb.js

@@ -57,6 +57,7 @@ module.exports = defineTest({
 						preserveModules: false,
 						reexportProtoFromExternal: true,
 						sourcemap: false,
+						sourcemapDebugIds: false,
 						sourcemapExcludeSources: false,
 						strict: true,
 						systemNullSetters: true,

Diff for: test/chunking-form/samples/hashing/base-16/_expected/cjs/main2-d4907d4b.js renamed to test/chunking-form/samples/hashing/base-16/_expected/cjs/main2-e8d99f43.js

@@ -318,4 +318,18 @@ console.log(x);
 		await bundle.generate({ format: 'iife', inlineDynamicImports: true });
 		await bundle.generate({ format: 'es', exports: 'auto' });
 	});
+
+	it('should support `Symbol.asyncDispose` of the rollup bundle and set closed state to true', async () => {
+		const bundle = await rollup.rollup({
+			input: 'main.js',
+			plugins: [
+				loader({
+					'main.js': "console.log('hello')"
+				})
+			]
+		});
+
+		await bundle[Symbol.asyncDispose]();
+		assert.strictEqual(bundle.closed, true);
+	});
 });