chore(deps): update dependency tsdown to ^0.23.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
tsdown (source)	^0.22.14 → ^0.23.0

---

Release Notes

rolldown/tsdown (tsdown)

v0.23.0

Compare Source

   🧭 Migration Guide

Most users can upgrade directly. Before upgrading, run one final build with tsdown@0.22.14 and resolve all deprecation warnings.

• config:
  • bundle: false → unbundle: true; bundle: true can be removed
  • outExtension → outExtensions
  • publicDir / --public-dir → copy / --copy
  • removeNodeProtocol: true → nodeProtocol: 'strip'
  • injectStyle → css.inject
• deps:
  • inlineOnly / deps.onlyAllowBundle → deps.onlyBundle
  • skipNodeModulesBundle: true → deps.neverBundle: true
  • resolveDepSubpath now defaults to false; set it to true to preserve the previous behavior
• dts:
  • Select a generator with dts.generator, for example { generator: 'oxc' }
  • dts.cjsReexport was removed; dual-format builds now generate CJS declarations in a separate pass
• attw:
  • The default profile changed from strict to esm-only; set profile: 'strict' to preserve the previous checks
• programmatic API:
  • build() now returns { bundles, watch }; replace const bundles = await build() with const { bundles } = await build()
• requirements:
  • Node.js 25 is no longer supported; use ^22.18.0, ^24.11.0, or >=26.0.0
  • The packages no longer publish legacy types and typesVersions fallbacks; use TypeScript’s bundler, node16, or nodenext module resolution

   🚨 Breaking Changes

• Drop support for Node.js 25  -  by @​sxzz (26950)
• Remove deprecated tsup compatibility options  -  by @​sxzz (50766)
• Drop types and typesVersionsfields  -  by @​sxzz (be3ea)
• attw:
  • Change default profile to esm-only  -  by @​sxzz (9b3cf)
• deps:
  • Remove deprecated deps.onlyAllowBundle  -  by @​sxzz (30c55)
  • Disable resolveDepSubpath by default  -  by @​sxzz (d300f)
  • Remove deprecated skipNodeModulesBundle  -  by @​sxzz (f2a3d)
• dts:
  • Remove dts.cjsReexport option  -  by @​sxzz (9c70f)
  • Make dts.generator the only way to select generator  -  by @​sxzz (eb75f)

   🚀 Features

• Expose programmatic watch controls  -  by @​sxzz in #​1062 (96a40)
• css: Support function form for css.modules.localsConvention  -  by @​sxzz and @​lazerg (b566f)
• report: Add summary option to skip per-file size logs  -  by @​lazerg in #​1036 (020e9)

   🐞 Bug Fixes

• Allow unplugin-unused v0.5+  -  by @​sxzz (53c78)
• Ignore optional dependencies in type definitions  -  by @​sxzz (94622)
• cli:
  • Camel-case nested flag keys  -  by @​sxzz (bf53f)
• css:
  • Watch files imported via @import  -  by @​lazerg in #​1038 (ebee5)
• deps:
  • Apply resolveDepSubpath when neverBundle is true  -  by @​lazerg in #​1053 (4943c)
• exports:
  • Scope inlined dependencies to configs with exports  -  by @​lazerg in #​1040 (d5b80)
• migrate:
  • Pin migrated projects to tsdown 0.22.14  -  by @​sxzz (113fb)
  • Support non-interactive environments  -  by @​sxzz (51e41)

   🏎 Performance

• Remove asyncDispose polyfill  -  by @​sxzz (82675)
• Replace ansis with util.styleText  -  by @​sxzz (be6bf)

    View changes on GitHub

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Error: ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION

  × installing dependencies
  ╰─▶ 20 lockfile entries failed verification:
        @oxfmt/binding-android-arm-eabi@0.67.0 was published at 2026-09-
      07T14:53:46.000Z, within the minimumReleaseAge cutoff (2026-09-
      07T04:07:15.739Z)
        @oxfmt/binding-android-arm64@0.67.0 was published at 2026-09-
      07T14:53:19.000Z, within the minimumReleaseAge cutoff (2026-09-
      07T04:07:15.739Z)
        @oxfmt/binding-darwin-arm64@0.67.0 was published at 2026-09-
      07T14:53:14.000Z, within the minimumReleaseAge cutoff (2026-09-
      07T04:07:15.739Z)
        @oxfmt/binding-darwin-x64@0.67.0 was published at 2026-09-
      07T14:54:33.000Z, within the minimumReleaseAge cutoff (2026-09-
      07T04:07:15.739Z)
        @oxfmt/binding-freebsd-x64@0.67.0 was published at 2026-09-
      07T14:54:44.000Z, within the minimumReleaseAge cutoff (2026-09-
      07T04:07:15.739Z)
        @oxfmt/binding-linux-arm-gnueabihf@0.67.0 was published at 2026-09-
      07T14:53:52.000Z, within the minimumReleaseAge cutoff (2026-09-
      07T04:07:15.739Z)
        @oxfmt/binding-linux-arm-musleabihf@0.67.0 was published at 2026-09-
      07T14:53:58.000Z, within the minimumReleaseAge cutoff (2026-09-
      07T04:07:15.739Z)
        @oxfmt/binding-linux-arm64-gnu@0.67.0 was published at 2026-09-
      07T14:53:30.000Z, within the minimumReleaseAge cutoff (2026-09-
      07T04:07:15.739Z)
        @oxfmt/binding-linux-arm64-musl@0.67.0 was published at 2026-09-
      07T14:53:35.000Z, within the minimumReleaseAge cutoff (2026-09-
      07T04:07:15.739Z)
        @oxfmt/binding-linux-ppc64-gnu@0.67.0 was published at 2026-09-
      07T14:54:09.000Z, within the minimumReleaseAge cutoff (2026-09-
      07T04:07:15.739Z)
        @oxfmt/binding-linux-riscv64-gnu@0.67.0 was published at 2026-09-
      07T14:54:15.000Z, within the minimumReleaseAge cutoff (2026-09-
      07T04:07:15.739Z)
        @oxfmt/binding-linux-riscv64-musl@0.67.0 was published at 2026-09-
      07T14:54:21.000Z, within the minimumReleaseAge cutoff (2026-09-
      07T04:07:15.739Z)
        @oxfmt/binding-linux-s390x-gnu@0.67.0 was published at 2026-09-
      07T14:54:27.000Z, within the minimumReleaseAge cutoff (2026-09-
      07T04:07:15.739Z)
        @oxfmt/binding-linux-x64-gnu@0.67.0 was published at 2026-09-
      07T14:54:50.000Z, within the minimumReleaseAge cutoff (2026-09-
      07T04:07:15.739Z)
        @oxfmt/binding-linux-x64-musl@0.67.0 was published at 2026-09-
      07T14:54:56.000Z, within the minimumReleaseAge cutoff (2026-09-
      07T04:07:15.739Z)
        @oxfmt/binding-openharmony-arm64@0.67.0 was published at 2026-09-
      07T14:53:40.000Z, within the minimumReleaseAge cutoff (2026-09-
      07T04:07:15.739Z)
        @oxfmt/binding-win32-arm64-msvc@0.67.0 was published at 2026-09-
      07T14:53:24.000Z, within the minimumReleaseAge cutoff (2026-09-
      07T04:07:15.739Z)
        @oxfmt/binding-win32-ia32-msvc@0.67.0 was published at 2026-09-
      07T14:54:03.000Z, within the minimumReleaseAge cutoff (2026-09-
      07T04:07:15.739Z)
        @oxfmt/binding-win32-x64-msvc@0.67.0 was published at 2026-09-
      07T14:54:39.000Z, within the minimumReleaseAge cutoff (2026-09-
      07T04:07:15.739Z)
        oxfmt@0.67.0 was published at 2026-09-07T14:55:00.000Z, within the
      minimumReleaseAge cutoff (2026-09-07T04:07:15.739Z)
  help: The lockfile contains entries that the active policies reject. This
        can mean the lockfile is stale, or that someone committed a lockfile
        that bypassed the policy locally — inspect recent changes to pnpm-
        lock.yaml before trusting it. If the changes look expected, run "pnpm
        clean --lockfile" and then "pnpm install" to rebuild from a fresh
        resolution. Alternatively, relax the policy that flagged them.