feat(deps): upgrade upstream dependencies (#1352)

Automated daily upgrade of upstream dependencies:
- rolldown (latest tag)
- vite (latest tag)
- vitest (latest npm version)
- tsdown (latest npm version)

Build status: success

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Upgrades core build/test toolchain dependencies (Vite/Rolldown/Vitest
and OXC bindings), which can change bundling, codegen, or test execution
behavior across the repo. Risk is mainly regressions or subtle behavior
changes from upstream releases rather than logic changes in this
codebase.
> 
> **Overview**
> **Bumps bundled toolchain versions** used by the workspace: `vite`
`8.0.7` → `8.0.8` and `rolldown` `1.0.0-rc.13` → `1.0.0-rc.15`, and
updates the tracked upstream commit hashes in
`packages/tools/.upstream-versions.json`.
> 
> **Updates Vitest to `4.1.4`** across `packages/test` (dev + peer deps)
and updates workspace overrides (`vitest-dev`).
> 
> **Refreshes workspace catalog + lockfile** for related transitive
upgrades (notably `@oxc-project/*` `0.123.0` → `0.124.0`, `oxc-*`
`0.123.0` → `0.124.0`, and `@emnapi/*` / `@napi-rs/*` patch bumps), with
corresponding `pnpm-lock.yaml` rewrites.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
039abea. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: Brooooooklyn

packages/core/package.json

@@ -217,8 +217,8 @@
     "node": "^20.19.0 || >=22.12.0"
   },
   "bundledVersions": {
-    "vite": "8.0.7",
-    "rolldown": "1.0.0-rc.13",
+    "vite": "8.0.8",
+    "rolldown": "1.0.0-rc.15",
     "tsdown": "0.21.7"
   }
 }

packages/test/package.json

@@ -293,17 +293,17 @@
     "@blazediff/core": "1.9.1",
     "@oxc-node/cli": "catalog:",
     "@oxc-node/core": "catalog:",
-    "@vitest/browser": "4.1.3",
-    "@vitest/browser-playwright": "4.1.3",
-    "@vitest/browser-preview": "4.1.3",
-    "@vitest/browser-webdriverio": "4.1.3",
-    "@vitest/expect": "4.1.3",
-    "@vitest/mocker": "4.1.3",
-    "@vitest/pretty-format": "4.1.3",
-    "@vitest/runner": "4.1.3",
-    "@vitest/snapshot": "4.1.3",
-    "@vitest/spy": "4.1.3",
-    "@vitest/utils": "4.1.3",
+    "@vitest/browser": "4.1.4",
+    "@vitest/browser-playwright": "4.1.4",
+    "@vitest/browser-preview": "4.1.4",
+    "@vitest/browser-webdriverio": "4.1.4",
+    "@vitest/expect": "4.1.4",
+    "@vitest/mocker": "4.1.4",
+    "@vitest/pretty-format": "4.1.4",
+    "@vitest/runner": "4.1.4",
+    "@vitest/snapshot": "4.1.4",
+    "@vitest/spy": "4.1.4",
+    "@vitest/utils": "4.1.4",
     "chai": "^6.2.1",
     "convert-source-map": "^2.0.0",
     "estree-walker": "^3.0.3",
@@ -316,16 +316,16 @@
     "rolldown": "workspace:*",
     "rolldown-plugin-dts": "catalog:",
     "tinyrainbow": "^3.1.0",
-    "vitest-dev": "^4.1.3",
+    "vitest-dev": "^4.1.4",
     "why-is-node-running": "^2.3.0"
   },
   "peerDependencies": {
     "@edge-runtime/vm": "*",
     "@opentelemetry/api": "^1.9.0",
     "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
-    "@vitest/coverage-istanbul": "4.1.3",
-    "@vitest/coverage-v8": "4.1.3",
-    "@vitest/ui": "4.1.3",
+    "@vitest/coverage-istanbul": "4.1.4",
+    "@vitest/coverage-v8": "4.1.4",
+    "@vitest/ui": "4.1.4",
     "happy-dom": "*",
     "jsdom": "*",
     "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
@@ -363,6 +363,6 @@
     "node": "^20.0.0 || ^22.0.0 || >=24.0.0"
   },
   "bundledVersions": {
-    "vitest": "4.1.3"
+    "vitest": "4.1.4"
   }
 }

packages/tools/.upstream-versions.json

@@ -2,11 +2,11 @@
   "rolldown": {
     "repo": "https://github.com/rolldown/rolldown.git",
     "branch": "main",
-    "hash": "1d1cd7ac1b88026997048f912a8df55085dd4dbe"
+    "hash": "27cb729813ae7facfe106a859458c199cc19955e"
   },
   "vite": {
     "repo": "https://github.com/vitejs/vite.git",
     "branch": "main",
-    "hash": "fdb2e6f63894d8c458c1778f3df77afe537f2bb2"
+    "hash": "6e585dcb05a3b159fba7ae57f7faf0b1eca7a390"
   }
 }