chore(deps): bump vitest to 5 with the vite peer it now needs

[mariano-aguero]

What this changes

Takes vitest from 2.1.9 to 5.0.0 and @types/node from 20.19.43 to 26.5.1, and adds vite as an explicit dev dependency.

This supersedes #16 and #17. Dependabot opened those separately and #17 cannot pass on its own, for two reasons it has no way to discover.

In vitest 5, vite became an optional peer dependency, so the package manager does not install it, and the vite@5.4.21 that vitest 2 used to pull in stayed pinned in the lockfile. Vitest 5 needs ^6.4.0 || ^7.0.0 || ^8.0.0, so the startup fails with ERR_PACKAGE_PATH_NOT_EXPORTED: './module-runner' is not defined by "exports" in vite/package.json. Naming vite in devDependencies fixes it and resolves 8.3.0.

Vitest 5 also requires @types/node at ^22.0.0 || >=24.0.0, which is why the two bumps travel together rather than in sequence.

It also closes both open Dependabot alerts, which are against vitest as a development dependency. Neither was reachable from the published package, since the tarball ships dist only, and the critical one needs the Vitest UI server listening, which nothing in this repository starts.

Why

Dependabot cannot add a dependency that is not being bumped, so a peer going optional upstream is a change it can only propose halfway. The alternative to naming vite is pinning it through an override, which hides the reason in a place nobody reads.

How the new behaviour is pinned

• A published figure, transcribed rather than derived
• The golden byte vector or sig-hash from ethrex's frame_tx_wire_tests.rs
• Re-encoding captured chain data and reproducing the transaction hash
• A live receipt (recovered signer, maxCost, or the gasUsed decomposition)
• N/A, this change has no wire-format or gas behaviour

No source file changes. The existing suite is what verifies the runner swap: all 293 tests still run and pass, so the oracles are still being exercised, not skipped.

Load-bearing rules

• No
• Yes, and the argument for it is below

One of them deserved a check rather than an assumption. vitest.config.ts gates the live suite on FRAMES_LIVE by configuration, because vitest applies exclude even to a path named on the command line, and an unconditional exclude would make bun run test:live run zero tests and report success. Under vitest 5 that gate still behaves as documented: without the variable the default run collects 14 files and 293 tests and no live file, and with FRAMES_LIVE=1 the live file is collected and its 4 tests execute against the endpoint.

vitest list does not print the live tests under vitest 5 even when they are collected, which is a reporting difference in that subcommand and not the gate. Reading list alone would have looked exactly like the failure mode the config exists to prevent, so the gate was verified by running the suite.

Checks

• bun run test
• bun run typecheck
• bun run build && bunx @arethetypeswrong/cli --pack .
• bun run test:live (optional, hits the public endpoint, not a gate)

293 tests pass, the type check is clean, and attw --pack . reports no problems across all three entry points. The packaging check was run although exports, files, typesVersions and tsup.config.ts are untouched, because the declaration flavours are built by a toolchain this PR moves.

The live suite fails, and it fails identically on main with vitest 2, so it is not evidence about this change. It is evidence about something else, filed separately: the chain has re-genesised a fourth time. The node now serves genesis 0x2036e3fe3eaaa15382a9befde816137b6b2cda1e3df8ca0c92e89bc17a3fca5a, against the pinned 0x7ca0f7358d127dc4a68983050eb88837a5f384225254d1b009fa87fbcd0f2332, and ethrex_simulateFrameTransaction now answers Invalid params: MalformedData to both the hand-built and the re-encoded transaction. That is the fixture expiry mechanism working as designed.

Release impact

• No release (docs, chore, test, ci, refactor, style, perf, build)
• Patch (fix)
• Minor (feat)
• Major (feat! or a BREAKING CHANGE: footer)

Development dependencies only. Nothing in dist changes.

AI assistance

• This change was written or reviewed with an assistant, and I have read every line of it

Related issues

Supersedes #16 and #17, which can be closed once this merges.

[justalab-agents]

Findings outside the diff

These sit on lines this PR did not change, but this PR is what makes them wrong. They cannot be posted as inline comments.

• [WARNING] package.json — package.json has dependency changes but no pnpm-lock.yaml update was found in this PR. Commit the lockfile together with manifest changes.

Reviewer callouts (1)

Non-blocking observations. Nothing here needs to change before merge.

• .github:1 — "The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see actions/runner-images#14748"