Skip to content

chore(deps): bump the npm-dependencies group across 1 directory with 5 updates - #44

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-714c8c750c
Closed

chore(deps): bump the npm-dependencies group across 1 directory with 5 updates#44
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-714c8c750c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-dependencies group with 5 updates in the / directory:

Package From To
@kuestcom/builder-signing-sdk 2.0.2 2.0.3
@types/node 26.5.0 26.5.1
@vitest/coverage-v8 4.1.10 5.0.0
vite-plus 0.2.7 0.3.1
vitest 4.1.10 5.0.0

Updates @kuestcom/builder-signing-sdk from 2.0.2 to 2.0.3

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​kuestcom/builder-signing-sdk since your current version.


Updates @types/node from 26.5.0 to 26.5.1

Commits

Updates @vitest/coverage-v8 from 4.1.10 to 5.0.0

Release notes

Sourced from @​vitest/coverage-v8's releases.

v5.0.0

Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

   🚨 Breaking Changes

... (truncated)

Commits

Updates vite-plus from 0.2.7 to 0.3.1

Release notes

Sourced from vite-plus's releases.

vite-plus v0.3.1: manage package-manager versions with vp env

vp env now manages Node.js and package-manager versions together. This release also fixes TanStack Start routing and stale Vitest aliases.

Breaking Changes

Package-manager setup

Vite+ replaces Corepack with managed npm, pnpm, yarn, and bun commands. It removes the corepack shim and legacy global package-manager installations (#2391), by @​liangmiQwQ.

Replace Corepack setup commands in shell profiles, CI jobs, and Dockerfiles:

Previous setup Replacement
corepack enable vp env setup
vp install -g pnpm@<version> vp env default pnpm@<version>
vp install -g yarn@<version> vp env default yarn@<version>
vp install -g bun@<version> vp env default bun@<version>
vp install -g corepack Use the managed package-manager commands directly

Use vp env pin <manager>@<version> to set a project version.

vp env command scope and JSON output

Unscoped vp env commands now operate on Node.js and package managers. Package managers support independent defaults, project pins, session overrides, and installation commands (#2398), by @​liangmiQwQ.

Add node to limit an operation to Node.js, for example, vp env off node or vp env unpin node. Bare versions, such as vp env default 22.19.0, still select Node.js.

Update scripts that read JSON output:

Command New output structure
vp env current --json node and package_manager objects
vp env list --json, vp env list-remote --json node and package_managers groups

See the environment guide.

vp pack migration to tsdown@0.23

vp pack now uses tsdown@0.23, which removes deprecated options and changes defaults (#2614), by @​fengmk2.

  1. Run vp migrate to update supported static configurations and package scripts, including projects that already use Vite+.
  2. Check migration warnings in vite.config.*, tsdown.config.*, and package.json.
  3. Update dynamic configurations manually. Arrays built with .map() require manual changes, even when migration reports no warning.
  4. Run vp pack to check the result.
Previous option Replacement
bundle: false unbundle: true
outExtension outExtensions
publicDir / --public-dir copy / --copy

... (truncated)

Commits
  • 13e1e5a release: v0.3.1: manage package-manager versions with vp env (#2623)
  • 0931d9b fix(cli): share Vite runtime through the core alias (#2617)
  • 3bbae42 feat(migrate): upgrade pack config for tsdown 0.23 (#2614)
  • 7123545 chore(deps): update dependency voidzero-dev/setup-vp to v1.19.0 (#2619)
  • b87593c fix(cli): recover from stale Vitest aliases (#2605)
  • 21f6c42 ci: gate npm publishes on dependency propagation (#2601)
  • 809d8b8 feat(deps): upgrade upstream dependencies (#2613)
  • 585353f docs: fix Zed Oxc configuration (#2592)
  • 4f97f30 feat(cli): expose dependency alignment plans (#2600)
  • 03b659c feat(cli): add --quiet to vp check (#2593)
  • Additional commits viewable in compare view

Updates vitest from 4.1.10 to 5.0.0

Release notes

Sourced from vitest's releases.

v5.0.0

Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

   🚨 Breaking Changes

... (truncated)

Commits
  • f441c6f chore: release v5.0.0 (#11130)
  • d46a747 fix: treat test.describe as a suite during static collection (#11128)
  • 584cf30 fix: add a warning if inline project has duplicate plugins due to unexpected ...
  • f08ce4b fix: apply queued mocks from doMock() in queue order (fixes #10706) (#11127)
  • 897f51f chore: release v5.0.0-rc.4 (#11107)
  • 1339b06 chore(deps): update all non-major dependencies (#11104)
  • 51e9494 feat!: parse files statically in vitest list by default (#11088)
  • 2122ffd fix: propagate --maxWorkers to projects (#11102)
  • dc10f5f fix(browser): report the action error when a task times out (#11101)
  • d4fe198 feat: promote clearCache out of experimental (#11086)
  • Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request
Dependency Name Ignore Conditions
@types/node [>= 25.a, < 26]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by cubic

Updates the npm dependency group in pnpm-workspace.yaml and pnpm-lock.yaml, moving vitest and @vitest/coverage-v8 to 5.0.0, vite-plus to 0.3.1, and pulling patch releases for @kuestcom/builder-signing-sdk and @types/node. Vitest 5 improves test performance by sharing the Vite server between inline projects and statically parsing vitest list; vite-plus 0.3.1 replaces Corepack with managed package-manager commands.

Behavior changes

  • Vitest now clears mocks before each test by default; add explicit mock setup in tests that relied on previous mocks.
  • Un-awaited async assertions now fail the test, expect.poll fails on timeout, and toHaveTextContent is strict; use toMatchTextContent for non-strict matching.
  • Vitest now writes attachments to .vitest/attachments/ instead of .vitest-attachements/.

Migration

  • Vitest 5 requires Node.js 22.12+ and Vite 6.4+, so update CI and local runtimes.
  • Replace corepack enable with vp env setup in shell profiles, CI, and Dockerfiles; update scripts that read vp env JSON to expect node and package_manager objects.
  • vp pack now uses tsdown@0.23; run vp migrate and update renamed options like bundle: false to unbundle: true.

Written for commit e393b18. Summary will update on new commits.

@dependabot
chore(deps): bump the npm-dependencies group across 1 directory with …
e393b18 
…5 updates

Bumps the npm-dependencies group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@kuestcom/builder-signing-sdk](https://github.com/kuestcom/builder-signing-sdk) | `2.0.2` | `2.0.3` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.5.0` | `26.5.1` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.10` | `5.0.0` |
| [vite-plus](https://github.com/voidzero-dev/vite-plus/tree/HEAD/packages/cli) | `0.2.7` | `0.3.1` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `5.0.0` |



Updates `@kuestcom/builder-signing-sdk` from 2.0.2 to 2.0.3
- [Commits](https://github.com/kuestcom/builder-signing-sdk/commits)

Updates `@types/node` from 26.5.0 to 26.5.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitest/coverage-v8` from 4.1.10 to 5.0.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.0/packages/coverage-v8)

Updates `vite-plus` from 0.2.7 to 0.3.1
- [Release notes](https://github.com/voidzero-dev/vite-plus/releases)
- [Commits](https://github.com/voidzero-dev/vite-plus/commits/v0.3.1/packages/cli)

Updates `vitest` from 4.1.10 to 5.0.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.0/packages/vitest)

---
updated-dependencies:
- dependency-name: "@kuestcom/builder-signing-sdk"
  dependency-version: 2.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.5.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: vite-plus
  dependency-version: 0.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: vitest
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 19, 2026
@dependabot
dependabot Bot requested a review from a team September 19, 2026 05:13
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 19, 2026
@socket-security

socket-security Bot commented Sep 19, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​kuestcom/​builder-signing-sdk@​2.0.2 ⏵ 2.0.373 +11008488 -2100
Updated@​vitest/​coverage-v8@​4.1.10 ⏵ 5.0.09910079 +199 +1100
Updatedvitest@​4.1.10 ⏵ 5.0.098 +1100 +279 +199 +1100
Updated@​types/​node@​26.5.0 ⏵ 26.5.1100 +110081 +196 +1100
Updatedvite-plus@​0.2.7 ⏵ 0.3.198 +19100100 +1100 +1100

View full report

@dependabot @github

dependabot Bot commented on behalf of github Sep 26, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 26, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-dependencies-714c8c750c branch September 26, 2026 05:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants