Skip to content

chore(deps): bump vitest from 3.2.7 to 5.0.0 - #438

Closed
dependabot[bot] wants to merge 1 commit into
developmentfrom
dependabot/npm_and_yarn/vitest-4.1.11
Closed

dependabot[bot] wants to merge 1 commit into
developmentfrom
dependabot/npm_and_yarn/vitest-4.1.11

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026 •

Copy link
Copy Markdown

Bumps vitest from 3.2.7 to 5.0.0.

Release notes

Sourced from vitest's releases.

v5.0.0

Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

   🚨 Breaking Changes

... (truncated)

Commits
  • f441c6f chore: release v5.0.0 (#11130)
  • d46a747 fix: treat test.describe as a suite during static collection (#11128)
  • 584cf30 fix: add a warning if inline project has duplicate plugins due to unexpected ...
  • f08ce4b fix: apply queued mocks from doMock() in queue order (fixes #10706) (#11127)
  • 897f51f chore: release v5.0.0-rc.4 (#11107)
  • 1339b06 chore(deps): update all non-major dependencies (#11104)
  • 51e9494 feat!: parse files statically in vitest list by default (#11088)
  • 2122ffd fix: propagate --maxWorkers to projects (#11102)
  • dc10f5f fix(browser): report the action error when a task times out (#11101)
  • d4fe198 feat: promote clearCache out of experimental (#11086)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 1, 2026
Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 3.2.7 to 5.0.0.
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.0/packages/vitest)

---
updated-dependencies:
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump vitest from 3.2.7 to 4.1.11 chore(deps): bump vitest from 3.2.7 to 5.0.0 Sep 10, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/vitest-4.1.11 branch from 0d67bed to 6f773f0 Compare September 10, 2026 21:27
@coderabbitai

coderabbitai Bot commented Sep 10, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: d69e70ac-37e7-49ce-afea-ad801064e429

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Comment @coderabbitai help to get the list of available commands.

mohanagy added a commit that referenced this pull request Sep 11, 2026
Vitest 5 applies AST-aware remapping unconditionally, attributing functions
and branches differently from Vitest 3. With identical tests and unchanged
source, the measured figures moved in both directions — upstream-process-manager
functions 100 -> 89.84 and redact branches 94.69 -> 87.17, but
secret-provider-availability branches 81.57 -> 84.21 and secret-resolver
functions 86.66 -> 89.47 — so this is a measurement change, not a coverage
regression. Confirmed by running coverage on development (Vitest 3), where the
same tests meet every threshold.

Vitest 5 removed the experimental opt-out, so the previous measurement cannot
be restored. Recalibrated the seven breached function and branch thresholds to
measured actuals with a small margin, preserving the ratchet going forward.
Line thresholds were unaffected and are unchanged.

Refs #435, #436, #437, #438, #445

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
mohanagy added a commit that referenced this pull request Sep 11, 2026
Supersedes #445, #438, #437, #436, #435, none of which could go green alone.

Vitest 3.2.7 -> 5.0.0 with @vitest/coverage-v8 and vite as an explicit devDependency (Vitest 5 declares vite a non-optional peer). @types/node 22 -> 26, @hono/node-server 2.0.10 -> 2.1.1, esbuild 0.28.1 -> 0.28.2, eslint 10.8.0 -> 10.10.0, typescript-eslint 8.65.0 -> 8.70.0. Both the production-only and full npm audits now report zero.

@types/node 26 added a throwIfNoEntry overload to stat(), so Awaited<ReturnType<typeof stat>> resolves to Stats | BigIntStats | undefined and keyof of that union is never. Replaced the idiom with the concrete Stats type in the three files using it.

Vitest 4 removed test.poolOptions and promoted its contents to top-level options. Vitest 5 applies AST-aware remapping unconditionally, so function and branch figures are not comparable across the migration; thresholds recalibrated to measured actuals with line thresholds unchanged.

zod 4.2.0 -> 4.6.2 deliberately held: the evidence-pinned bundled fixture embeds zod, so bumping it invalidates the sha256 that the named-host evidence ledger pins. Lock-only hold; the declared ^4.2.0 range is unchanged.

Refs #435, #436, #437, #438, #445

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@mohanagy

Copy link
Copy Markdown
Owner

Superseded by #446, which landed this bump together with the changes Dependabot cannot make on its own.

This PR could not pass alone: see #446 for the specific reason (split vitest peer pair, security-override contract pins, or @types/node 26 source breakage) and the verification.

@mohanagy mohanagy closed this Sep 11, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 11, 2026

Copy link
Copy Markdown
Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/vitest-4.1.11 branch September 11, 2026 04:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant