Skip to content

build(deps-dev): bump vitest from 4.1.11 to 5.0.4 - #147

Merged
vincentkoc merged 2 commits into
mainfrom
dependabot/npm_and_yarn/vitest-5.0.4
Oct 15, 2026
Merged

build(deps-dev): bump vitest from 4.1.11 to 5.0.4#147
vincentkoc merged 2 commits into
mainfrom
dependabot/npm_and_yarn/vitest-5.0.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor

Bumps vitest from 4.1.11 to 5.0.4.

Release notes

Sourced from vitest's releases.

v5.0.4

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits
  • 6a11cf6 chore: release v5.0.4 (#11554)
  • 58c86ed chore(deps): update all non-major dependencies (#11550)
  • 0fa80f5 fix(coverage): filenames containing brackets incorrectly showing as uncovered...
  • bf04b9c fix(browser): run browser instances as workers (#11525)
  • 3e3624c refactor: resolve maxWorkers once in config (#11524)
  • 26642f7 fix: respect root in projects (#11521)
  • c06012a feat(experimental): add an option to cache dependencies instead of statically...
  • 4ef000a fix(coverage): allowExternal fails to include uncovered files (#11513)
  • 1da6640 feat: support test.ui.theme option (#11499)
  • b618afd fix(vm): bind this to module.exports (#11504)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps-dev): bump vitest from 4.1.11 to 5.0.4
f674cde 
Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 4.1.11 to 5.0.4.
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.4/packages/vitest)

---
updated-dependencies:
- dependency-name: vitest
  dependency-version: 5.0.4
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 14, 2026
@clawsweeper

clawsweeper Bot commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

@socket-security

socket-security Bot commented Oct 14, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedvitest@​4.1.11 ⏵ 5.0.49810079 +198 -1100

View full report

@clawsweeper clawsweeper Bot added P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Oct 14, 2026
@clawsweeper

clawsweeper Bot commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex review: needs maintainer review before merge.

What this changes

This PR upgrades four workspace packages to Vitest 5.0.4 and disables filesystem module caching for Worker tests.

Example: Run the API suite with Vitest 5.0.4 and Cloudflare's test plugin 1.4.0.

  • Before: The earlier PR head failed the CI test step with filesystem module caching enabled by default.
  • After: The API configuration sets fsModuleCache to false, and the current-head CI test step passes.

Review scores

Measure Result What it means
Overall readiness 🦐 gold shrimp (3/6) A focused, source-verified maintenance patch with passing CI; validation consists of automated suites rather than a separate runtime demonstration.
Proof confidence 🦐 gold shrimp (3/6) This Dependabot development-tooling PR is outside the ordinary contributor runtime-proof gate; source and current-head CI support the Worker transport repair, with no production data-model change.
Patch quality 🐚 platinum hermit (4/6) No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: The workspace needs a compatible test-runner upgrade that keeps Worker and D1 tests executable.
Reason: The narrow change meets the previously recorded conditions for revisiting Vitest 5, and the current maintainer explanation supports the cache adjustment.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: main still uses Vitest 4, and the current head addresses the earlier Worker test failure without changing assertions or setup; no actionable defects remain.

Priority: P3
Reviewed head: 889b212f3f36d6a6dfa39a8f1c9c7a290a5256f1

Before merge

None.

Findings

None.

Agent review details

How this fits together

Vitest executes SDK, CLI, and API tests; the API configuration connects it through Cloudflare's plugin to local workerd and D1, producing results for the CI test gate.

flowchart LR
  A[SDK and CLI tests] --> B[Vitest 5]
  C[API tests] --> B
  B --> D[Cloudflare test plugin]
  D --> E[Local workerd and D1]
  B --> F[CI results]
  E --> F
Loading

Technical review

Best possible solution:

Retain the focused Vitest upgrade and API cache setting with the existing Worker test setup.

Do we have a high-confidence way to reproduce the issue?

This dependency update reports no current-main product bug; GitHub confirms the earlier PR head failed Run Test and the reviewed head passes it.

Is this the best way to solve the issue?

Disabling the existing cache option only for workerd addresses the host-filesystem boundary directly while preserving the supported plugin pairing and existing tests.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 5ebf8ebc3905.

Provenance checked

  • Workspace Vitest versions and Cloudflare test integration keeps the original intent (59f724c: chore(deps): refresh workspace and GitHub Actions dependencies #85 refreshed tooling while preserving runtime support, SDK exports, and D1 behavior; later maintainer comments deferred Vitest 5 until supported by Cloudflare.)
  • API module transport changes intended behavior with a stated reason (vitest-dev/vitest@6a11cf6: Vitest 5.0.4 enables filesystem module caching by default; the maintainer explains why workerd requires inline transforms, and upstream source verifies that disabling the cache preserves that path.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

Likely related people:

  • Peter Steinberger: Raw commit 59f724c adds apps/api/vitest.config.ts:2 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 59f724c8d5aa; files: apps/api/vitest.config.ts)
  • Vincent Koc: Raw commit e3c90f9 adds apps/api/vitest.config.ts:25 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: e3c90f9c5be0; files: apps/api/vitest.config.ts)
  • Jesse Merhi: Raw commit 868e11e adds apps/api/vitest.config.ts:21 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 868e11e75d07; files: apps/api/vitest.config.ts)

Labels

Label changes:

  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.
  • remove status: ⏳ waiting on author: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

  • P3: This is bounded development-tooling maintenance with passing current-head checks and no identified production regression.
  • rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (1 earlier review cycle)
  • reviewed 2026-10-14T21:40:28.545Z sha f674cde :: needs changes before merge. :: none

Reviewed October 15, 2026, 10:57 AM ET / 14:57 UTC (Revision 2).

@vincentkoc

vincentkoc commented Oct 15, 2026

Copy link
Copy Markdown
Member

@clawsweeper re-review

Please review current head 889b212f3f36d6a6dfa39a8f1c9c7a290a5256f1. The API Vitest configuration disables fsModuleCache because workerd cannot consume host filesystem module-cache paths. Vitest 5.0.4 sends inline transformed code through the existing worker transport with this setting. Setup, isolation, assertions, and timeouts are unchanged. All 11 current-head checks pass; required code-owner approval remains a separate gate.

No release operation is authorized.

@clawsweeper

clawsweeper Bot commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown

🦞👀
Exact review queued.

Re-review progress:

@clawsweeper clawsweeper Bot added status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Oct 15, 2026
vincentkoc
vincentkoc approved these changes Oct 15, 2026
View reviewed changes

@vincentkoc vincentkoc left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed head 889b212f3f36d6a6dfa39a8f1c9c7a290a5256f1. The API-only fsModuleCache setting preserves the existing Cloudflare inline module transport and leaves setup, isolation, assertions, and timeouts intact. Full independent source review has no actionable findings; exact-head hosted CI passes, including all 15 API test files in https://github.com/openclaw/krillswitch/actions/runs/38747845526/job/116466085912. Current-head ClawSweeper review is clear. No production behavior or data-model change is introduced.

@vincentkoc
vincentkoc merged commit 909c93e into main Oct 15, 2026
13 checks passed
@vincentkoc
vincentkoc deleted the dependabot/npm_and_yarn/vitest-5.0.4 branch October 15, 2026 15:05
@vincentkoc vincentkoc mentioned this pull request Oct 15, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vincentkoc vincentkoc vincentkoc approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@vincentkoc