chore(deps-dev): bump vitest from 1.6.1 to 4.1.0#27
Conversation
Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 1.6.1 to 4.1.0. - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest) --- updated-dependencies: - dependency-name: vitest dependency-version: 4.1.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![meroreviewer[bot]](https://avatars.githubusercontent.com/in/2793509?s=60&v=4){kind=small}
There was a problem hiding this comment.
🤖 AI Code Reviewer
Reviewed by 2 agents | Quality score: 42% | Review time: 115.1s
🟡 2 warnings. See inline comments.
🤖 Generated by AI Code Reviewer | Review ID: review-f960538d
| "typescript": "^5.3.0", | ||
| "vite": "^5.4.21", | ||
| "vitest": "^1.0.0" | ||
| "vitest": "^4.1.0" |
There was a problem hiding this comment.
🟡 Vitest 4.x peer-requires Vite ^6/7/8 but project pins Vite 5
vitest@4.1.0 declares a peer dependency of vite: ^6.0.0 || ^7.0.0 || ^8.0.0-0, but the project's devDependency is vite: ^5.4.21. The lockfile resolves this by passing vite@5.4.21 as an optional peer, which vitest accepts at runtime, but this is an unsupported combination. Vitest 4's internal Vite integration (module runner, HMR, transform pipeline) is designed and tested against Vite 6+. Subtle breakages—especially around module resolution, HMR, or the new @vitest/mocker vite plugin—may appear only at runtime or in CI, not at install time.
Suggested fix:
Either upgrade vite to ^6.0.0 alongside vitest@4.1.0, or pin vitest back to the latest 2.x release (which officially supports Vite 5) until a Vite 6 upgrade is planned.
| "typescript": "^5.3.0", | ||
| "vite": "^5.4.21", | ||
| "vitest": "^1.0.0" | ||
| "vitest": "^4.1.0" |
There was a problem hiding this comment.
🟡 Vitest peer dependency mismatch: vite@5 used with vitest@4 requiring vite@6+
vitest@4.1.0 declares a peer dependency of vite: ^6.0.0 || ^7.0.0 || ^8.0.0-0 (optional), but the project pins vite: ^5.4.21. The lockfile resolves this by passing vite@5.4.21 as the optional peer, which vitest@4 accepts at install time but may produce unexpected behaviour at runtime (e.g. module resolution, plugin APIs, or HMR internals that vitest@4 expects from vite@6). If vitest silently falls back to an internal bundled vite or uses incompatible APIs, test results could be unreliable or security-relevant code paths (e.g. source-map handling, module mocking) could behave differently than expected. This is a supply-chain / configuration risk rather than a direct vulnerability, but it can mask real test failures.
Suggested fix:
Either upgrade vite to ^6.0.0 to satisfy the declared peer requirement, or pin vitest to a version that officially supports vite@5 (e.g. vitest@1.x or vitest@2.x).
Documentation ReviewThe following documentation may need updates based on the changes in this PR:
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 004ce0c. Configure here.
| "typescript": "^5.3.0", | ||
| "vite": "^5.4.21", | ||
| "vitest": "^1.0.0" | ||
| "vitest": "^4.1.0" |
There was a problem hiding this comment.
Vitest four needs Vite six
High Severity
This change upgrades vitest to ^4.1.0 while vite remains at ^5.4.21. Vitest 4 requires Vite 6 or newer and no longer supports Vite 5, so pnpm test can fail or behave unpredictably with the current lockfile pairing.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 004ce0c. Configure here.
|
Superseded by #29. |
Bumps vitest from 1.6.1 to 4.1.0.
Release notes
Sourced from vitest's releases.
... (truncated)
Commits
4150b91chore: release v4.1.01de0aa2fix: correctly identify concurrent test during static analysis (#9846)c3cac1cfix: use isAgent check, not just TTY, for watch mode (#9841)eab68bachore(deps): update all non-major dependencies (#9824)031f02afix: allow catch/finally for async assertion (#9827)3e9e096feat(reporters): addagentreporter to reduce ai agent token usage (#9779)0c2c013chore: release v4.1.0-beta.68181e06fix:hideSkippedTestsshould not hidetest.todo(fix #9562) (#9781)a8216b0fix: manual and redirect mock shouldn'tloadortransformoriginal module...689a22afix(browser): types ofgetCDPSessionandcdp()(#9716)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Medium Risk
Major-version test runner upgrade with no accompanying config or test fixes in the PR; runtime or assertion API changes could fail CI until validated.
Overview
Bumps the devDependency
vitestfrom ^1.0.0 / 1.6.1 to ^4.1.0 inpackage.jsonand refreshespnpm-lock.yamlaccordingly. No application or test source files are modified in this diff—only the test runner toolchain.The lockfile reflects Vitest 4’s dependency graph (e.g.
@vitest/mocker,chai6.x, droppedvite-node/tinypoolpaths from the v1 stack). Existing scripts (vitest run,vitest) and imports like those insrc/hooks/index.test.tsxare unchanged here; CI should runpnpm testto confirm nothing breaks on the major upgrade. Vitest 4 also declares stricter Node engine requirements than v1; this repo’s CI already targets Node 24, which aligns with that.Reviewed by Cursor Bugbot for commit 004ce0c. Bugbot is set up for automated code reviews on this repo. Configure here.