[dependabot]

Bumps the development group with 2 updates: @vitest/coverage-v8 and vitest.

Updates @vitest/coverage-v8 from 5.0.4 to 5.0.5

Release notes

Sourced from @​vitest/coverage-v8's releases.

v5.0.5

   🐞 Bug Fixes

• Keep vite default fs.deny with api token file  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11578 (28dc1)
• Handle quoted file names in --changed  -  by @​sheremet-va in vitest-dev/vitest#11583 (14921)
• Add data to the import.meta.hot stub  -  by @​sheremet-va in vitest-dev/vitest#11590 (3a828)
• Set skip in skipIf, ignore undefined options  -  by @​sheremet-va in vitest-dev/vitest#11591 (d523a)
• Skip builtin loading in async leak detector  -  by @​sheremet-va in vitest-dev/vitest#11598 (fe86a)
• Keep the import frame in native loader errors  -  by @​sheremet-va in vitest-dev/vitest#11599 (9697b)
• Run hook cleanups when a later hook fails  -  by @​sheremet-va in vitest-dev/vitest#11605 (6c5a4)
• Release mocks of finished test files  -  by @​sheremet-va in vitest-dev/vitest#11607 (e9c3d)
• Abort all running tests on cancel  -  by @​sheremet-va in vitest-dev/vitest#11606 (6621a)
• browser:
  • Ignore synthetic pagehide events  -  by @​sheremet-va in vitest-dev/vitest#11582 (ca081)
  • Run plugin buildStart on server creation  -  by @​sheremet-va in vitest-dev/vitest#11593 (ea611)
  • Drop late connections of closed sessions  -  by @​sheremet-va in vitest-dev/vitest#11600 (f161e)
  • Wait 30s for the browser to close  -  by @​sheremet-va in vitest-dev/vitest#11601 (6498b)
  • Run global setup once with instances  -  by @​sheremet-va in vitest-dev/vitest#11596 (8dd67)
• reporter:
  • End reason &[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8/issues/39);failed&[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8/issues/39); on worker crash  -  by @​AriPerkkio in vitest-dev/vitest#11568 (6ae8e)

    View changes on GitHub

Commits

• 7a825db chore: release v5.0.5 (#11609)
• See full diff in compare view

Updates vitest from 5.0.4 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

• Keep vite default fs.deny with api token file  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11578 (28dc1)
• Handle quoted file names in --changed  -  by @​sheremet-va in vitest-dev/vitest#11583 (14921)
• Add data to the import.meta.hot stub  -  by @​sheremet-va in vitest-dev/vitest#11590 (3a828)
• Set skip in skipIf, ignore undefined options  -  by @​sheremet-va in vitest-dev/vitest#11591 (d523a)
• Skip builtin loading in async leak detector  -  by @​sheremet-va in vitest-dev/vitest#11598 (fe86a)
• Keep the import frame in native loader errors  -  by @​sheremet-va in vitest-dev/vitest#11599 (9697b)
• Run hook cleanups when a later hook fails  -  by @​sheremet-va in vitest-dev/vitest#11605 (6c5a4)
• Release mocks of finished test files  -  by @​sheremet-va in vitest-dev/vitest#11607 (e9c3d)
• Abort all running tests on cancel  -  by @​sheremet-va in vitest-dev/vitest#11606 (6621a)
• browser:
  • Ignore synthetic pagehide events  -  by @​sheremet-va in vitest-dev/vitest#11582 (ca081)
  • Run plugin buildStart on server creation  -  by @​sheremet-va in vitest-dev/vitest#11593 (ea611)
  • Drop late connections of closed sessions  -  by @​sheremet-va in vitest-dev/vitest#11600 (f161e)
  • Wait 30s for the browser to close  -  by @​sheremet-va in vitest-dev/vitest#11601 (6498b)
  • Run global setup once with instances  -  by @​sheremet-va in vitest-dev/vitest#11596 (8dd67)
• reporter:
  • End reason &[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39);failed&[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39); on worker crash  -  by @​AriPerkkio in vitest-dev/vitest#11568 (6ae8e)

    View changes on GitHub

Commits

• 7a825db chore: release v5.0.5 (#11609)
• 6621a72 fix: abort all running tests on cancel (#11606)
• e9c3d72 fix: release mocks of finished test files (#11607)
• 8dd67c2 fix(browser): run global setup once with instances (#11596)
• 6c5a447 fix: run hook cleanups when a later hook fails (#11605)
• 9697b38 fix: keep the import frame in native loader errors (#11599)
• 6498b66 fix(browser): wait 30s for the browser to close (#11601)
• f161e6d fix(browser): drop late connections of closed sessions (#11600)
• fe86a64 fix: skip builtin loading in async leak detector (#11598)
• 6ae8e89 fix(reporter): end reason 'failed' on worker crash (#11568)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates the locked Vitest and V8 coverage packages from 5.0.4 to 5.0.5.

Example: A contributor installs dependencies with pnpm install --frozen-lockfile.

• Before: Vitest and @vitest/coverage-v8 resolve to 5.0.4.
• After: Both resolve to 5.0.5, with matching mocker and spy packages.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is focused and has passing validation; the available evidence consists of automated checks rather than independent execution evidence.
Proof confidence	🦐 gold shrimp (3/6)	This automated development-dependency PR is outside the contributor live-proof gate; passing checks support installation, test, and coverage compatibility without constituting independent live proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Contributors remain on the previous Vitest patch release and do not receive the upstream test-runner fixes.
Reason: This follows the repository's established grouped development-dependency maintenance policy without changing product defaults or public contracts.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: main still uses Vitest 5.0.4, and this focused patch update has passing checks with no concrete introduced defect found.

Priority: P3
Reviewed head: b6313530a9514614518ead462bd60e73e19abaa9

Before merge

None.

Findings

None.

Agent review details

How this fits together

The lockfile selects development tools used by the repository's test and coverage scripts; these packages are separate from the published terminal runtime dependencies.

flowchart LR
  A[Package dependency ranges] --> B[pnpm lockfile]
  B --> C[Frozen dependency installation]
  C --> D[Vitest runner]
  D --> E[Terminal library tests]
  D --> F[V8 coverage reports]

Loading

Technical review

Best possible solution:

Retain the focused lockfile update with Vitest and its coverage provider aligned.

Do we have a high-confidence way to reproduce the issue?

This is dependency maintenance rather than a reported libterminal bug, so a failing reproduction is not applicable.

Is this the best way to solve the issue?

The lockfile-only update is appropriately narrow, satisfies the existing manifest ranges, and preserves the established matching-provider contract.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 4961b34d8dcf.

Provenance checked

• Vitest-family lockfile resolutions keeps the original intent (7040f0c: The previous merged dependency update advanced Vitest and its coverage provider together to 5.0.4.)
• Matching V8 coverage provider keeps the original intent (2e73ab0: Provide reproducible Vitest 5 coverage over handwritten TypeScript with a matching V8 provider.)

Testing

Proof path: unit tests only.

Security

None.

Evidence

What I checked:

• Verified introduced change: The complete introduced diff changes only Vitest-family versions, matching peer references, and integrity hashes in pnpm-lock.yaml; it adds no dependency names, scripts, or runtime code. (pnpm-lock.yaml:29, b6313530a951)
• Update remains absent from main: GitHub still reports main at the pinned base, whose lockfile resolves Vitest and its coverage provider to 5.0.4; the existing ^5.0.4 manifest ranges permit 5.0.5. (pnpm-lock.yaml:29, 4961b34d8dcf)
• Passing validation on the reviewed head: All 13 completed checks succeeded, including the Node 22/24 platform matrix, Node 26, and Chromium smoke; two dispatch checks were skipped. CI runs frozen installation and pnpm check, with coverage on Node 24 Linux. (.github/workflows/ci.yml:79, b6313530a951)
• Existing coverage contract: The merged test: add Vitest 5 coverage reporting #74 established matching Vitest/V8 provider versions, coverage of handwritten source, and Node 24 Linux coverage validation; this update preserves that arrangement. (vitest.config.ts:7, 2e73ab0ecd8c)
• Dependency provenance and history: The merged build(deps-dev): bump the development group with 2 updates #107 supplied the previous aligned 5.0.4 update. Local historical blob reads encountered missing objects; GitHub commit patches recovered the relevant dependency and test-configuration history. (pnpm-lock.yaml:710, 7040f0cd32f8)
• Policy and discussion inspected: The complete root AGENTS.md applies to the root lockfile; no matching maintainer notes or pr-simplify skill were present. The full PR body and both comments contain upstream release information and review-status messages, with no additional product decision. No tests or autoreview helper were run during this read-only review. (AGENTS.md, b6313530a951)

Labels

Label changes:

• add P3: Routine development-tool patch maintenance with passing validation and no demonstrated terminal-runtime regression.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: Routine development-tool patch maintenance with passing validation and no demonstrated terminal-runtime regression.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 19, 2026, 1:29 PM ET / 17:29 UTC.

[steipete]

Included in #114, merged as c5e11c3. Vitest and the V8 coverage provider are now both 5.0.5. Frozen install, package checks, all 140 unit tests, coverage, nine browser tests, and the exact-head cross-platform CI passed. Dependabot credit is preserved in the changelog and squash commit. Closing this superseded update.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml