build(deps-dev): bump vitest from 4.1.11 to 5.0.2 by dependabot[bot] · Pull Request #44 · openclaw/uirouter

dependabot · 2026-09-30T18:54:50Z

Bumps vitest from 4.1.11 to 5.0.2.

Release notes

v5.0.2

   🐞 Bug Fixes

Bind process in case global is overwritten - by @AriPerkkio in vitest-dev/vitest#11343 (0b792)

detect-async-leaks:

Ignore process.stdio handles - by @AriPerkkio in vitest-dev/vitest#11333 (0fd6b)

expect:

Fix toMatchObject with asymmetric matchers - by @ShreeBohara, Claude Opus 5, @hi-ogawa, Hiroshi Ogawa and Codex (GPT-5) in vitest-dev/vitest#11100 (42523)

jsdom:

Fix Request with Blob body on jsdom 28+ - by @harshit-d3v in vitest-dev/vitest#11295 (d1c3e)

reporter:

agent to respect --silent - by @Raj4478 and @AriPerkkio in vitest-dev/vitest#11271 (5b95e)

reporters:

Handle concurrent createReport calls - by @7rulnik in vitest-dev/vitest#11278 (e8e55)

hanging-process to use ESM entrypoint - by @AriPerkkio in vitest-dev/vitest#11316 (4e91e)

spy:

Fix stack overflow when spying Set.prototype.add - by @fengmk2 in vitest-dev/vitest#11299 (a0a93)

ui:

Persist authentication cookie beyond current browser session - by @hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#11066 (f8819)

    View changes on GitHub

v5.0.1

   🚀 Features

ui:

Move trace attempts selector to viewer header - by @hi-ogawa, Hiroshi Ogawa and Codex in vitest-dev/vitest#11189 (5dc4b)

Add focused trace view layout mode - by @hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in vitest-dev/vitest#11190 (376dc)

   🐞 Bug Fixes

Exit 1 when vitest list fails collection - by @hamed-bavar in vitest-dev/vitest#11145 and vitest-dev/vitest#11146 (6108b)

Keep parse error details in static collection - by @hamed-bavar in vitest-dev/vitest#11150 and vitest-dev/vitest#11151 (7c818)

Avoid recursive prototype in automocking - by @sheremet-va in vitest-dev/vitest#11195 (99fc5)

Prevent false Vitest import resolution - by @sheremet-va in vitest-dev/vitest#11196 (b426c)

Keep metadata file when clearing the cache - by @sheremet-va in vitest-dev/vitest#11199 (73614)

Correct typos in error message and comments - by @shinji00222 and Shinji in vitest-dev/vitest#11187 (115c3)

Resolve ResolvedConfig exactOptionalPropertyTypes errors - by @LukeAbby in vitest-dev/vitest#11175 (498fb)

Share the server on self-referencing extends - by @sheremet-va in vitest-dev/vitest#11034 (23dda)

Warn when deprecated deps.optimizer.web is used - by @im10furry in vitest-dev/vitest#11214 (2ce29)

browser:

Avoid double quotes in config.define - by @sheremet-va in vitest-dev/vitest#11198 (972e2)

doctor:

Measure vm pools for custom environments - by @sheremet-va in vitest-dev/vitest#11212 (91ab1)

expect:

Correct return value in toMatchAriaSnapshot - by @sheremet-va in vitest-dev/vitest#11208 (c119b)

fakeTimers:

Force queueMicrotask and nextTick in toNotFake - by @kingmakeruix, kingmakeruix, Hiroshi Ogawa, Codex and @hi-ogawa in vitest-dev/vitest#11261 (a47d7)

snapshot:

Report obsolete keys next to skipped tests - by @hamed-bavar, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#11157 and vitest-dev/vitest#11158 (17e2b)

... (truncated)

Commits

428e2e5 chore: release v5.0.2 (#11357)
0b79231 fix: bind process in case global is overwritten (#11343)
597df56 docs: correct stale config defaults (#11354)
ea1c44f docs: sequence.setupFiles default is 'list' (#11351)
0fd6b97 fix(detect-async-leaks): ignore process.stdio handles (#11333)
4e91e56 fix(reporters): hanging-process to use ESM entrypoint (#11316)
1a57929 docs(browser): fix locators.exact default (#11338)
5b95efb fix(reporter): agent to respect --silent (#11271)
f58a209 docs: correct benchmark.exclude and watch defaults (#11268)
d1c3ecc fix(jsdom): fix Request with Blob body on jsdom 28+ (#11295)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 4.1.11 to 5.0.2. - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.2/packages/vitest) --- updated-dependencies: - dependency-name: vitest dependency-version: 5.0.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

clawsweeper · 2026-09-30T18:54:54Z

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

clawsweeper · 2026-09-30T18:59:56Z

Codex review: blocked before merge. Reviewed October 1, 2026, 8:17 AM ET / 12:17 UTC (Revision 2).

ClawSweeper review

What this changes

This PR upgrades the package’s Vitest test runner from 4.1.11 to 5.0.2 and updates the pnpm lockfile.

Regression provenance

Possible regression — suspected (reviewed change). No predecessor PR is attributed.

Merge readiness

⛔ Blocked before merge - 3 items remain

The upgrade remains distinct from current main, but it introduces a development-install failure on supported Node 25. The successful Node 22/24 CI matrix does not cover that regression.

Priority: P2
Reviewed head: caa90adba57ea838c4c82e0d80fff777995b2e86

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The focused dependency update has successful matrix checks but introduces a concrete supported-version installation regression.
Proof confidence	🌊 off-meta tidepool	Not applicable: Dependabot’s dependency-only PR is exempt from contributor runtime proof. Successful CI exercises the changed runner through package checks on Node 22/24, but does not resolve the Node 25 engine failure; no stored-data contract changes.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Dependabot’s dependency-only PR is exempt from contributor runtime proof. Successful CI exercises the changed runner through package checks on Node 22/24, but does not resolve the Node 25 engine failure; no stored-data contract changes.
Evidence reviewed	8 items	Introduced dependency change: The pinned introduced delta changes only package.json and pnpm-lock.yaml, upgrading Vitest to 5.0.2. Its locked Node range excludes Node 25; the previous range included it. Strict installation contract: engineStrict is enabled. CONTRIBUTING.md explicitly requires contributors to use the declared Node versions and explains that pnpm enforces dependency engines. The package declares ^22.18.0 \|\| >=24.11.0, including Node 25. Authoritative dependency engine requirement: Vitest’s v5.0.2 manifest independently confirms engines.node is ^22.12.0 \|\| ^24.0.0 \|\| >=26.0.0. The tagged dependency is directly executed by the target’s test script, establishing the relevant dependency contract.
Findings	1 actionable finding	[P1] Preserve development installation on supported Node 25
Security	None	None.

How this fits together

Vitest runs the standalone router’s behavior tests during package validation. pnpm validates dependency engine requirements before contributors can run those checks.

flowchart LR
 A[Contributor Node version] --> B[pnpm dependency installation]
 C[Locked Vitest version] --> B
 B --> D{Engine requirements satisfied}
 D --> E[Router behavior tests]
 D --> F[Installation rejected]
 E --> G[Package validation]

Before merge

Preserve development installation on supported Node 25 (P1) - On Node 25, pnpm install --frozen-lockfile will reject Vitest 5.0.2: its engine range is ^22.12.0 || ^24.0.0 || >=26.0.0, while this repository enables engineStrict and declares >=24.11.0. Current main explicitly preserves Node 25 contributor support in build(deps): refresh formatter with Node 25 support #48. The green CI matrix covers only Node 22/24. Retain a compatible Vitest version rather than dropping that supported installation path.
Resolve merge risk (P1) - Contributors using supported Node 25 would be unable to install the development dependencies because Vitest 5.0.2 excludes that version and pnpm enforces dependency engines.
Complete next step (P2) - Preserve Node 25 development installation by using a compatible Vitest release, then validate frozen installation and package checks on Node 25.

Findings

[P1] Preserve development installation on supported Node 25 — package.json:59

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Validation coverage	6 passing matrix jobs; Node 25 absent	The successful Node 22/24 checks cannot detect the introduced Node 25 installation failure.

Merge-risk options

Maintainer options:

Defer the incompatible major upgrade (recommended)
Retain Vitest 4 until a Vitest 5 release supports the repository’s declared Node range.

Technical review

Best possible solution:

Keep the test toolchain compatible with the declared Node range and adopt Vitest 5 only when its engine contract permits that range.

Do we have a high-confidence way to reproduce the issue?

Yes, from source: a frozen development installation on Node 25 encounters Vitest’s incompatible engine range with engineStrict enabled. Installation was not executed during this read-only review.

Is this the best way to solve the issue?

No, this exact version upgrade conflicts with the established development support contract; retaining a compatible runner is the safer path.

Full review comments:

[P1] Preserve development installation on supported Node 25 — package.json:59
On Node 25, pnpm install --frozen-lockfile will reject Vitest 5.0.2: its engine range is ^22.12.0 || ^24.0.0 || >=26.0.0, while this repository enables engineStrict and declares >=24.11.0. Current main explicitly preserves Node 25 contributor support in build(deps): refresh formatter with Node 25 support #48. The green CI matrix covers only Node 22/24. Retain a compatible Vitest version rather than dropping that supported installation path.
Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 07fab057ebd5.

Labels

Label changes:

add P2: This dependency upgrade introduces a bounded contributor installation regression without changing shipped router behavior.
add merge-risk: 🚨 compatibility: Vitest 5 excludes supported Node 25, causing strict dependency installation to reject existing contributor setups.
add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: Dependabot’s dependency-only PR is exempt from contributor runtime proof. Successful CI exercises the changed runner through package checks on Node 22/24, but does not resolve the Node 25 engine failure; no stored-data contract changes.
remove rating: 🐚 platinum hermit: Current PR rating is rating: 🦐 gold shrimp, so this older rating label is no longer current.
remove status: 👀 ready for maintainer look: Current PR status label is status: ⏳ waiting on author.
remove P3: Current review triage priority is P2, so this older priority label is no longer current.

Label justifications:

P2: This dependency upgrade introduces a bounded contributor installation regression without changing shipped router behavior.
merge-risk: 🚨 compatibility: Vitest 5 excludes supported Node 25, causing strict dependency installation to reject existing contributor setups.
rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: Dependabot’s dependency-only PR is exempt from contributor runtime proof. Successful CI exercises the changed runner through package checks on Node 22/24, but does not resolve the Node 25 engine failure; no stored-data contract changes.

Evidence

What I checked:

Introduced dependency change: The pinned introduced delta changes only package.json and pnpm-lock.yaml, upgrading Vitest to 5.0.2. Its locked Node range excludes Node 25; the previous range included it. (pnpm-lock.yaml:1190, caa90adba57e)
Strict installation contract: engineStrict is enabled. CONTRIBUTING.md explicitly requires contributors to use the declared Node versions and explains that pnpm enforces dependency engines. The package declares ^22.18.0 || >=24.11.0, including Node 25. (pnpm-workspace.yaml:1, caa90adba57e)
Authoritative dependency engine requirement: Vitest’s v5.0.2 manifest independently confirms engines.node is ^22.12.0 || ^24.0.0 || >=26.0.0. The tagged dependency is directly executed by the target’s test script, establishing the relevant dependency contract. (packages/vitest/package.json, 428e2e5043c6)
Maintainer-confirmed Node 25 support: The merged build(deps): refresh formatter with Node 25 support #48 explicitly preserves development installation on every declared Node version, including Node 25, and records successful frozen installation and package checks on Node 25.9.0. That decision applies to the current base. (package.json:61, 07fab057ebd5)
Current main and release necessity: Both fetched main and v0.1.2 still declare Vitest ^4.1.11. The requested major upgrade has not landed or shipped. (package.json:59, cd289d3d3d30)
CI coverage: The workflow installs with a frozen lockfile and runs pnpm run check on Node 22 and 24 across Linux, macOS, and Windows. All six supplied matrix checks succeeded, but none exercises Node 25. (.github/workflows/ci.yml:38, caa90adba57e)

Likely related people:

unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)
steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

Use a Vitest version compatible with the declared Node range and validate frozen installation plus package checks on Node 25.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

reviewed 2026-09-30T18:57:33.146Z sha e86513b :: needs maintainer review before merge. :: none

vincentkoc · 2026-10-01T12:14:47Z

@clawsweeper re-review

clawsweeper · 2026-10-01T12:15:02Z

🦞👀
Exact review queued.

Re-review progress:

State: Complete
Detail: A newer review tuple already exists; this stale result was superseded.
Run: https://github.com/openclaw/clawsweeper/actions/runs/36861475926
Updated: 2026-10-01T12:24:12.746Z

vincentkoc · 2026-10-01T12:19:43Z

Closing as incompatible with this repository's supported Node range. Vitest 5.0.2 declares ^22.12.0 || ^24.0.0 || >=26.0.0, while UIRouter declares ^22.18.0 || >=24.11.0 with engineStrict: true, so Node 25 remains supported by the repository but excluded by this dependency. The current Vitest 5.0.3 manifest has the same restriction. Hosted Node 22/24 checks and local runtime tests pass, but they do not make the dependency contract compatible. Retaining Vitest 4 until Vitest 5 supports Node 25.

dependabot · 2026-10-01T12:19:46Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 30, 2026

dependabot Bot requested a review from a team as a code owner September 30, 2026 18:54

Merge branch 'main' into dependabot/npm_and_yarn/vitest-5.0.2

caa90ad

vincentkoc closed this Oct 1, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/vitest-5.0.2 branch October 1, 2026 12:19

clawsweeper Bot mentioned this pull request Oct 5, 2026

build(deps-dev): bump vitest from 4.1.11 to 5.0.3 #51

Closed

Navigation Menu

Repository navigation

build(deps-dev): bump vitest from 4.1.11 to 5.0.2 - #44

build(deps-dev): bump vitest from 4.1.11 to 5.0.2#44
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/vitest-5.0.2

dependabot Bot commented on behalf of github Sep 30, 2026

Uh oh!

clawsweeper Bot commented Sep 30, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Sep 30, 2026 •

edited

Loading

Security

Review metrics

Merge-risk options

Technical review

Labels

Evidence

Rank-up moves

Rating scale

Workflow

History

Uh oh!

vincentkoc commented Oct 1, 2026

Uh oh!

clawsweeper Bot commented Oct 1, 2026 •

edited

Loading

Uh oh!

vincentkoc commented Oct 1, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Sep 30, 2026

v5.0.2

🐞 Bug Fixes

View changes on GitHub

v5.0.1

🚀 Features

🐞 Bug Fixes

Uh oh!

clawsweeper Bot commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ClawSweeper review complete

Uh oh!

clawsweeper Bot commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ClawSweeper review

What this changes

Regression provenance

Merge readiness

Review scores

Verification

How this fits together

Before merge

Findings

Security

Review metrics

Merge-risk options

Technical review

Labels

Evidence

Rank-up moves

Rating scale

Workflow

History

Uh oh!

vincentkoc commented Oct 1, 2026

Uh oh!

clawsweeper Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vincentkoc commented Oct 1, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

clawsweeper Bot commented Sep 30, 2026 •

edited

Loading

clawsweeper Bot commented Sep 30, 2026 •

edited

Loading

clawsweeper Bot commented Oct 1, 2026 •

edited

Loading