build(deps-dev): bump vitest from 4.1.11 to 5.0.3

[dependabot]

Bumps vitest from 4.1.11 to 5.0.3.

Release notes

Sourced from vitest's releases.

v5.0.3

   🐞 Bug Fixes

• Isolate result.status between repeats runs  -  by @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11218 (5dbeb)
• Don't print an interceptor warning in browser mode  -  by @​sheremet-va in vitest-dev/vitest#11377 (15cc0)
• Don't retry when test.fails expectedly failed  -  by @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11219 (b2458)
• Scope cache key generators to projects  -  by @​ecoyoung in vitest-dev/vitest#11281 and vitest-dev/vitest#11301 (92ba7)
• browser:
  • Delay server listen until tests start running  -  by @​sheremet-va in vitest-dev/vitest#11366 (7d8ed)
  • Check mock path boundaries  -  by @​saryn17, Ryosei Sato and @​sheremet-va in vitest-dev/vitest#11361 and vitest-dev/vitest#11362 (1c388)
  • Keep config of browser-consumed environments  -  by @​kasperpeulen and Claude in vitest-dev/vitest#11378 (aafc0)
  • Ignore page crash while cancelling  -  by @​sheremet-va in vitest-dev/vitest#11386 (7c367)
  • toMatchScreenshot uses wrong reference on retried tests  -  by @​macarie in vitest-dev/vitest#11393 (c22ab)
• cache:
  • Revalidate imports of cached modules  -  by @​sheremet-va in vitest-dev/vitest#11381 (38f98)
• deps:
  • Pin why-is-node-running to 3.2.1 to avoid users running into ERR_PNPM_TRUST_DOWNGRADE  -  by @​AriPerkkio in vitest-dev/vitest#11403 (f6c9a)
• expect:
  • Pass current equality testers to expect.extend asymmetric matchers  -  by @​hi-ogawa, Hiroshi Ogawa and Claude in vitest-dev/vitest#11401 (3e794)
• jsdom:
  • Support Blob on jsdom 30.1  -  by @​sheremet-va in vitest-dev/vitest#11379 (6c49b)
• pool:
  • Preserve unique pool ids when groupOrder is set  -  by @​mtorp in vitest-dev/vitest#11392 (50312)
• ui:
  • Split-pane handle overlapping iframe  -  by @​macarie in vitest-dev/vitest#11221 (f91db)
• vitest:
  • Remove root temp dir on close  -  by @​abhinav-phi in vitest-dev/vitest#11248 (7c711)
• vm:
  • Do not optimize deps from index.html  -  by @​ezefernandezyf, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11329 and vitest-dev/vitest#11360 (caf28)
  • Don't reuse scripts across vite environments  -  by @​MO2k4, Martin Oehlert and Claude in vitest-dev/vitest#11395 (346d3)

    View changes on GitHub

v5.0.2

   🐞 Bug Fixes

• Bind process in case global is overwritten  -  by @​AriPerkkio in vitest-dev/vitest#11343 (0b792)
• detect-async-leaks:
  • Ignore process.stdio handles  -  by @​AriPerkkio in vitest-dev/vitest#11333 (0fd6b)
• expect:
  • Fix toMatchObject with asymmetric matchers  -  by @​ShreeBohara, Claude Opus 5, @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-5) in vitest-dev/vitest#11100 (42523)
• jsdom:
  • Fix Request with Blob body on jsdom 28+  -  by @​harshit-d3v in vitest-dev/vitest#11295 (d1c3e)
• reporter:
  • agent to respect --silent  -  by @​Raj4478 and @​AriPerkkio in vitest-dev/vitest#11271 (5b95e)
• reporters:
  • Handle concurrent createReport calls  -  by @​7rulnik in vitest-dev/vitest#11278 (e8e55)
  • hanging-process to use ESM entrypoint  -  by @​AriPerkkio in vitest-dev/vitest#11316 (4e91e)
• spy:
  • Fix stack overflow when spying Set.prototype.add  -  by @​fengmk2 in vitest-dev/vitest#11299 (a0a93)

... (truncated)

Commits

• 33cadea chore: release v5.0.3 (#11409)
• 346d389 fix(vm): don't reuse scripts across vite environments (#11395)
• f6c9a49 fix(deps): pin why-is-node-running to 3.2.1 to avoid users running into `...
• 062c75d chore: fix standalone docs build, update exports maps (#11394)
• caf2887 fix(vm): do not optimize deps from index.html (fix #11329) (#11360)
• 50312eb fix(pool): preserve unique pool ids when groupOrder is set (#11392)
• 7c36748 fix(browser): ignore page crash while cancelling (#11386)
• 92ba7fc fix: scope cache key generators to projects (fix #11281) (#11301)
• 38f9885 fix(cache): revalidate imports of cached modules (#11381)
• b24585f fix: don't retry when test.fails expectedly failed (#11219)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vitest@​4.1.11 ⏵ 5.0.3			+1

View full report

[clawsweeper]

Codex review: blocked before merge. Reviewed October 6, 2026, 5:02 PM ET / 21:02 UTC (Revision 4).

ClawSweeper review

What this changes

Updates the development test runner from Vitest 4.1.11 to 5.0.3 and refreshes its locked dependencies.

Regression provenance

Possible regression — suspected (reviewed change). No predecessor PR is attributed.

Merge readiness

⛔ Blocked before merge - 3 items remain

Keep open with the previously reported compatibility blocker: the unchanged dependency update excludes supported Node 25 development installations. Current main retains Vitest 4, and no merged replacement establishes that this upgrade is already implemented.

Priority: P2
Reviewed head: 1aa22468bec48d3bcf4ea639ea0c2b069e5715d1

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The focused upgrade passes hosted checks but retains a concrete supported-engine compatibility defect.
Proof confidence	🌊 off-meta tidepool	Not applicable: Dependabot is exempt from contributor runtime proof. Hosted Node 22/24 checks support test-runner validation but do not cover the source-proven Node 25 installation incompatibility; no stored-data contract changes.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Dependabot is exempt from contributor runtime proof. Hosted Node 22/24 checks support test-runner validation but do not cover the source-proven Node 25 installation incompatibility; no stored-data contract changes.
Evidence reviewed	8 items	Pinned introduced change: The complete introduced diff changes only package.json and pnpm-lock.yaml, replacing Vitest 4.1.11 with 5.0.3. The locked engine range changes from one accepting Node 25 to one excluding it. Supported installation contract: package.json declares Node ^22.18.0 || >=24.11.0, README.md repeats that range, and pnpm-workspace.yaml enables engineStrict. Node 25 satisfies the repository range but fails the introduced Vitest range. Dependency contract verified: The patch directly installs and executes Vitest through the test script, making its engine contract applicable. The official Vitest 5.0.3 manifest independently declares ^22.12.0 || ^24.0.0 || >=26.0.0, matching the lockfile and excluding Node 25.
Findings	1 actionable finding	[P1] Preserve development installation on supported Node 25
Security	None	None.

How this fits together

Vitest runs UIRouter’s public behavior tests during development and CI. Dependency installation must succeed before those tests and package validation can run.

flowchart TD
  A[Developer Node version] --> B[Strict dependency installation]
  C[Locked test dependencies] --> B
  B --> D{Compatible engines}
  D -->|Yes| E[Router tests and package checks]
  D -->|No| F[Installation blocked]

Loading

Before merge

• Preserve development installation on supported Node 25 (P1) - Vitest 5.0.3 declares ^22.12.0 || ^24.0.0 || >=26.0.0, excluding Node 25 even though this repository declares ^22.18.0 || >=24.11.0. With engineStrict: true, a fresh or updated development install on Node 25 fails before tests run. The Node 22/24 CI matrix cannot catch this. Retain a compatible dependency, consistent with the member decision at build(deps-dev): bump vitest from 4.1.11 to 5.0.2 #44 (comment). This previously reported blocker remains present at the unchanged head.
• Resolve merge risk (P1) - Merging this update makes fresh or existing Node 25 development setups fail strict dependency installation before repository checks can run.
• Complete next step (P2) - Restore a compatible Vitest dependency and matching lockfile while preserving Node 25 support and strict engine validation.

Findings

• [P1] Preserve development installation on supported Node 25 — package.json:59

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Engine coverage	1 supported Node major excluded; CI covers 2 majors	Passing Node 22 and 24 checks cannot detect the introduced Node 25 installation failure.

Merge-risk options

Maintainer options:

1. Preserve compatible tooling (recommended)
   Restore Vitest 4.1.11 and its matching lockfile entries without narrowing Node support or disabling engine checks.
2. Defer the major upgrade
   Pause this upgrade until a Vitest release supports Node 25 under the existing repository contract.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Preserve the declared Node support range and engineStrict; retain Vitest 4.1.11 with a consistent lockfile, and validate development installation on Node 25.

Technical review

Best possible solution:

Retain a test runner compatible with the full supported Node range and preserve strict engine validation, following the existing member decision.

Do we have a high-confidence way to reproduce the issue?

Yes, source establishes the introduced failure: a normal development install on Node 25 encounters Vitest’s incompatible engine range with engineStrict enabled. Installation was not executed during this read-only review.

Is this the best way to solve the issue?

No, this upgrade violates the established development compatibility contract; retaining compatible Vitest 4 is the narrowest supported direction.

Full review comments:

• [P1] Preserve development installation on supported Node 25 — package.json:59
  Vitest 5.0.3 declares ^22.12.0 || ^24.0.0 || >=26.0.0, excluding Node 25 even though this repository declares ^22.18.0 || >=24.11.0. With engineStrict: true, a fresh or updated development install on Node 25 fails before tests run. The Node 22/24 CI matrix cannot catch this. Retain a compatible dependency, consistent with the member decision at build(deps-dev): bump vitest from 4.1.11 to 5.0.2 #44 (comment). This previously reported blocker remains present at the unchanged head.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against f7320e4435a3.

Labels

Label changes:

• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• remove rating: 🦪 silver shellfish: Current PR rating is rating: 🦐 gold shrimp, so this older rating label is no longer current.

Label justifications:

• P2: This is a bounded development-tooling compatibility problem rather than a shipped router runtime outage.
• merge-risk: 🚨 compatibility: The introduced dependency rejects Node 25, which remains explicitly supported under strict engine validation.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: Dependabot is exempt from contributor runtime proof. Hosted Node 22/24 checks support test-runner validation but do not cover the source-proven Node 25 installation incompatibility; no stored-data contract changes.

Evidence

Acceptance criteria:

• [P1] pnpm install --frozen-lockfile on Node 25.
• [P1] pnpm run check on Node 25.
• [P1] pnpm install --frozen-lockfile on Node 22 and Node 24.
• [P1] pnpm run check on Node 22 and Node 24.
• [P1] git diff --check.

What I checked:

• Pinned introduced change: The complete introduced diff changes only package.json and pnpm-lock.yaml, replacing Vitest 4.1.11 with 5.0.3. The locked engine range changes from one accepting Node 25 to one excluding it. (pnpm-lock.yaml:1214, 1aa22468bec4)
• Supported installation contract: package.json declares Node ^22.18.0 || >=24.11.0, README.md repeats that range, and pnpm-workspace.yaml enables engineStrict. Node 25 satisfies the repository range but fails the introduced Vitest range. (package.json:62, 1aa22468bec4)
• Dependency contract verified: The patch directly installs and executes Vitest through the test script, making its engine contract applicable. The official Vitest 5.0.3 manifest independently declares ^22.12.0 || ^24.0.0 || >=26.0.0, matching the lockfile and excluding Node 25. (packages/vitest/package.json)
• Existing member decision: vincentkoc’s MEMBER-associated comment explicitly retains Vitest 4 until Vitest 5 supports Node 25 and specifically notes that 5.0.3 has the same restriction: build(deps-dev): bump vitest from 4.1.11 to 5.0.2 #44 (comment). That related PR closed unmerged and is not a replacement landing candidate.
• Main and release necessity check: Pinned current main retains ^4.1.11. GitHub’s v0.1.2 package manifest also retains ^4.1.11 and the same Node support range; neither already implements this upgrade. Local tag inspection could not load an unavailable blob, so release contents were verified through GitHub instead. (package.json:59, cd289d3d3d30)
• CI coverage and review continuity: CI checks Node 22 and 24 across three operating systems, leaving Node 25 outside its matrix. The prior review identified this same blocker at the exact current head, so it remains unresolved rather than newly discovered. (.github/workflows/ci.yml:38, 1aa22468bec4)

Likely related people:

• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Preserve Node 25 installation compatibility and validate the corrected dependency set with strict engine checks enabled.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (3 earlier review cycles)

• reviewed 2026-10-05T18:59:55.397Z sha 1aa2246 :: blocked before merge. :: [P1] Preserve development installation on supported Node 25
• reviewed 2026-10-06T01:44:13.594Z sha 1aa2246 :: blocked before merge. :: [P1] Preserve development installation on supported Node 25
• reviewed 2026-10-06T18:36:00.428Z sha 1aa2246 :: blocked before merge. :: [P1] Preserve development installation on supported Node 25

[steipete]

Thanks for the update. Closing this major upgrade because Vitest 5.0.3 excludes Node 25, which remains supported by this repository. A clean install on Node 25.9.0 with our strict engine policy fails with ERR_PNPM_UNSUPPORTED_ENGINE for vitest@5.0.3.

We will retain Vitest 4.1.11; #52 adds the missing Node 25 CI coverage. This upgrade can be reconsidered when the supported development runtime range changes or Vitest restores compatibility.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.