build(deps-dev): bump vitest from 4.1.11 to 5.0.4

[dependabot]

Bumps vitest from 4.1.11 to 5.0.4.

Release notes

Sourced from vitest's releases.

v5.0.4

   🚀 Features

• experimental:
  • Tag cache directories with CACHEDIR.TAG  -  by @​lifeiscontent in vitest-dev/vitest#11461 (a8ea3)
  • Support test.ui.theme option  -  by @​sheremet-va in vitest-dev/vitest#11499 (1da66)
  • Highlight selector multiple matches in trace view  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11489 (5abba)
  • Print how many tests were affected and a total when running --changed  -  by @​sheremet-va in vitest-dev/vitest#11424 (a2336)
  • Add an option to cache dependencies instead of statically parsing them  -  by @​sheremet-va in vitest-dev/vitest#11515 (c0601)
  • Add fit and zoom controls to trace viewer  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11490 (f5dd9)

   🐞 Bug Fixes

• Fail the run on git and location filter errors  -  by @​sheremet-va in vitest-dev/vitest#11430 (30d03)
• Enable fsModuleCache by default  -  by @​sheremet-va in vitest-dev/vitest#11435 (ad208)
• Track project files and mocks with --changed  -  by @​sheremet-va in vitest-dev/vitest#11432 (b0f2b)
• Refactor caching, fix : in project and change the shape of results cache  -  by @​sheremet-va in vitest-dev/vitest#11453 (9673c)
• Keep full $ string values when taskTitleValueFormatTruncate is 0  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11485 (4f7e1)
• Resolve node builtins in client environments  -  by @​sheremet-va in vitest-dev/vitest#11417 (56b31)
• Fix module graph builtin externals after #11421  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11491 and vitest-dev/vitest#11421 (008e1)
• Wrap module mocks during in-source testing  -  by @​sheremet-va in vitest-dev/vitest#11505 (36d19)
• Handle line endings in snapshot  -  by @​sheremet-va in vitest-dev/vitest#11522 (4c468)
• Respect root in projects  -  by @​sheremet-va in vitest-dev/vitest#11521 (26642)
• Resolve mocks in directories with spaces  -  by @​sheremet-va in vitest-dev/vitest#11539 (caaef)
• api:
  • Publish the api token atomically  -  by @​umairnawaz333 in vitest-dev/vitest#11323 (6f990)
• browser:
  • Close the mock route interception race  -  by @​cplieger and @​sheremet-va in vitest-dev/vitest#8339 and vitest-dev/vitest#11083 (d6620)
  • Allow toHaveTextContent without arguments  -  by @​nomadical in vitest-dev/vitest#11425 (8ebcf)
  • Apply API options without browser config  -  by @​sheremet-va in vitest-dev/vitest#10852 (ad055)
  • Preserve undefined command arguments  -  by @​sheremet-va and @​AriPerkkio in vitest-dev/vitest#11497 (1576d)
  • Wait for setup mocks before importing a test file  -  by @​kasperpeulen in vitest-dev/vitest#11520 (b61d1)
  • Avoid extra scroll outside the iframe  -  by @​sheremet-va in vitest-dev/vitest#11523 (662e8)
  • Run browser instances as workers  -  by @​sheremet-va in vitest-dev/vitest#11525 (bf04b)
    • ⚠️ This can degrade performance if you have a custom maxWorkers setting. Previously, it was applied incorrectly and could lead to Vitest using too many resources. For example, a lower number would still open too many browsers. Fixing it means Vitest opens less instances by default now.
  • Open one cdp session per tester  -  by @​sheremet-va in vitest-dev/vitest#11542 (69e63)
  • Clean up unmocked and pending mocks  -  by @​sheremet-va in vitest-dev/vitest#11537 (5c955)
• coverage:
  • V8 browser memory leak between test files  -  by @​AriPerkkio in vitest-dev/vitest#11466 (2297d)
  • allowExternal fails to include uncovered files  -  by @​AriPerkkio in vitest-dev/vitest#11513 (4ef00)
  • Filenames containing brackets incorrectly showing as uncovered  -  by @​AriPerkkio in vitest-dev/vitest#11531 (0fa80)
  • Istanbul coverage wrong when module transform warmups  -  by @​AriPerkkio in vitest-dev/vitest#11529 (9f61d)
• deps:
  • Update all non-major dependencies  -  by @​sheremet-va in vitest-dev/vitest#11167 (c74e0)
• expect:
  • Fix Map and Set deep equality in some assertions  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11402 (b4e79)
  • Check value in chai-style returned  -  by @​sheremet-va in vitest-dev/vitest#11500 (1aca0)
• mocker:
  • Fix native loader mocking edge cases  -  by @​sheremet-va in vitest-dev/vitest#11540 (cd423)
• pretty-format:

... (truncated)

Commits

• 6a11cf6 chore: release v5.0.4 (#11554)
• 58c86ed chore(deps): update all non-major dependencies (#11550)
• 0fa80f5 fix(coverage): filenames containing brackets incorrectly showing as uncovered...
• bf04b9c fix(browser): run browser instances as workers (#11525)
• 3e3624c refactor: resolve maxWorkers once in config (#11524)
• 26642f7 fix: respect root in projects (#11521)
• c06012a feat(experimental): add an option to cache dependencies instead of statically...
• 4ef000a fix(coverage): allowExternal fails to include uncovered files (#11513)
• 1da6640 feat: support test.ui.theme option (#11499)
• b618afd fix(vm): bind this to module.exports (#11504)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge.

What this changes

This PR upgrades the development test runner from Vitest 4.1.11 to 5.0.4 and refreshes its locked dependencies.

Example: A contributor installs development dependencies on Node 25.9.0 with strict engine checks enabled.

• Before: Vitest 4.1.11 permits Node 25, and the current main Node 25 installation check passes.
• After: Vitest 5.0.4 excludes Node 25, so installation fails before package checks run.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The upgrade breaks an explicitly supported development runtime and contradicts the recorded compatibility decision.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot development-dependency PR is outside the ordinary contributor proof gate; CI provides supporting validation but exposes the Node 25 installation failure.
Patch quality	🧂 unranked krab (1/6)	1 actionable review finding remain.

Product

Kind: Maintenance · Worth it: No
User problem: Contributors receive a newer test runner, but the update prevents supported Node 25 development installs.
Reason: The recorded owner direction preserves Node 25 support and defers Vitest 5; this release retains the incompatible engine requirement.

Regression provenance

Possible regression — suspected (reviewed change). No predecessor PR is attributed.

Merge readiness

⛔ Blocked before merge - 3 items remain

This PR breaks supported Node 25 development installs and contradicts the recorded decision to retain Vitest 4; repository policy does not permit automatic closure for this reason.

Priority: P2
Reviewed head: 657322c312f7f8fcaefbaebf1e095efe8d46b813

Before merge

• [P1] Preserve Node 25 compatibility when updating Vitest (P1) - Vitest 5.0.4 declares Node ^22.12.0 || ^24.0.0 || >=26.0.0, excluding Node 25, while this package declares ^22.18.0 || >=24.11.0 and enables engineStrict. Consequently, a supported Node 25 development install fails before any package checks; the exact-head Node 25 CI job already fails at Install dependencies, whereas current main passes. Retain Vitest 4.1.11 and its compatible lockfile graph rather than disabling engine checks or removing the Node 25 lane; the same compatibility decision is recorded in build(deps): refresh Node types and cover Node 25 installs #52.
• Product: not worth merging - The recorded owner direction preserves Node 25 support and defers Vitest 5; this release retains the incompatible engine requirement.
• Explain or restore the original intent of Vitest version and development-runtime compatibility - 8ddc83a: The tooling refresh adopted Vitest 4.1.11; later merged build(deps): refresh Node types and cover Node 25 installs #52 and build(deps): refresh compatible tooling and Node setup #55 deliberately retained it to preserve Node 25 installs.

Findings

• [P1] [P1] Preserve Node 25 compatibility when updating Vitest — package.json:59

Provenance

• Vitest version and development-runtime compatibility changes intended behavior without addressing why it exists (8ddc83a: The tooling refresh adopted Vitest 4.1.11; later merged build(deps): refresh Node types and cover Node 25 installs #52 and build(deps): refresh compatible tooling and Node setup #55 deliberately retained it to preserve Node 25 installs.)

Tests

• Missing end-to-end proof: The Node 25 lane fails before tests run, so successful validation covers only the Node 22 and 24 lanes.

Agent review details

How this fits together

Vitest runs the router's development tests through pnpm; its dependency engine requirements are enforced during installation before CI can build, test, and validate the package.

flowchart TD
  A[Contributor or CI] --> B[pnpm frozen installation]
  B --> C[Strict engine validation]
  C --> D[Vitest dependency graph]
  D --> E[Router behavior tests]
  E --> F[Package quality gate]

Loading

Technical review

Best possible solution:

Retain Vitest 4.1.11 until an upgrade supports the existing Node range or a separate approved change revises that contract.

Do we have a high-confidence way to reproduce the issue?

The locked Vitest engine range excludes Node 25 under engineStrict, and the exact-head Node 25 job fails during installation while current main passes; no target code was executed during this review.

Is this the best way to solve the issue?

The proposed upgrade conflicts with the established compatibility contract and the explicit deferral recorded in #52 and #55.

Full review comments:

• [P1] [P1] Preserve Node 25 compatibility when updating Vitest — package.json:59
  Vitest 5.0.4 declares Node ^22.12.0 || ^24.0.0 || >=26.0.0, excluding Node 25, while this package declares ^22.18.0 || >=24.11.0 and enables engineStrict. Consequently, a supported Node 25 development install fails before any package checks; the exact-head Node 25 CI job already fails at Install dependencies, whereas current main passes. Retain Vitest 4.1.11 and its compatible lockfile graph rather than disabling engine checks or removing the Node 25 lane; the same compatibility decision is recorded in build(deps): refresh Node types and cover Node 25 installs #52.
  Confidence: 1

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 251c5f19a107.

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Introduced compatibility failure: The pinned introduction diff changes Vitest to ^5.0.4; its locked engine range is ^22.12.0 || ^24.0.0 || >=26.0.0, excluding Node 25. (pnpm-lock.yaml:1218, 657322c312f7)
• Existing development contract: The package permits Node ^22.18.0 || >=24.11.0, pnpm-workspace.yaml enables engineStrict, and CI explicitly installs dependencies on Node 25. (package.json:62, 657322c312f7)
• Head failure and passing main baseline: The exact-head Node 25 job fails at Install dependencies and skips Check: https://github.com/openclaw/uirouter/actions/runs/38640630151/job/116114923300. The corresponding current-main job succeeds: https://github.com/openclaw/uirouter/actions/runs/38514120090/job/115688959761. Raw head logs redirect to a blocked artifact host; the engine mismatch is independently established by the source. (657322c312f7)
• Recorded owner direction: In build(deps-dev): bump vitest from 4.1.11 to 5.0.3 #51 (comment), steipete explicitly retained Vitest 4.1.11 because Vitest 5 excludes supported Node 25; merged build(deps): refresh Node types and cover Node 25 installs #52 added coverage, and merged build(deps): refresh compatible tooling and Node setup #55 reiterated deferral of Vitest 5. (.github/workflows/ci.yml:46, 01c7a1b96886)
• Feature history and provenance: The test script appears in commit 409c838; commit 8ddc83a updated Vitest to 4.1.11, while subsequent tooling work deliberately preserved Node 25 compatibility. Some older blobs are unavailable locally; current blobs and GitHub PR discussions establish the relevant intent. (package.json:59, 8ddc83ae3c76)
• Upgrade remains absent from main: The default branch is main at the supplied base SHA, where package.json still declares Vitest ^4.1.11; this upgrade is not already implemented. (package.json:59, 251c5f19a107)

Labels

Label changes:

• add P2: This development-tooling upgrade blocks supported contributor installations but does not change the published router runtime.
• add merge-risk: 🚨 compatibility: Vitest 5.0.4 rejects Node 25 despite the repository explicitly supporting that development runtime.
• add merge-risk: 🚨 automation: The changed dependency graph causes the existing Node 25 CI installation step to fail before package validation.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Label justifications:

• P2: This development-tooling upgrade blocks supported contributor installations but does not change the published router runtime.
• merge-risk: 🚨 compatibility: Vitest 5.0.4 rejects Node 25 despite the repository explicitly supporting that development runtime.
• merge-risk: 🚨 automation: The changed dependency graph causes the existing Node 25 CI installation step to fail before package validation.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 14, 2026, 5:42 PM ET / 21:42 UTC.

[vincentkoc]

Closing this repeated incompatible major upgrade at reviewed head 657322c312f7f8fcaefbaebf1e095efe8d46b813. Current main still supports and tests Node 25 with strict engine checks. vitest@5.0.4 requires ^22.12.0 || ^24.0.0 || >=26.0.0, excluding Node 25; the exact-head installation fails: https://github.com/openclaw/uirouter/actions/runs/38640630151/job/116114923300.

This follows the explicit maintainer decision to retain Vitest 4.1.11 while Node 25 is supported: #51 (comment). Reconsider when Vitest restores that compatibility or the repository deliberately changes its runtime contract. No engine enforcement or Node coverage is being removed. Thanks to Dependabot for the update.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.