Repository navigation
chore(deps): update vitest monorepo to v5 - #35
renovate[bot] wants to merge 1 commit into
Conversation
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
df3966f to
daaef67
Compare
69e46ff to
34e10c7
Compare
11bce6e to
2b26f5d
Compare
3a284c5 to
8ad4ba6
Compare
12e4a3b to
029af58
Compare
6d3e731 to
8af1f60
Compare
timoa
left a comment
timoa
left a comment
There was a problem hiding this comment.
DevSecOps daily sweep flagged this PR as awaiting-human review.
Reason: major version bump. Even with green CI, major bumps can introduce breaking API changes, behavior shifts, or require code edits downstream of the lockfile. No autopilot approve or merge.
Please review the release notes and changelog before merging.
|
CI gate failure: |
|
🤖 DevSecOps sweep: |
|
Renovate daily sweep (TIM-380): blocked on CI. Major bump |
|
CI gate failure: |
timoa
left a comment
timoa
left a comment
There was a problem hiding this comment.
Renovate vitest monorepo 3.2.6 → 5.0.1 (@vitest/coverage-v8 + vitest). Semver major (v3 → v5). CI: 'Lint, Test, Build & Security' FAILURE. No labels. Major bump + red CI → human review required, no auto-merge.
|
DevSecOps daily sweep (TIM-397): CI gate failing — |
|
Skipped: Lint, Test, Build & Security check failed on this run (2026-10-05). vitest monorepo 3.2.6→5.0.1 (MAJOR semver; v5 requires Node 22 + Vite 6.4, breaking changes). Renovate labels missing so no risk-tier. Awaiting CI fix before auto-merge can be re-evaluated. — DevSecOps autopilot (TIM-400) |
|
DevSecOps daily sweep: skipping auto-merge. 'Lint, Test, Build & Security' check is FAILURE. Major bump of vitest monorepo 3.2.6 → 5.0.1 (vitest + @vitest/coverage-v8). Please address the lint/test/build failure, confirm major-version impact, and merge manually. No hard exclusions. |
|
Renovate daily sweep 2026-10-08: blocked. |
timoa
left a comment
timoa
left a comment
There was a problem hiding this comment.
DevSecOps daily sweep (TIM-409). No security/patch Renovate label → not eligible for auto-merge.
Scope: package.json + pnpm-lock.yaml. vitest monorepo 3.2.6 → 5.0.1 (major — both vitest and @vitest/coverage-v8).
CI: Lint, Test, Build & Security failed (run 37357752536). Other checks green.
Action: rebase + re-run. Major monorepo bump — v5 has plugin API changes; careful review needed even if CI goes green.
|
Daily Renovate sweep 2026-10-12: |
|
Daily Renovate sweep (TIM-419): |
|
Renovate autopilot: required check 'Lint, Test, Build & Security' FAILED in latest run (2026-10-13). Blocking auto-merge — please fix CI before re-running the daily Renovate sweep. |
|
🤖 DevSecOps daily sweep (TIM-430, 2026-10-15). CI gate failure — not auto-merging. Skipping until the Lint/Test/Build pipeline is green. Major-version bump (vitest monorepo 3 → 5, including No diff touches |
|
Renovate daily sweep (TIM-432) — skipping this PR. CI gate not green:
Diff: This PR cannot be auto-merged. A Vitest 3 → 5 jump is significant; @dev please verify the test pipeline against v5 (browser/isolate/result.status changes), or close and re-open with a smaller bump. |
|
Renovate daily review — CI blocked: |
|
DevSecOps daily sweep (TIM-445, 2026-10-19): skipped-blocked. |
|
DevSecOps sweep: skipping. Major vitest monorepo bump (3.2.6 → 5.0.3) and |
|
DevSecOps daily sweep: 'Lint, Test, Build & Security' check FAILURE (run 38564183724). Major bump (vitest v3→v5) needs human review. Skipping auto-merge. |
|
DevSecOps daily sweep — blocked. Major bump of the |
|
Renovate sweep 2026-10-24 — CI gate failure, not merged.
This is a major bump of the whole vitest monorepo, so it needs a human to run the migration and confirm the suite passes. It should be prioritised ahead of the other PRs in this repo. |
|
DevSecOps Renovate sweep 2026-10-25 — skipped-blocked — and worth a human's attention.
This is very likely the fix for the rest of the backlog. The failure on the other PRs is osv-scanner reporting 2 critical Not merged — a human should drive this one, since landing it should unblock #87, #94, #76, #77 and others. Full sweep report: TIM-461. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #35 +/- ##
=======================================
Coverage 92.71% 92.71%
=======================================
Files 6 6
Lines 741 741
Branches 227 235 +8
=======================================
Hits 687 687
Misses 54 54 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
DevSecOps Renovate sweep 2026-10-26 — skipped-blocked.
Not merged anyway: Worth a human's attention though — this PR is the likely fix for the rest of the backlog. vitest 5 pulls Full sweep report: TIM-464. |
timoa
left a comment
timoa
left a comment
There was a problem hiding this comment.
DevSecOps Renovate sweep 2026-10-27 — CI now fully green, awaiting human approval.
vitest 4.1.12 → 5.0.4 (major), with @vitest/coverage-v8 4.1.12 → 5.0.4 alongside it. Files touched: package.json + pnpm-lock.yaml only.
The 2026-10-26 sweep blocked this PR on a CodeQL-Build runner flake (ECONNREFUSED to github.com:443). That check has since passed and every check on the rollup is now SUCCESS, including the required Lint, Test, Build & Security — so the osv-scanner step that was reddening this repo's lint job is clean on this branch.
Supply-chain review of the full lockfile delta:
- New packages:
obug@3.0.0,expect-type@1.4.0,why-is-node-running@3.2.1,tinybench@6.2.2— all resolved fromregistry.npmjs.org, none withhasInstallScript. obugis the renameddebugpackage (same author, same lineage) pulled in by the newtinybench;tinybenchitself jumps 2.9.0 → 6.2.2.- Dropped by vitest 5: the istanbul coverage chain (
istanbul-lib-coverage,istanbul-lib-report,istanbul-reports,make-dir,convert-source-map,html-escaper,siginfo,stackback). viteis not bumped directly; its peer range widens to^6.4.0 || ^7.0.0 || ^8.0.0and resolves against thevite@8.3.5already in the tree.
Not auto-merged. Major bump and no security/patch Renovate label (no labelRules in .github/renovate.json), so it is outside this sweep's auto-merge tier. Needs 1 code-owner approval (@timoa per CODEOWNERS) to land — the Main ruleset requires 1 code-owner review plus the strict Lint, Test, Build & Security check. This is the most valuable PR in the current Renovate backlog: it is the one the last three sweeps have pointed at, and it is now green.
|
DevSecOps Renovate sweep 2026-10-28 — awaiting-human (CI is now fully green). The Not auto-merged: This PR is the unblocker for the rest of the workflow-metrics backlog — most other PRs in the repo are red on the vitest 4 -> 5 upgrade path. Recommend a human approve and merge it. Full sweep report: TIM-470. |
timoa
left a comment
timoa
left a comment
There was a problem hiding this comment.
Renovate daily sweep (2026-10-30) — major tier, human approval needed. Not auto-merged.
Diff scope: package.json + pnpm-lock.yaml only. vitest 4.1.12 → 5.0.5 and @vitest/coverage-v8 4.1.12 → 5.0.5.
State changed since the 2026-10-29 sweep: Renovate rebased this branch on 2026-10-29T16:24Z (head ba800b11, vitest 5.0.4 → 5.0.5) and CI re-ran clean — 10/10 checks green, required check Lint, Test, Build & Security SUCCESS, dependency-review SUCCESS, CodeQL-Build SUCCESS.
Supply-chain check on the packages this bump adds to the lockfile: expect-type@1.4.0, obug@3.0.0 (the debug fork), tinybench@6.2.2, why-is-node-running@3.2.1, vitest@5.0.5 — all on the public npm registry, no install scripts, no new registry, no typosquat signature.
Why it is not auto-merged: Vitest 5 is a major release (Vite 8 peer, Node ≥ 20, breaking changes to test APIs/config/coverage). That is above this sweep's auto-merge threshold (security / patch only). Note this repo's renovate.json applies no label rules, so tier was derived from the manifest diff.
Context: this PR is the unblocker for the other open workflow-metrics dependency PRs, which sit behind the Vitest 4 → 5 upgrade path.
Asks: a human to approve and squash-merge. If the Vitest 5 test run is green in a local/CI pass, approving is the intended action.
timoa
left a comment
timoa
left a comment
There was a problem hiding this comment.
DevSecOps Renovate sweep 2026-11-05 — awaiting-human. Correction: this PR is not a security unblocker.
Head ba800b11, unchanged. CI still fully green (Lint, Test, Build & Security SUCCESS, 10/10 checks). Diff scope: package.json + pnpm-lock.yaml only. vitest 4.1.12 → 5.0.5 and @vitest/coverage-v8 4.1.12 → 5.0.5.
Correction. Earlier sweeps described this PR as the fix for the tinypool advisories. That is wrong, and it matters because it can make a major bump look like a security patch:
tinypooldoes not appear in this repo's lockfile at all —grep -c tinypool pnpm-lock.yaml= 0 on bothmainand this head. The tinypool GHSAs affect only thetinypoolpackage, so no tinypool advisory is reachable from this tree.vitest4.1.12 is already above the patched floor of every publishedvitestadvisory, and 5.0.5 is outside allvitestranges.@vitest/mocker4.1.12 and 5.0.5 are both above their advisory floors (4.1.12 and 5.0.3).
So this is a plain major test-runner upgrade. Nothing in the tree is being patched by it, and there is no security urgency attached to it.
Supply-chain check on what the bump adds to the lockfile — expect-type@1.4.0, obug@3.0.0, tinybench@6.2.2, vitest@5.0.5, @vitest/coverage-v8@5.0.5, @vitest/istanbul-lib-coverage@1.0.2, @vitest/istanbul-lib-report@1.0.2, @vitest/mocker@5.0.5, @vitest/spy@5.0.5, why-is-node-running@3.2.1: all resolved from registry.npmjs.org, no postinstall/requiresBuild markers, no unfamiliar registry, no typosquats. Removed: 21 packages, all superseded test-runner internals.
Recommendation: merge is a human decision (major tier). It carries no security urgency — do not merge it as a security fix.
Human approval needed. Full sweep report: TIM-480.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
4.1.12→5.0.54.1.12→5.0.5Release Notes
vitest-dev/vitest (@vitest/coverage-v8)
v5.0.5Compare Source
🐞 Bug Fixes
fs.denywith api token file - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #11578 (28dc1)--changed- by @sheremet-va in #11583 (14921)datato theimport.meta.hotstub - by @sheremet-va in #11590 (3a828)skipinskipIf, ignoreundefinedoptions - by @sheremet-va in #11591 (d523a)&#​39;failed&#​39;on worker crash - by @AriPerkkio in #11568 (6ae8e)View changes on GitHub
v5.0.4Compare Source
🚀 Features
test.ui.themeoption - by @sheremet-va in #11499 (1da66)--changed- by @sheremet-va in #11424 (a2336)🐞 Bug Fixes
:in project and change the shape ofresultscache - by @sheremet-va in #11453 (9673c)$string values whentaskTitleValueFormatTruncateis 0 - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #11485 (4f7e1)maxWorkerssetting. Previously, it was applied incorrectly and could lead to Vitest using too many resources. For example, a lower number would still open too many browsers. Fixing it means Vitest opens less instances by default now.allowExternalfails to include uncovered files - by @AriPerkkio in #11513 (4ef00)MapandSetdeep equality in some assertions - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #11402 (b4e79)thistomodule.exports- by @sheremet-va in #11504 (b618a)🏎 Performance
View changes on GitHub
v5.0.3Compare Source
🐞 Bug Fixes
result.statusbetweenrepeatsruns - by @hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in #11218 (5dbeb)test.failsexpectedly failed - by @hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in #11219 (b2458)listenuntil tests start running - by @sheremet-va in #11366 (7d8ed)toMatchScreenshotuses wrong reference on retried tests - by @macarie in #11393 (c22ab)why-is-node-runningto3.2.1to avoid users running intoERR_PNPM_TRUST_DOWNGRADE- by @AriPerkkio in #11403 (f6c9a)expect.extendasymmetric matchers - by @hi-ogawa, Hiroshi Ogawa and Claude in #11401 (3e794)groupOrderis set - by @mtorp in #11392 (50312)View changes on GitHub
v5.0.2Compare Source
🐞 Bug Fixes
processin case global is overwritten - by @AriPerkkio in #11343 (0b792)process.stdiohandles - by @AriPerkkio in #11333 (0fd6b)toMatchObjectwith asymmetric matchers - by @ShreeBohara, Claude Opus 5, @hi-ogawa, Hiroshi Ogawa and Codex (GPT-5) in #11100 (42523)RequestwithBlobbody on jsdom 28+ - by @harshit-d3v in #11295 (d1c3e)agentto respect--silent- by @Raj4478 and @AriPerkkio in #11271 (5b95e)createReportcalls - by @7rulnik in #11278 (e8e55)hanging-processto use ESM entrypoint - by @AriPerkkio in #11316 (4e91e)Set.prototype.add- by @fengmk2 in #11299 (a0a93)View changes on GitHub
v5.0.1Compare Source
🚀 Features
🐞 Bug Fixes
extends- by @sheremet-va in #11034 (23dda)deps.optimizer.webis used - by @im10furry in #11214 (2ce29)config.define- by @sheremet-va in #11198 (972e2)toMatchAriaSnapshot- by @sheremet-va in #11208 (c119b)queueMicrotaskandnextTickintoNotFake- by @kingmakeruix, kingmakeruix, Hiroshi Ogawa, Codex and @hi-ogawa in #11261 (a47d7)deepMergeto handle prototype - by @hi-ogawa, Hiroshi Ogawa and Codex in #11215 (4944c)View changes on GitHub
v5.0.0Compare Source
Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.
🚨 Breaking Changes
loupe.inspectwith pretty-format - by @hi-ogawa, Claude Opus 5 (1M context) and OpenAI Codex in #9609 (3f802)test.for/eachtitle$variable (take 2) - by @hi-ogawa in #10170 (04d37)attachmentsDirfrom.vitest-attachements/to.vitest/attachments/- by @MdSadiqMd in #10186 (1ba73)sequentialtest/suite options in favor ofconcurrent- by @hi-ogawa and OpenAI Codex in #10198 (9229f)expectpackage - by @sheremet-va in #10221 (ad162)expect.pollwhen function didn't resolve in time - by @hi-ogawa and OpenAI Codex in #10233 (4df04)toHaveTextContentis strict, addtoMatchTextContentas alternative - by @sheremet-va in #10473 (18f30)@vitest/runnerpackage, do not publish it anymore - by @sheremet-va in #10511 (6d6e4)concurrencyId/workerIdon TestModule's diagnostics, make id 1-based - by @sheremet-va in #10516 (bdd98)screenshotDirectoryconfig tobrowser.expect.toMatchScreenshot- by @macarie in #10592 (a60de)@sinonjs/fake-timersand support mockingTemporal- by @hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #10654 (f8b15)>as separator in-t, calculateonlyonce - by @sheremet-va in #10686 (a0b20)locators.exactby default - by @sheremet-va in #10430 (e2032)sessionIdfor orchestrator html request - by @hi-ogawa, Hiroshi Ogawa and OpenAI Codex in #10522 (79b7d)attachmentsDir- by @macarie in #10917 (3b5bb)include/excludeglobs too eager - by @AriPerkkio in #9818 (edacb)thresholds.perFileto accept an object - by @vladlenskiy and @AriPerkkio in #10190 (13b78)toThrow("")behavior by reverting #6710 - by @hi-ogawa in #9643 and #6710 (6c3e4)blobreporter and--merge-reportsdefault to.vitest/blob/- by @AriPerkkio in #10232 (d22b0).vitestby default - by @hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and @AriPerkkio in #10621 (58577).vitest- by @hi-ogawa and Hiroshi Ogawa in #10620 (29c36)🚀 Features
createReportand.vitestreport directory convention - by @AriPerkkio in #9993 (72a6d)configDefaults.reporters- by @hi-ogawa and Claude Opus 5 (1M context) in #10219 (083f6)logger.formatError- by @hi-ogawa and OpenAI Codex in #10268 (2c5f3)injectCjsGlobalsoption - by @sheremet-va in #10709 (82671)for/eachtitle placeholders - by @k-yle in #10773 (15e0a)ToMatchScreenshotResolvePath- by @macarie and @sheremet-va in #10138 (16654)kindinpage.mark- by @AriPerkkio in #10302 (053e8)context.markfor custom command tracing - by @AriPerkkio in #10329 (aa514)--repeatsCLI option - byConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.