chore: bump vitest from 4.1.11 to 5.0.3

[dependabot]

Bumps vitest from 4.1.11 to 5.0.3.

Release notes

Sourced from vitest's releases.

v5.0.3

   🐞 Bug Fixes

• Isolate result.status between repeats runs  -  by @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11218 (5dbeb)
• Don't print an interceptor warning in browser mode  -  by @​sheremet-va in vitest-dev/vitest#11377 (15cc0)
• Don't retry when test.fails expectedly failed  -  by @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11219 (b2458)
• Scope cache key generators to projects  -  by @​ecoyoung in vitest-dev/vitest#11281 and vitest-dev/vitest#11301 (92ba7)
• browser:
  • Delay server listen until tests start running  -  by @​sheremet-va in vitest-dev/vitest#11366 (7d8ed)
  • Check mock path boundaries  -  by @​saryn17, Ryosei Sato and @​sheremet-va in vitest-dev/vitest#11361 and vitest-dev/vitest#11362 (1c388)
  • Keep config of browser-consumed environments  -  by @​kasperpeulen and Claude in vitest-dev/vitest#11378 (aafc0)
  • Ignore page crash while cancelling  -  by @​sheremet-va in vitest-dev/vitest#11386 (7c367)
  • toMatchScreenshot uses wrong reference on retried tests  -  by @​macarie in vitest-dev/vitest#11393 (c22ab)
• cache:
  • Revalidate imports of cached modules  -  by @​sheremet-va in vitest-dev/vitest#11381 (38f98)
• deps:
  • Pin why-is-node-running to 3.2.1 to avoid users running into ERR_PNPM_TRUST_DOWNGRADE  -  by @​AriPerkkio in vitest-dev/vitest#11403 (f6c9a)
• expect:
  • Pass current equality testers to expect.extend asymmetric matchers  -  by @​hi-ogawa, Hiroshi Ogawa and Claude in vitest-dev/vitest#11401 (3e794)
• jsdom:
  • Support Blob on jsdom 30.1  -  by @​sheremet-va in vitest-dev/vitest#11379 (6c49b)
• pool:
  • Preserve unique pool ids when groupOrder is set  -  by @​mtorp in vitest-dev/vitest#11392 (50312)
• ui:
  • Split-pane handle overlapping iframe  -  by @​macarie in vitest-dev/vitest#11221 (f91db)
• vitest:
  • Remove root temp dir on close  -  by @​abhinav-phi in vitest-dev/vitest#11248 (7c711)
• vm:
  • Do not optimize deps from index.html  -  by @​ezefernandezyf, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11329 and vitest-dev/vitest#11360 (caf28)
  • Don't reuse scripts across vite environments  -  by @​MO2k4, Martin Oehlert and Claude in vitest-dev/vitest#11395 (346d3)

    View changes on GitHub

v5.0.2

   🐞 Bug Fixes

• Bind process in case global is overwritten  -  by @​AriPerkkio in vitest-dev/vitest#11343 (0b792)
• detect-async-leaks:
  • Ignore process.stdio handles  -  by @​AriPerkkio in vitest-dev/vitest#11333 (0fd6b)
• expect:
  • Fix toMatchObject with asymmetric matchers  -  by @​ShreeBohara, Claude Opus 5, @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-5) in vitest-dev/vitest#11100 (42523)
• jsdom:
  • Fix Request with Blob body on jsdom 28+  -  by @​harshit-d3v in vitest-dev/vitest#11295 (d1c3e)
• reporter:
  • agent to respect --silent  -  by @​Raj4478 and @​AriPerkkio in vitest-dev/vitest#11271 (5b95e)
• reporters:
  • Handle concurrent createReport calls  -  by @​7rulnik in vitest-dev/vitest#11278 (e8e55)
  • hanging-process to use ESM entrypoint  -  by @​AriPerkkio in vitest-dev/vitest#11316 (4e91e)
• spy:
  • Fix stack overflow when spying Set.prototype.add  -  by @​fengmk2 in vitest-dev/vitest#11299 (a0a93)

... (truncated)

Commits

• 33cadea chore: release v5.0.3 (#11409)
• 346d389 fix(vm): don't reuse scripts across vite environments (#11395)
• f6c9a49 fix(deps): pin why-is-node-running to 3.2.1 to avoid users running into `...
• 062c75d chore: fix standalone docs build, update exports maps (#11394)
• caf2887 fix(vm): do not optimize deps from index.html (fix #11329) (#11360)
• 50312eb fix(pool): preserve unique pool ids when groupOrder is set (#11392)
• 7c36748 fix(browser): ignore page crash while cancelling (#11386)
• 92ba7fc fix: scope cache key generators to projects (fix #11281) (#11301)
• 38f9885 fix(cache): revalidate imports of cached modules (#11381)
• b24585f fix: don't retry when test.fails expectedly failed (#11219)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

Claude finished @dependabot[bot]'s task in 2m 46s —— View job

---

Dependency review: vitest 4.1.11 → 5.0.3

• Gather context (diff, config, Node floor)
• Check vitest 5 breaking changes vs. this repo's usage
• Verify Node engine compatibility (engines.node, CI matrix)
• Verify the suite passes (via CI — local install was blocked)
• Post review

Verdict: safe to merge. Major bump, but dev-only, no config to migrate, and CI is green on both Node 22 and 24. One observation worth a follow-up, left inline on package.json.

What changed

A major bump of a devDependency. vitest is not in dependencies and files: ["dist"] excludes everything but build output, so the published package and its consumers are untouched.

The lockfile churn (+209/−280) is almost entirely vitest consolidating its own internals: @vitest/expect, @vitest/runner, @vitest/snapshot, @vitest/utils, @vitest/pretty-format, plus pathe, tinyrainbow, stackback, siginfo all drop out of the tree. Nothing in this repo imports any of them — the only vitest import anywhere is from "vitest" in test/.

vite went from 8.2.2 → 8.3.2, not a new major: vitest 4.1.11 already resolved vite 8.

Risks checked

1. Node floor — the one thing worth noting. vitest 5 requires ^22.12.0 || ^24.0.0 || >=26.0.0; the repo declares >=22. Node 22.0–22.11 now falls outside what vitest accepts, and Node 23/25 are excluded outright where vitest 4 allowed them (it inherited vite's looser ^20.19.0 || >=22.12.0). CI's ['22', '24'] resolves to latest minors, so it's unaffected. Details and my recommendation (don't touch engines.node; a CONTRIBUTING.md note is the cheaper fix) are in the inline comment.

2. vite moved from dependency to required peer. In 4.1.11 vitest depended on vite directly. In 5.0.3 it's peerDependencies.vite: "^6.4.0 || ^7.0.0 || ^8.0.0" with "optional": false. npm auto-installs peers and the lockfile pins vite 8.3.2 with "peer": true, so npm ci works — this only becomes a problem if the project ever moves to pnpm with strict peers, where vite would need an explicit devDependencies entry.

3. No config to migrate. There is no vitest.config.* or vite.config.* in the repo (git ls-files confirms), so the suite runs on defaults and no renamed or removed options apply. The scripts are plain vitest run / vitest.

4. Test APIs in use are all stable in v5. Across test/: vi.fn (28×), vi.spyOn, vi.stubGlobal, mockReset, it.each, expect.anything / objectContaining / stringContaining, toMatchObject. None were removed or renamed.

One thing to be aware of rather than act on: v5.0.2 changed how toMatchObject handles asymmetric matchers (vitest-dev/vitest#11100). test/client/kosli-client.test.ts:138 is exactly that shape —

expect(result).toMatchObject({ error: true, message: expect.stringContaining("Missing required path parameter: org") });

— and it still passes, so this is informational. It's a load-bearing assertion for the no-configured-org invariant in CLAUDE.md, so it's the first place to look if a future vitest patch shifts matcher semantics again.

5. chai 6 under the hood. vitest 5 swaps its assertion engine to chai ^6. No file imports chai directly and the suite uses only the Jest-compatible expect, so there's no exposure to chai's own breaking changes.

Verification

CI run 37269184701 is green on both matrix legs — test (node 22) and test (node 24), no failed steps. That covers build, the full suite, and the .mcpb smoke test.

I could not run npm ci / npm test in this job — the sandbox declined the install — so the pass is CI's, not a local reproduction. Given CI exercises the same lockfile on both supported Node majors, I don't think a local run would add anything.

Suggested follow-up

Optional, not blocking: add a development-requires-Node-≥22.12 line to CONTRIBUTING.md, since engines.node: ">=22" no longer tells a contributor what they need to run the tests. Fix this →

--- · branch dependabot/npm_and_yarn/vitest-5.0.3

[claude]

vitest 5 declares engines.node: "^22.12.0 || ^24.0.0 || >=26.0.0", while this repo declares >=22. Two consequences, both dev-only:

• Node 22.0–22.11 satisfies the repo's floor but not vitest's → npm ci/npm test will warn EBADENGINE and may not run for a contributor on an early 22.x.
• vitest 5 also excludes Node 23 and 25. vitest 4 pulled vite in directly, inheriting ^20.19.0 || >=22.12.0, which allowed the odd-numbered lines.

CI is unaffected — node-version: ['22', '24'] resolves to the latest minor. And engines.node in package.json describes the published runtime, which vitest (a devDependency, excluded by files: ["dist"]) doesn't constrain, so per CLAUDE.md's "raising the Node floor moves six things together" rule I would not change it here. If anything, a line in CONTRIBUTING.md noting that development needs ≥22.12 is the cheaper fix.