Skip to content

build(deps-dev): bump the development group with 2 updates - #154

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-084c0aad97
Closed

build(deps-dev): bump the development group with 2 updates#154
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-084c0aad97

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 4, 2026

Copy link
Copy Markdown
Contributor

Bumps the development group with 2 updates: @vitest/coverage-v8 and vitest.

Updates @vitest/coverage-v8 from 5.0.5 to 5.1.0

Release notes

Sourced from @​vitest/coverage-v8's releases.

v5.1.0

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Updates vitest from 5.0.5 to 5.1.0

Release notes

Sourced from vitest's releases.

v5.1.0

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps-dev): bump the development group with 2 updates
fcfc522 
Bumps the development group with 2 updates: [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).


Updates `@vitest/coverage-v8` from 5.0.5 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/coverage-v8)

Updates `vitest` from 5.0.5 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/vitest)

---
updated-dependencies:
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 5.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: vitest
  dependency-version: 5.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner November 4, 2026 17:15
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 4, 2026
@clawsweeper

clawsweeper Bot commented Nov 4, 2026 •
edited
Loading

Copy link
Copy Markdown

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

@clawsweeper clawsweeper Bot added P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Nov 4, 2026
@clawsweeper

clawsweeper Bot commented Nov 4, 2026

Copy link
Copy Markdown

Codex review: needs changes before merge.

What this changes

Updates Vitest and its matching V8 coverage provider from 5.0.5 to 5.1.0 in the pnpm lockfile.

Example: A contributor installs dependencies with pnpm install --frozen-lockfile.

  • Before: Vitest and @vitest/coverage-v8 resolve to 5.0.5.
  • After: Both resolve to 5.1.0.

Review scores

Measure Result What it means
Overall readiness 🦐 gold shrimp (3/6) A focused, validated dependency update with CI evidence and one required changelog correction.
Proof confidence 🦐 gold shrimp (3/6) This Dependabot-authored maintenance PR is outside the ordinary contributor proof gate; current-head CI exercises installation, tests, coverage, package checks, and browser smoke.
Patch quality 🐚 platinum hermit (4/6) 1 actionable review finding remain.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Contributors remain on older test and coverage tooling despite an eligible paired minor release.
Reason: The update follows the configured development dependency group and preserves supported runtimes, package ranges, and the two-day cooldown.

Merge readiness

⛔ Needs changes before merge - 1 item remains

Keep this PR open: main still uses Vitest 5.0.5, and the paired upgrade passes current-head checks; add the required tooling changelog entry before merge.

Priority: P3
Reviewed head: fcfc522b93f03898cfbdb7b2fffc4a4d581a9003

Before merge

  • Add the required Unreleased tooling changelog entry (P3) - This upgrades the test runner and coverage tooling, but the introduced diff contains only the lockfile. AGENTS.md lines 68–69 require an Unreleased entry for operational changes; the previous paired Vitest update and recent development dependency update both document these changes. Add a short entry describing the paired 5.1.0 upgrade so the operational change is recorded.

Findings

  • [P3] Add the required Unreleased tooling changelog entry — pnpm-lock.yaml:25
Agent review details

How this fits together

The development toolchain runs TypeScript tests through Vitest and produces V8 coverage reports; these dependencies are separate from the published terminal runtime.

flowchart LR
  A[pnpm lockfile] --> B[Development installation]
  B --> C[Vitest runner]
  D[TypeScript tests] --> C
  C --> E[V8 coverage provider]
  E --> F[Coverage reports]
Loading

Technical review

Best possible solution:

Land the paired lockfile upgrade with a short Unreleased changelog entry.

Do we have a high-confidence way to reproduce the issue?

This dependency-maintenance PR reports no terminal-runtime bug requiring reproduction.

Is this the best way to solve the issue?

Updating the runner and coverage provider together is appropriately scoped and preserves their exact peer-version relationship.

Full review comments:

  • [P3] Add the required Unreleased tooling changelog entry — pnpm-lock.yaml:25
    This upgrades the test runner and coverage tooling, but the introduced diff contains only the lockfile. AGENTS.md lines 68–69 require an Unreleased entry for operational changes; the previous paired Vitest update and recent development dependency update both document these changes. Add a short entry describing the paired 5.1.0 upgrade so the operational change is recorded.
    Confidence: 0.97

Overall correctness: patch is correct
Overall confidence: 0.96

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against d6167fbc7e0a.

Provenance checked

Testing

Proof path: unit tests only.

Security

None.

Evidence

Acceptance criteria:

  • git diff --check
  • pnpm run format:check

What I checked:

  • Verified introduced change: The pinned diff changes only pnpm-lock.yaml, updating the runner, coverage provider, and their matching transitive dependencies without changing package ranges or runtime exports. (pnpm-lock.yaml:25, fcfc522b93f0)
  • Current main remains on the previous version: GitHub confirms main remains at d6167fb; its lockfile resolves both packages to 5.0.5. (pnpm-lock.yaml:25, d6167fbc7e0a)
  • Applicable changelog requirement: AGENTS.md requires an Unreleased note for operational changes, but this PR contains no changelog entry for the test-toolchain upgrade. (AGENTS.md:68, fcfc522b93f0)
  • Established dependency-update practice: The previous paired Vitest update explicitly included the required Unreleased note in build(deps): refresh test tooling and CodeQL #114; the recent development update build(deps-dev): bump the development group with 3 updates #139 also includes a tooling changelog entry. (CHANGELOG.md, c5e11c32f69b)
  • Checks pass for the reviewed head: All 13 completed checks succeeded, with two dispatch checks skipped; the matrix covers Node 22 and 24 across Linux, macOS, and Windows, plus Node 26 on Linux, and the Node 24 Linux workflow runs coverage. (.github/workflows/ci.yml, fcfc522b93f0)
  • Complete discussion and body inspected: The full body matches supplied SHA-256 15067c7a38778fc95567f8e836c4ebccd5245ed72b0d6446c07be0e2afcfe560; both comments are review-status messages, and there are no submitted reviews or requested reviewers. (fcfc522b93f0)

Labels

Label changes:

  • add P3: This is routine development-tool maintenance with passing checks and a small documentation requirement.
  • add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
  • add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Label justifications:

  • P3: This is routine development-tool maintenance with passing checks and a small documentation requirement.
  • rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
  • status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed November 4, 2026, 12:29 PM ET / 17:29 UTC.

@steipete steipete mentioned this pull request Nov 5, 2026
Merged
steipete added a commit that referenced this pull request Nov 5, 2026
@steipete
build(deps): update Vitest and align tooling ranges
c6e0ca1 
Update Vitest and its V8 coverage provider together to 5.1.0. Align Oxlint and tsdown manifest minimums with the already-qualified versions in the lockfile, retaining the two-day dependency cooldown, pnpm 11 and supported Node.js versions.

Incorporates #154. Vince's Ghostty wrapper investigation (#41) remains separate and untouched.

Independent P0–P2 review is scoped-clean. Linux validation passed: full release check, 186 unit tests, 11 Chromium browser tests, packed-package checks, V8 coverage and pnpm audit (no vulnerabilities). [Remote proof](https://crabbox.openclaw.ai/portal/runs/run_993188a63e2c1d040594fcd40f84b260).
@steipete

steipete commented Nov 5, 2026

Copy link
Copy Markdown
Contributor

Incorporated in #155 and merged after exact-head Linux/macOS/Windows CI, browser smoke and CodeQL passed. Vitest and its coverage provider move together to 5.1.0, with the two-day cooldown and runtime floors preserved. The Linux release check, 186 unit tests, 11 browser tests, coverage and audit also passed.

@steipete steipete closed this Nov 5, 2026
@dependabot @github

dependabot Bot commented on behalf of github Nov 5, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/development-084c0aad97 branch November 5, 2026 08:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@steipete