build(deps-dev): bump vitest from 4.1.10 to 4.1.11 - #1134
Conversation
Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 4.1.10 to 4.1.11. - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) --- updated-dependencies: - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| "typescript-eslint": "^8.63.0", | ||
| "vite": "^8.1.4", | ||
| "vitest": "^4.1.10" | ||
| "vitest": "^4.1.11" |
There was a problem hiding this comment.
📝 Info: Coverage versions remain aligned
The unchanged @vitest/coverage-v8 range admits 4.1.11. The lockfile resolves runner and provider 4.1.11 together in both workspaces.
Was this helpful? React with 👍 or 👎 to provide feedback.
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
현재 exact head 770db9b73e53e191dc7d3e89e1dcce9fe1e512ce는 병합할 수 없습니다. ci / build-and-test의 실제 checkout에서 Vitest 4.1.11 자체와 236개 JS/TS 테스트는 통과하고 100% coverage도 유지되지만, 생성된 package-lock.json이 root node_modules/@esbuild/*의 peer: true 메타데이터를 제거해 저장소의 canonical npm/lock provenance 계약을 깨뜨립니다. 그 결과 test_lock_records_match_exact_registry_artifacts_and_preserve_peer_metadata와 test_root_lock_preserves_esbuild_peer_metadata가 실패합니다. 이 계약은 #896에서도 complete npm 10.9.9 lock generation이 보존해야 할 명시적 prerequisite입니다. 테스트를 완화하거나 lock을 수동 편집하지 말고, 현재 protected develop ancestry 위에서 repository-canonical npm 10.9.9로 전체 lock을 재생성한 뒤 frozen npm ci, 두 lock/provenance regression, full quickcheck를 같은 exact head에서 다시 통과시켜 주세요.
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact head 770db9b73e53e191dc7d3e89e1dcce9fe1e512ce has a verified lock-provenance RED. ci run 33589608944 / job 100267513514 verifies npm 10.9.9 with bundled tar 7.5.22, installs and runs Vitest 4.1.11 successfully (216 desktop tests + 20 shared-types tests, 100% measured frontend coverage), then fails only the two repository lock contracts that require root node_modules/@esbuild/* records to retain peer: true; the first reported missing record is node_modules/@esbuild/aix-ppc64.
So Vitest 4.1.11 itself is not rejected by current execution evidence, but this generated root lock is. Preserve the unique Vitest 4.1.11 delta and route the complete lock repair through canonical owner #896 (or a verified successor) with the repository-approved npm 10.9.9 generator. Do not hand-edit the lock, weaken the provenance tests, or close this PR until the version delta and its full generated dependency graph are verifiably integrated elsewhere.
1 participant
Bumps vitest from 4.1.10 to 4.1.11.
Release notes
Sourced from vitest's releases.
Commits
9bd8d46chore: release v4.1.11 (#10995)9851dbcfix(browser): trigger playwright/chromium gc on lower disk availability [back...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)