Repository navigation
build(deps-dev): bump vitest to 5.0.5 - #449
Conversation
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N2vvE5XzurMvQfsX7Vz7bF
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
I reviewed this vitest bump and didn't find any bugs. CODEOWNERS assigns every path in this repo to the releases working group, so one of its members should still take a look.
What was reviewed:
- The package.json range (^5.0.5) matches the workspace entry and the resolved vitest 5.0.5 entry in yarn.lock.
- @ vitest/mocker and @ vitest/spy moved to 5.0.5 along with vitest's transitive ranges. obug 3.x is only used by vitest. siginfo and stackback have no other users, so removing them is safe.
- The split tinyexec entry is consistent: ^1.3.0 still resolves to 1.3.0 for its other users, and vitest's ^1.3.1 resolves to 1.3.1.
Extended reasoning...
The change touches only package.json and yarn.lock. It bumps vitest, a dev/test dependency, from ^5.0.1 to ^5.0.5 and updates its transitive dependencies, including major-version moves for obug and why-is-node-running. No application source changes and no runtime security surface (auth, injection, data exposure) are involved. The lockfile entries are internally consistent with package.json. I'm deferring rather than approving because .github/CODEOWNERS assigns all paths to the releases working group.
Resolve the yarn.lock conflict by taking main's lockfile and regenerating it with `yarn install` against the merged package.json (vitest ^5.0.5, simple-git removed by main). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N2vvE5XzurMvQfsX7Vz7bF
This bumps
vitestfrom ^5.0.1 to ^5.0.5, and the lockfile moves it from 5.0.1 to 5.0.5 along with its own dependencies. 5.0.5 carries the fix for GHSA-p458-7748-mcp3, which affects@vitest/uiand@vitest/browser. This repo doesn't use either of those, so it wasn't exposed, and the bump keeps vitest on the same version as the other Electron repos. Every package that changed in the lockfile was published at least 7 days ago. The vendored.build-toolscheckout still declaresvitest ~4.1.2, but it's gitignored and pinned by SHA, so I left it alone. Lint andtscpass locally, and all 152 tests pass. I ran them on Node 22 because Node 24 isn't installed in my environment, so CI covers theenginesversion.Generated by Claude Code