build(deps-dev): bump the development-minor-and-patch group with 2 updates

[dependabot]

Bumps the development-minor-and-patch group with 2 updates: @vitest/coverage-v8 and vitest.

Updates @vitest/coverage-v8 from 5.0.1 to 5.0.2

Release notes

Sourced from @​vitest/coverage-v8's releases.

v5.0.2

   🐞 Bug Fixes

• Bind process in case global is overwritten  -  by @​AriPerkkio in vitest-dev/vitest#11343 (0b792)
• detect-async-leaks:
  • Ignore process.stdio handles  -  by @​AriPerkkio in vitest-dev/vitest#11333 (0fd6b)
• expect:
  • Fix toMatchObject with asymmetric matchers  -  by @​ShreeBohara, Claude Opus 5, @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-5) in vitest-dev/vitest#11100 (42523)
• jsdom:
  • Fix Request with Blob body on jsdom 28+  -  by @​harshit-d3v in vitest-dev/vitest#11295 (d1c3e)
• reporter:
  • agent to respect --silent  -  by @​Raj4478 and @​AriPerkkio in vitest-dev/vitest#11271 (5b95e)
• reporters:
  • Handle concurrent createReport calls  -  by @​7rulnik in vitest-dev/vitest#11278 (e8e55)
  • hanging-process to use ESM entrypoint  -  by @​AriPerkkio in vitest-dev/vitest#11316 (4e91e)
• spy:
  • Fix stack overflow when spying Set.prototype.add  -  by @​fengmk2 in vitest-dev/vitest#11299 (a0a93)
• ui:
  • Persist authentication cookie beyond current browser session  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#11066 (f8819)

    View changes on GitHub

Commits

• 428e2e5 chore: release v5.0.2 (#11357)
• See full diff in compare view

Updates vitest from 5.0.1 to 5.0.2

Release notes

Sourced from vitest's releases.

v5.0.2

   🐞 Bug Fixes

• Bind process in case global is overwritten  -  by @​AriPerkkio in vitest-dev/vitest#11343 (0b792)
• detect-async-leaks:
  • Ignore process.stdio handles  -  by @​AriPerkkio in vitest-dev/vitest#11333 (0fd6b)
• expect:
  • Fix toMatchObject with asymmetric matchers  -  by @​ShreeBohara, Claude Opus 5, @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-5) in vitest-dev/vitest#11100 (42523)
• jsdom:
  • Fix Request with Blob body on jsdom 28+  -  by @​harshit-d3v in vitest-dev/vitest#11295 (d1c3e)
• reporter:
  • agent to respect --silent  -  by @​Raj4478 and @​AriPerkkio in vitest-dev/vitest#11271 (5b95e)
• reporters:
  • Handle concurrent createReport calls  -  by @​7rulnik in vitest-dev/vitest#11278 (e8e55)
  • hanging-process to use ESM entrypoint  -  by @​AriPerkkio in vitest-dev/vitest#11316 (4e91e)
• spy:
  • Fix stack overflow when spying Set.prototype.add  -  by @​fengmk2 in vitest-dev/vitest#11299 (a0a93)
• ui:
  • Persist authentication cookie beyond current browser session  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#11066 (f8819)

    View changes on GitHub

Commits

• 428e2e5 chore: release v5.0.2 (#11357)
• 0b79231 fix: bind process in case global is overwritten (#11343)
• 597df56 docs: correct stale config defaults (#11354)
• ea1c44f docs: sequence.setupFiles default is 'list' (#11351)
• 0fd6b97 fix(detect-async-leaks): ignore process.stdio handles (#11333)
• 4e91e56 fix(reporters): hanging-process to use ESM entrypoint (#11316)
• 1a57929 docs(browser): fix locators.exact default (#11338)
• 5b95efb fix(reporter): agent to respect --silent (#11271)
• f58a209 docs: correct benchmark.exclude and watch defaults (#11268)
• d1c3ecc fix(jsdom): fix Request with Blob body on jsdom 28+ (#11295)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 28, 2026, 12:10 PM ET / 16:10 UTC.

ClawSweeper review

What this changes

Updates the lockfile so the CLI's development tests and V8 coverage use matching Vitest 5.0.2 packages.

Merge readiness

✅ Ready for maintainer review

Current main still resolves Vitest 5.0.1, so this update remains useful. The lockfile change is consistent with the existing package manifest and the relevant completed checks passed; the pending Windows check is routine.

Priority: P3
Reviewed head: 7cd2d18039524cee123b8010c16eda11a3893b4f

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, internally consistent test-dependency update with relevant completed checks and no identified patch defect.
Proof confidence	🌊 off-meta tidepool	Not applicable: This bot-authored lockfile update is exempt from contributor runtime proof. CI exercises the frozen-lockfile test path, and no stored-data contract changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This bot-authored lockfile update is exempt from contributor runtime proof. CI exercises the frozen-lockfile test path, and no stored-data contract changes.
Evidence reviewed	5 items	Introduced change: The pinned PR delta changes only pnpm-lock.yaml, resolving Vitest and its V8 coverage package from 5.0.1 to 5.0.2 with matching transitive packages. Current main dependency contract: The manifest permits both 5.0.2 versions through ^5.0.1, while current main's lockfile still resolves 5.0.1. This establishes that the proposed resolution is not already on main. Test integration: The project runs Vitest tests and V8 coverage, and CI installs from the frozen lockfile before running coverage and build checks.
Findings	None	None.
Security	None	None.

How this fits together

Vitest runs clawpatch's TypeScript tests during development and CI. The pnpm lockfile supplies the resolved test packages used by those checks; it is not part of the published CLI.

flowchart LR
  A[Package manifest] --> B[pnpm lockfile]
  B --> C[Vitest and coverage packages]
  C --> D[Development and CI tests]
  D --> E[Test and coverage results]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Keep the matched Vitest and coverage versions and let the repository's normal checks gate the lockfile update.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency update, not a bug report.

Is this the best way to solve the issue?

Yes: the existing version ranges allow 5.0.2, and updating the resolved lockfile packages is the focused way to adopt it.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 527bdbc979dd.

Labels

Label changes:

• add P3: This is a development test-tooling patch update with no demonstrated user-facing regression.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This bot-authored lockfile update is exempt from contributor runtime proof. CI exercises the frozen-lockfile test path, and no stored-data contract changes.

Label justifications:

• P3: This is a development test-tooling patch update with no demonstrated user-facing regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This bot-authored lockfile update is exempt from contributor runtime proof. CI exercises the frozen-lockfile test path, and no stored-data contract changes.

Evidence

What I checked:

• Introduced change: The pinned PR delta changes only pnpm-lock.yaml, resolving Vitest and its V8 coverage package from 5.0.1 to 5.0.2 with matching transitive packages. (pnpm-lock.yaml:31, 7cd2d1803952)
• Current main dependency contract: The manifest permits both 5.0.2 versions through ^5.0.1, while current main's lockfile still resolves 5.0.1. This establishes that the proposed resolution is not already on main. (package.json:46, 527bdbc979dd)
• Test integration: The project runs Vitest tests and V8 coverage, and CI installs from the frozen lockfile before running coverage and build checks. (.github/workflows/ci.yml:27, 527bdbc979dd)
• Relevant feature history: Recent merged work established Vitest 5 coverage tooling and then refreshed the test dependencies; both changes were authored by steipete. Older commit blobs could not be fetched from the partial local checkout, so this is routing context rather than source-line introduction proof. (pnpm-lock.yaml, 527bdbc979dd)
• Review and release state: The provided check results show successful test, Node 22 and 24 runtime, dependency-review, and security checks; the Windows execution check was still in progress. No tag contains this PR head, and the latest identified release is v0.8.1. (7cd2d1803952)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Thanks! Incorporated the Vitest and coverage updates into #230, now merged with contributor credit. The full remote gate passed (964 tests), and Node 22/24/26 plus Windows CI passed on the exact PR head: https://github.com/openclaw/clawpatch/actions/runs/36665460012. Closing this superseded dependency PR.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml