[jmcentire]

Post-transfer security scanning found vulnerable dependencies in the existing lockfile. Updates the affected dependency graph to patched versions.

Moves the test runner to Vitest 5; development checks require Node >=22.12. Updates CI to Node22.

Validation: npm audit reports zero vulnerabilities; build passes. Full TypeScript test suite passes.

---

Note

Medium Risk
Major Vitest/Vite dev-dependency jump and CI Node version change can break local or CI test runs; published runtime Node requirement is unchanged.

Overview
Upgrades the TypeScript dev/test stack to Vitest 5 and adds an explicit Vite 8 dev dependency (with a refreshed package-lock.json transitive graph, including the Vite 8 / Rolldown toolchain Vitest 5 expects). @types/node is bumped to match.

CI alignment: both TypeScript jobs in .github/workflows/check.yml now use Node 22 instead of 20 for npm ci, lint, test, and export drift checks.

Docs: README’s “Running tests locally” section now states that dev checks run on Vitest 5 and need Node 22.12+ (or 24/26), while engines.node in package.json stays >=20.10.0 for package runtime.

^{Reviewed by Cursor Bugbot for commit b9b1eb5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[adaptcom]

Confidence Score: 4/5

Summary

Refreshes vulnerable development dependencies and moves CI to Node 22. Runtime dependencies and emitted library files are unchanged, limiting risk to development tooling.

Important Files Changed

File	Overview
.github/workflows/check.yml	Runs TypeScript and export-drift checks on Node 22
package-lock.json	Refreshes development dependencies, replacing Rollup with Rolldown
package.json	Upgrades Vitest and Vite without declaring their separate development Node requirement

↻ Re-run review · View in Adapt

[adaptcom]

Node 20 contributors now hit engine errors with strict installs; document Vitest’s supported development Node versions separately in contributor instructions or devEngines.