deps(npm): update Vitest packages to v5 in lockstep - #2803
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Independent Terra review, round 1, at The reviewer checked the frozen checkout and package/lock diff. Vitest, coverage-v8 and UI resolve to exactly 5.0.0 with matching peers. Node 24.13.1 and Vite 8 satisfy their declared ranges; current Vitest/PWA configuration has no demonstrated compatibility defect. No additional install or test was run by the reviewer. Supplied local evidence is npm ci and 47 focused tests. Hosted CI, production build and broad coverage proof remain merge gates; a clean source review does not stand in for them. The original three isolated Dependabot PRs remain open until this combined replacement qualifies. |
|
Control-path authority correction: |
|
Exact-head hosted qualification is now terminal at ef62bab: CLEAN/SUCCESS, 0 pending checks, 0 failed checks, and 0 unresolved review threads. The independent review evidence remains recorded. Because this package and lockfile path is a |
|
Fresh Terra base-interaction review at c30c358: no confirmed CRITICAL/HIGH findings. npm ci and npm ls confirm one deduped Vitest/UI/coverage 5.0.0 set with compatible peers; config suite 91 passed / 3 skipped. A single-file V8 coverage probe executed but failed the full-project coverage threshold, so is not claimed as green coverage. Broader local commands were limited/time out and are not qualification evidence. Exact-head hosted CI and the ADR-0066 maintainer review remain required. |
|
Maintainer ruling received in-session on 2026-09-09: "Delegate this four-PR batch; review afterward" for #2769, #2803, #2791 and #2792. The coordinator may perform final review and merge after fresh hosted CI, with maintainer review afterward. These source heads are preserved in integration PR #2815 so the complete combined tree receives one final exact-head qualification. Separate historical disclosures, repository settings and release decisions are not acknowledged or authorized by this ruling. |
1 participant
Problem
The three Dependabot major-update PRs for Vitest, Vitest UI, and Vitest coverage cannot install independently. Each package peers against the corresponding Vitest version, so an isolated update makes npm ci fail with ERESOLVE before frontend tests run.
Change
Update all three packages to 5.0.0 together and regenerate package-lock.json.
This replaces #2770, #2771, and #2773. Keep those original PRs open until this replacement is independently reviewed and qualified. #2769 remains separate.
Verification
npm run build began but did not reach a terminal result before the shared resource ceiling was reported, so it is not claimed as verification and was not retried. A full frontend Vitest suite was not run because another active lane holds the resource slot.
Refs #2770
Refs #2771
Refs #2773