[MarkusNeusinger]

Summary

• Raises vitest and @vitest/coverage-v8 in app/ from ^4.1.11 to ^5.0.5. Test-time dependency only; nothing ships to the site.
• app/yarn.lock now resolves @vitest/mocker 5.0.5, which is outside both open Dependabot advisory ranges (GHSA-qxg6-89mg-rqv8 < 4.1.12, GHSA-xp26-3454-mjgp >= 4.1.11, < 4.1.12).
• This supersedes chore(app): vitest 4.1.12 closes the two @vitest/mocker advisories #12241 (vitest ^4.1.12 for the same two advisories). The owner merges either chore(app): vitest 4.1.12 closes the two @vitest/mocker advisories #12241 or this PR, not both.
• No config or test changes were needed. The Vitest 5 migration guide items that could affect this suite were checked:
  • clearMocks now defaults to true: all 1,168 tests still pass.
  • vi.mock / vi.hoisted inside functions or describe blocks now throw: none in the suite, all tests pass.
  • coverage.include / coverage.exclude lost their looser "contains" matching: the coverage file set is identical to Vitest 4 (117 files, diffed).
  • vite became a required peer dependency: app/package.json already lists vite 8.3.5, inside the ^6.4.0 || ^7.0.0 || ^8.0.0 peer range.
  • Node ^22.12.0 || ^24.0.0: CI and the local toolchain run Node 24.

Plan

N/A. A single dependency bump, no plan file.

Test plan

Local, Node 24.21.0, in a fresh worktree from origin/main:

• yarn lint: pass
• yarn fm:check: pass
• yarn type-check: pass
• yarn test: 106 files, 1,168 tests pass (same counts as Vitest 4.1.11 on main)
• yarn test --coverage (the CI form): pass; 117 covered files, identical list to Vitest 4; statements 80.55 % vs 80.61 % on main
• yarn build: pass; dist/ identical to main in file names and sizes
• uv run python -m tools.changelog check --base origin/main: pass
• CI green

No local browser run against the backend: Vitest is a test-time dependency only and never reaches the site, and the built bundle is identical to main. The gates plus the full test run cover this change.

🤖 Generated with Claude Code

https://claude.ai/code/session_0175hA62juZoajMcqKxWFGza

[Copilot]

🔵 Needs a closer look

Remove the PR reference from the changelog fragment to comply with the documented fragment format.

No open issues 🎉

What changed in this PR

This pull request upgrades the frontend test tooling from Vitest 4.1.11 to 5.0.5, resolving the affected @vitest/mocker advisories without changing production code.

Changes:

• Updates vitest and @vitest/coverage-v8 to ^5.0.5.
• Refreshes the Yarn lockfile and Vitest dependency tree.
• Adds a changelog fragment documenting the upgrade and validation results.

File	Description
changelog.d/​vitest-5.md	Documents the Vitest upgrade, advisory resolution, and compatibility validation.
app/​yarn.lock	Locks Vitest 5.0.5 and its updated transitive dependencies.
app/​package.json	Updates the Vitest and coverage provider development dependencies.

_{Review effort: Lite}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!