build(deps-dev): upgrade vitest to v5

[claude]

Requested by David Sanders · Slack thread

This bumps vitest and @vitest/coverage-v8 to ^5.0.1. That also fixes the existing peer mismatch between coverage-v8 4.1.2 and vitest 4.1.11. Vitest 5 lists vite as a required peer instead of a dependency, so I added vite as a devDependency at ^8.0.16, the version already in the lockfile. I also moved @types/node from ~22.10.7 to ~22.12.0. The old version didn't satisfy vite's @types/node peer range, and 22.12 matches the repo's engines floor and .nvmrc. No test or config changes were needed. Lint, build, docs:ci and test:ci all pass locally on Linux with Node 22 (81 passed, 2 skipped, the same as main).

🤖 Generated with Claude Code

https://claude.ai/code/session_01N2vvE5XzurMvQfsX7Vz7bF

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​vitest/​coverage-v8@​4.1.2 ⏵ 5.0.1			+1	-1
	npm/​vitest@​4.1.11 ⏵ 5.0.1	+1		+1
	npm/​@​types/​node@​22.10.10 ⏵ 22.12.0	+1		+1
	npm/​vite@​8.0.16

View full report

[claude]

Looks good — mechanical devDependency version bump (vitest/coverage-v8 4→5, @ types/node 22.10.7→22.12.0, plus new vite ^8.0.16 peer devDependency), with yarn.lock regenerated consistently. Checked package.json/yarn.lock diff: peer ranges line up (vitest@ 5.0.1 requires vite ^6.4.0||^7.0.0||^8.0.0 and @ types/node ^22.0.0||>=24.0.0, both satisfied), and the @ types/node version matches .nvmrc (22.12) and the engines field. No source or test files changed.

Extended reasoning...

Change is limited to package.json and yarn.lock: a devDependency major-version bump for vitest/@ vitest/coverage-v8 with an added vite peer devDependency, plus a matching @ types/node minor bump; yarn.lock diff reflects the expected transitive shifts. No security-sensitive code paths are touched (test tooling only), and the resulting peer dependency ranges are mutually satisfied, which is what decided approve over defer for this small, self-contained config change.