chore(deps-dev): bump vitest from 2.1.9 to 3.2.7

[dependabot]

Bumps vitest from 2.1.9 to 3.2.7.

Release notes

Sourced from vitest's releases.

v3.2.7

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v3]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10679 (b795e)

    View changes on GitHub

v3.2.6

   🐞 Bug Fixes

• Pin last supported vite-node version  -  by @​sheremet-va (16f12)

    View changes on GitHub

v3.2.5

   🚀 Features

• api: Add allowWrite and allowExec options to api [backport to v3]  -  by @​hi-ogawa and Codex in vitest-dev/vitest#10445 (af88b)

   🐞 Bug Fixes

• browser: Disable client cdp API when allowWrite/allowExec: false [backport to v3]  -  by @​hi-ogawa and Codex in vitest-dev/vitest#10456 (385a1)

    View changes on GitHub

v3.2.4

   🐞 Bug Fixes

• Use correct path for optimisation of strip-literal  -  by @​mrginglymus in vitest-dev/vitest#8139 (44940)
• Print uint and buffer as a simple string  -  by @​sheremet-va in vitest-dev/vitest#8141 (b86bf)
• browser:
  • Show a helpful error when spying on an export  -  by @​sheremet-va in vitest-dev/vitest#8178 (56007)
• cli:
  • vitest run --watch should be watch-mode  -  by @​AriPerkkio in vitest-dev/vitest#8128 (657e8)
  • Use absolute path environment on Windows  -  by @​colinaaa in vitest-dev/vitest#8105 (85dc0)
  • Throw error when --shard x/<count> exceeds count of test files  -  by @​AriPerkkio in vitest-dev/vitest#8112 (8a18c)
• coverage:
  • Ignore SCSS in browser mode  -  by @​sheremet-va in vitest-dev/vitest#8161 (0c3be)
• deps:
  • Update all non-major dependencies  -  in vitest-dev/vitest#8123 (93f32)
• expect:
  • Handle async errors in expect.soft  -  by @​lzl0304 in vitest-dev/vitest#8145 (68699)
• pool:
  • Auto-adjust minWorkers when only maxWorkers specified  -  by @​AriPerkkio in vitest-dev/vitest#8110 (14dc0)
• reporter:
  • task.meta should be available in custom reporter's errors  -  by @​AriPerkkio in vitest-dev/vitest#8115 (27df6)
• runner:
  • Preserve handler wrapping on extend  -  by @​pengooseDev in vitest-dev/vitest#8153 (a9281)
• ui:
  • Ensure ui config option works correctly  -  by @​lzl0304 in vitest-dev/vitest#8147 (42eeb)

... (truncated)

Commits

• c0c203d chore: release v3.2.7 (#10719)
• b6d56f8 chore: release v3.2.6
• 16f120d fix: pin last supported vite-node version
• 2cbad0a chore: release v3.2.5
• 385a1ae fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
• af88b1f feat(api): add allowWrite and allowExec options to api [backport to v3]...
• c666d14 chore: release v3.2.4
• 8a18c8e fix(cli): throw error when --shard x/\<count> exceeds count of test files (#...
• 8abd7cc chore(deps): update tinypool (#8174)
• 93f3200 fix(deps): update all non-major dependencies (#8123)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
vitest	[>= 4.a, < 5]

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[zeshi-du]

Leaving this open rather than closing it, because unlike the action-pin bumps this one represents real outstanding work: the CI failures here are genuine, not infrastructural. The major carries breaking changes that need a migration pass through the test suite, and that has to happen on our internal source-of-truth repo first (this repository is a per-release mirror, so a bump landing only here blocks or gets reverted by the next snapshot).

I've queued the migration internally. When it lands, this PR will resolve itself on the next release snapshot.

Recording it here rather than silently closing so it doesn't look like the bump was dismissed.

[zeshi-du]

Closing this — and independent of our mirror policy, this specific PR is broken on its own terms and shouldn't be merged as-is even internally.

It bumps vitest to 3.2.7 but leaves @vitest/coverage-v8 pinned at ^2.1.4, whose only compatible peer is the exact version vitest@2.1.9. That's a partial bump of a pair that has to move together, and npm ci fails on it before a single test runs:

npm error While resolving: @vitest/coverage-v8@2.1.9
npm error Found: vitest@3.2.7
npm error Could not resolve dependency:
npm error peer vitest@"2.1.9" from @vitest/coverage-v8@2.1.9

Checked against 8dab99c3: every job that reaches npm ci — Build (Node 22), Typecheck, Lint & Format, Local E2E, all three unit-test jobs, Coverage — fails on that same ERESOLVE. Build (Node 20) never gets that far: it's cancelled mid-setup once Build (Node 22) goes red (matrix fail-fast), which is why it shows red without an ERESOLVE of its own. Only Secret scan (gitleaks) passes, because that job only checks out the repo and runs gitleaks — it doesn't touch node_modules. (This run also predates the security workflow — no Dependency Review/ESLint Security/CodeQL at all — but it's moot here since the install itself doesn't succeed.)

Separately, and worth stating even though a corrected version of this bump would install fine: 3.x isn't the version we'd want to land regardless. The Windows-side vitest failures we've been chasing trace to birpc's hardcoded 60-second RPC timeout, which has no configuration surface independent of testTimeout — I confirmed the mechanism from public vitest issues (vitest-dev/vitest#4106, #4357, #4497, #5182, and the still-open timeout-unification issue #9751), which corroborate a default 60s birpc timeout with no config knob causing exactly this class of false timeout on slower/CI/Windows runs. What I could not confirm from public sources is the specific claim that the fix lands only in vitest 4.x and was never backported to the 2.x/3.x lines — that part is from our own internal testing, not something I could verify independently today. Flagging that distinction so it's not overstated.

Net: fixing the @vitest/coverage-v8 pairing would only get this PR to a version we don't want anyway. This repo is also a mirror — dependency bumps land in our source repo and arrive here via release snapshot — so it's closed here regardless of the above.

What would change the answer: look for a coordinated vitest + @vitest/coverage-v8 bump targeting the 4.x line from our source repo, not a re-fixed version of this PR.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.