build(deps-dev): bump vitest from 4.1.11 to 5.0.5

[dependabot]

Bumps vitest from 4.1.11 to 5.0.5.

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

• Keep vite default fs.deny with api token file  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11578 (28dc1)
• Handle quoted file names in --changed  -  by @​sheremet-va in vitest-dev/vitest#11583 (14921)
• Add data to the import.meta.hot stub  -  by @​sheremet-va in vitest-dev/vitest#11590 (3a828)
• Set skip in skipIf, ignore undefined options  -  by @​sheremet-va in vitest-dev/vitest#11591 (d523a)
• Skip builtin loading in async leak detector  -  by @​sheremet-va in vitest-dev/vitest#11598 (fe86a)
• Keep the import frame in native loader errors  -  by @​sheremet-va in vitest-dev/vitest#11599 (9697b)
• Run hook cleanups when a later hook fails  -  by @​sheremet-va in vitest-dev/vitest#11605 (6c5a4)
• Release mocks of finished test files  -  by @​sheremet-va in vitest-dev/vitest#11607 (e9c3d)
• Abort all running tests on cancel  -  by @​sheremet-va in vitest-dev/vitest#11606 (6621a)
• browser:
  • Ignore synthetic pagehide events  -  by @​sheremet-va in vitest-dev/vitest#11582 (ca081)
  • Run plugin buildStart on server creation  -  by @​sheremet-va in vitest-dev/vitest#11593 (ea611)
  • Drop late connections of closed sessions  -  by @​sheremet-va in vitest-dev/vitest#11600 (f161e)
  • Wait 30s for the browser to close  -  by @​sheremet-va in vitest-dev/vitest#11601 (6498b)
  • Run global setup once with instances  -  by @​sheremet-va in vitest-dev/vitest#11596 (8dd67)
• reporter:
  • End reason &[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39);failed&[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39); on worker crash  -  by @​AriPerkkio in vitest-dev/vitest#11568 (6ae8e)

    View changes on GitHub

v5.0.4

   🚀 Features

• experimental:
  • Tag cache directories with CACHEDIR.TAG  -  by @​lifeiscontent in vitest-dev/vitest#11461 (a8ea3)
  • Support test.ui.theme option  -  by @​sheremet-va in vitest-dev/vitest#11499 (1da66)
  • Highlight selector multiple matches in trace view  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11489 (5abba)
  • Print how many tests were affected and a total when running --changed  -  by @​sheremet-va in vitest-dev/vitest#11424 (a2336)
  • Add an option to cache dependencies instead of statically parsing them  -  by @​sheremet-va in vitest-dev/vitest#11515 (c0601)
  • Add fit and zoom controls to trace viewer  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11490 (f5dd9)

   🐞 Bug Fixes

• Fail the run on git and location filter errors  -  by @​sheremet-va in vitest-dev/vitest#11430 (30d03)
• Enable fsModuleCache by default  -  by @​sheremet-va in vitest-dev/vitest#11435 (ad208)
• Track project files and mocks with --changed  -  by @​sheremet-va in vitest-dev/vitest#11432 (b0f2b)
• Refactor caching, fix : in project and change the shape of results cache  -  by @​sheremet-va in vitest-dev/vitest#11453 (9673c)
• Keep full $ string values when taskTitleValueFormatTruncate is 0  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11485 (4f7e1)
• Resolve node builtins in client environments  -  by @​sheremet-va in vitest-dev/vitest#11417 (56b31)
• Fix module graph builtin externals after #11421  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11491 and vitest-dev/vitest#11421 (008e1)
• Wrap module mocks during in-source testing  -  by @​sheremet-va in vitest-dev/vitest#11505 (36d19)
• Handle line endings in snapshot  -  by @​sheremet-va in vitest-dev/vitest#11522 (4c468)
• Respect root in projects  -  by @​sheremet-va in vitest-dev/vitest#11521 (26642)
• Resolve mocks in directories with spaces  -  by @​sheremet-va in vitest-dev/vitest#11539 (caaef)
• api:
  • Publish the api token atomically  -  by @​umairnawaz333 in vitest-dev/vitest#11323 (6f990)
• browser:

... (truncated)

Commits

• 7a825db chore: release v5.0.5 (#11609)
• 6621a72 fix: abort all running tests on cancel (#11606)
• e9c3d72 fix: release mocks of finished test files (#11607)
• 8dd67c2 fix(browser): run global setup once with instances (#11596)
• 6c5a447 fix: run hook cleanups when a later hook fails (#11605)
• 9697b38 fix: keep the import frame in native loader errors (#11599)
• 6498b66 fix(browser): wait 30s for the browser to close (#11601)
• f161e6d fix(browser): drop late connections of closed sessions (#11600)
• fe86a64 fix: skip builtin loading in async leak detector (#11598)
• 6ae8e89 fix(reporter): end reason 'failed' on worker crash (#11568)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge.

What this changes

This PR upgrades the development test runner from Vitest 4.1.11 to 5.0.5 and updates its lockfile dependencies.

Example: A contributor runs pnpm install --frozen-lockfile on Node 25.9.0.

• Before: Vitest 4.1.11 permits Node 25 and the supported dependency graph installs.
• After: Vitest 5.0.5 excludes Node 25, so strict engine validation rejects installation.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The upgrade breaks a supported development installation path and reverses recorded compatibility direction.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot maintenance PR is outside the contributor proof gate; exact-head CI exercises the updated tooling, with Node 25 failing before package checks.
Patch quality	🧂 unranked krab (1/6)	1 actionable review finding remain.

Product

Kind: Maintenance · Worth it: No
User problem: Contributors receive newer test tooling, but supported Node 25 development installs become unusable.
Reason: Recorded owner direction retains Vitest 4.1.11 until Vitest supports Node 25 or the repository changes its runtime contract.

Regression provenance

Possible regression — probable (reviewed change; failure trace). No predecessor PR is attributed.

Merge readiness

⛔ Blocked before merge - 3 items remain

This PR breaks supported Node 25 development installs and contradicts recorded compatibility direction; repository policy does not permit automatic closure of this unimplemented upgrade.

Priority: P2
Reviewed head: 4e37252f816d961dd7f6d6896c7acc837f0e6350

Before merge

• Preserve Node 25-compatible test tooling (P1) - The repository supports Node ^22.18.0 || >=24.11.0 and enables engineStrict, but this update locks Vitest 5.0.5 to ^22.12.0 || ^24.0.0 || >=26.0.0. Consequently, pnpm install --frozen-lockfile on Node 25 rejects the dependency before tests can run. The exact-head Node 25 job fails at installation while main passes. Retain Vitest 4.1.11 and its compatible lockfile graph, consistent with build(deps): refresh Node types and cover Node 25 installs #52 and build(deps-dev): bump vitest from 4.1.11 to 5.0.3 #51 (comment).
• Product: not worth merging - Recorded owner direction retains Vitest 4.1.11 until Vitest supports Node 25 or the repository changes its runtime contract.
• Explain or restore the original intent of Vitest version and transitive test-runner graph - 8ddc83a: chore(deps): refresh tooling and repair release CI #23 refreshes Vitest to 4.1.11; build(deps): refresh Node types and cover Node 25 installs #52 and build(deps-dev): bump vitest from 4.1.11 to 5.0.3 #51 (comment) subsequently explain retaining that version for Node 25 compatibility.

Findings

• [P1] Preserve Node 25-compatible test tooling — package.json:59

Provenance

• Vitest version and transitive test-runner graph changes intended behavior without addressing why it exists (8ddc83a: chore(deps): refresh tooling and repair release CI #23 refreshes Vitest to 4.1.11; build(deps): refresh Node types and cover Node 25 installs #52 and build(deps-dev): bump vitest from 4.1.11 to 5.0.3 #51 (comment) subsequently explain retaining that version for Node 25 compatibility.)

Agent review details

How this fits together

Vitest runs the router's TypeScript behavior tests during package validation; pnpm validates dependency engines before those tests can start.

flowchart LR
  A[Contributor checkout] --> B[pnpm frozen install]
  B --> C[Dependency engine validation]
  C --> D[Package checks]
  D --> E[Vitest router tests]
  D --> F[Packed package validation]

Loading

Technical review

Best possible solution:

Retain Vitest 4.1.11 until an upgrade supports the repository's declared development runtimes.

Do we have a high-confidence way to reproduce the issue?

The locked Vitest engine range excludes Node 25 under engineStrict, and the exact-head Node 25 job fails during installation while main passes; no target code was executed locally.

Is this the best way to solve the issue?

This upgrade conflicts with the established compatibility contract; retaining the current test runner is preferable to disabling engine checks or removing supported Node coverage.

Full review comments:

• [P1] Preserve Node 25-compatible test tooling — package.json:59
  The repository supports Node ^22.18.0 || >=24.11.0 and enables engineStrict, but this update locks Vitest 5.0.5 to ^22.12.0 || ^24.0.0 || >=26.0.0. Consequently, pnpm install --frozen-lockfile on Node 25 rejects the dependency before tests can run. The exact-head Node 25 job fails at installation while main passes. Retain Vitest 4.1.11 and its compatible lockfile graph, consistent with build(deps): refresh Node types and cover Node 25 installs #52 and build(deps-dev): bump vitest from 4.1.11 to 5.0.3 #51 (comment).
  Confidence: 1

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 3b2fb01297a5.

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Introduced upgrade: The pinned introduction diff changes only package.json and pnpm-lock.yaml; main still declares Vitest ^4.1.11. (package.json:59, 4e37252f816d)
• Incompatible dependency engines: Vitest 5.0.5 requires ^22.12.0 || ^24.0.0 || >=26.0.0, excluding Node 25, while package.json retains ^22.18.0 || >=24.11.0. (pnpm-lock.yaml:1221, 4e37252f816d)
• Strict installation contract: engineStrict is enabled, and CONTRIBUTING.md expressly requires dependency updates to preserve Node 25 development installs. (pnpm-workspace.yaml:1, 3b2fb01297a5)
• Exact-head installation failure: The Node 25 job fails at Install dependencies and skips Check: https://github.com/openclaw/uirouter/actions/runs/39306625066/job/118245256124. The corresponding main job passes: https://github.com/openclaw/uirouter/actions/runs/39215208970/job/117937342512. Raw logs redirect to a blocked artifact host; the engine incompatibility is independently established by source. (.github/workflows/ci.yml, 4e37252f816d)
• Recorded compatibility direction: build(deps-dev): bump vitest from 4.1.11 to 5.0.3 #51 (comment) explicitly retains Vitest 4.1.11 while Node 25 is supported; merged build(deps): refresh Node types and cover Node 25 installs #52 adds that CI coverage, and build(deps-dev): bump vitest from 4.1.11 to 5.0.4 #59 (comment) reiterates the same decision for the preceding Vitest update. (package.json:59, 01c7a1b96886)
• Feature history: The test runner appears in commit 409c838; merged chore(deps): refresh tooling and repair release CI #23 updates Vitest to 4.1.11, and subsequent tooling changes preserve Node 25 compatibility. One historical git show encountered an unavailable promisor blob; current files and GitHub discussions establish the relevant contract. (package.json:59, 8ddc83ae3c76)

Likely related people:

• Vincent Koc: Raw commit f33fdcb adds package.json:54 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: f33fdcbe0f8c; files: package.json)

Labels

Label changes:

• add P2: The update breaks supported contributor installations without changing the published router runtime.
• add merge-risk: 🚨 compatibility: The new Vitest engine range excludes the explicitly supported Node 25 development runtime.
• add merge-risk: 🚨 automation: The changed dependency graph prevents the existing Node 25 CI lane from installing dependencies and reaching package checks.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Label justifications:

• P2: The update breaks supported contributor installations without changing the published router runtime.
• merge-risk: 🚨 compatibility: The new Vitest engine range excludes the explicitly supported Node 25 development runtime.
• merge-risk: 🚨 automation: The changed dependency graph prevents the existing Node 25 CI lane from installing dependencies and reaching package checks.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 19, 2026, 3:08 PM ET / 19:08 UTC.