chore(deps-dev): bump vitest from 4.1.11 to 5.0.0

[dependabot]

Bumps vitest from 4.1.11 to 5.0.0.

Release notes

Sourced from vitest's releases.

v5.0.0

Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

   🚨 Breaking Changes

• Replace loupe.inspect with pretty-format  -  by @​hi-ogawa, Claude Opus 5 (1M context) and OpenAI Codex in vitest-dev/vitest#9609 (3f802)
• Remove quotes from string values in test.for/each title $ variable (take 2)  -  by @​hi-ogawa in vitest-dev/vitest#10170 (04d37)
• Default attachmentsDir from .vitest-attachements/ to .vitest/attachments/  -  by @​MdSadiqMd in vitest-dev/vitest#10186 (1ba73)
• Remove sequential test/suite options in favor of concurrent  -  by @​hi-ogawa and OpenAI Codex in vitest-dev/vitest#10198 (9229f)
• Represent locator as an object instead of a string  -  by @​sheremet-va in vitest-dev/vitest#10212 (80f07)
• Inline expect package  -  by @​sheremet-va in vitest-dev/vitest#10221 (ad162)
• Remove deprecated entry points  -  by @​sheremet-va in vitest-dev/vitest#10222 (994c6)
• Require Node.js 22 and Vite 6.4  -  by @​sheremet-va in vitest-dev/vitest#10178 (38762)
• Fail expect.poll when function didn't resolve in time  -  by @​hi-ogawa and OpenAI Codex in vitest-dev/vitest#10233 (4df04)
• Throw an error if hoistable methods are outside the top level scope  -  by @​sheremet-va in vitest-dev/vitest#10460 (d0b4f)
• toHaveTextContent is strict, add toMatchTextContent as alternative  -  by @​sheremet-va in vitest-dev/vitest#10473 (18f30)
• Don't lookup config file from ancestor directories  -  by @​hi-ogawa, OpenAI Codex and Hiroshi Ogawa in vitest-dev/vitest#10428 (945d9)
• Inline @vitest/runner package, do not publish it anymore  -  by @​sheremet-va in vitest-dev/vitest#10511 (6d6e4)
• Allow mutating happy-dom/jsdom window object  -  by @​hi-ogawa, Hiroshi Ogawa and OpenAI Codex in vitest-dev/vitest#10373 (206e8)
• Expose concurrencyId/workerId on TestModule's diagnostics, make id 1-based  -  by @​sheremet-va in vitest-dev/vitest#10516 (bdd98)
• Add screenshotDirectory config to browser.expect.toMatchScreenshot  -  by @​macarie in vitest-dev/vitest#10592 (a60de)
• Update @sinonjs/fake-timers and support mocking Temporal  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#10654 (f8b15)
• Remove webdriverio package  -  by @​sheremet-va in vitest-dev/vitest#10675 (5fed6)
• Clear mocks by default before each test  -  by @​sheremet-va in vitest-dev/vitest#10613 (0f646)
• Don't emit localStorage warnings on Node 26, fail gracefully when worker fails to start  -  by @​sheremet-va in vitest-dev/vitest#10293 (334ed)
• Separate config resolution from the server creation  -  by @​sheremet-va in vitest-dev/vitest#10554 (1c0ec)
• Inline projects extend the root config by default  -  by @​sheremet-va in vitest-dev/vitest#10750 (fec00)
• Enable mocking Temporal without fake timers  -  by @​fabon-f, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#10757 (ac2d4)
• Support nested projects  -  by @​sheremet-va in vitest-dev/vitest#10846 (ec367)
• Use > as separator in -t, calculate only once  -  by @​sheremet-va in vitest-dev/vitest#10686 (a0b20)
• Fail the test when an asynchronous assertion is not awaited  -  by @​sheremet-va in vitest-dev/vitest#10868 (86d4a)
• Share the Vite server between inline projects  -  by @​sheremet-va in vitest-dev/vitest#10848 (d87c9)
• Parse files statically in vitest list by default  -  by @​sheremet-va in vitest-dev/vitest#11088 (51e94)
• benchmark:
  • Rewrite the public API  -  by @​sheremet-va in vitest-dev/vitest#10113 (19f6e)
• browser:
  • Iframe scale  -  by @​macarie in vitest-dev/vitest#9745 (b6398)
  • Enable locators.exact by default  -  by @​sheremet-va in vitest-dev/vitest#10430 (e2032)
  • Require sessionId for orchestrator html request  -  by @​hi-ogawa, Hiroshi Ogawa and OpenAI Codex in vitest-dev/vitest#10522 (79b7d)
  • Save failure screenshots in attachmentsDir  -  by @​macarie in vitest-dev/vitest#10917 (3b5bb)
• coverage:
  • include/exclude globs too eager  -  by @​AriPerkkio in vitest-dev/vitest#9818 (edacb)
  • Allow thresholds.perFile to accept an object  -  by @​vladlenskiy and @​AriPerkkio in vitest-dev/vitest#10190 (13b78)
• expect:
  • Fix toThrow("") behavior by reverting #6710  -  by @​hi-ogawa in vitest-dev/vitest#9643 and vitest-dev/vitest#6710 (6c3e4)
• mocker:
  • Deserialize automock as automock  -  by @​nami8824 in vitest-dev/vitest#10192 (2f892)
• reporters:
  • blob reporter and --merge-reports default to .vitest/blob/  -  by @​AriPerkkio in vitest-dev/vitest#10232 (d22b0)
  • Write json and junit reporter output files to .vitest by default  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and @​AriPerkkio in vitest-dev/vitest#10621 (58577)

... (truncated)

Commits

• f441c6f chore: release v5.0.0 (#11130)
• d46a747 fix: treat test.describe as a suite during static collection (#11128)
• 584cf30 fix: add a warning if inline project has duplicate plugins due to unexpected ...
• f08ce4b fix: apply queued mocks from doMock() in queue order (fixes #10706) (#11127)
• 897f51f chore: release v5.0.0-rc.4 (#11107)
• 1339b06 chore(deps): update all non-major dependencies (#11104)
• 51e9494 feat!: parse files statically in vitest list by default (#11088)
• 2122ffd fix: propagate --maxWorkers to projects (#11102)
• dc10f5f fix(browser): report the action error when a task times out (#11101)
• d4fe198 feat: promote clearCache out of experimental (#11086)
• Additional commits viewable in compare view

[myselfsiddharth]

Review: not merged — the bump outruns the Node this repo builds on

All required checks are green, so this looks mergeable. It isn't, and the reason doesn't show up in the check list.

The finding

vitest@5.0.0 declares:

"engines": { "node": "^22.12.0 || ^24.0.0 || >=26.0.0" }

Every CI job here runs Node 20:

• .github/workflows/ci.yml:26 — lint-typecheck-test-secrets (required check, runs vitest run tests/unit + tests/integration)
• .github/workflows/ci.yml:77 — testbed-smoke
• .github/workflows/ci.yml:103 — privacy-canary (required check, runs vitest run tests/canary)
• .github/workflows/release.yml:24 — npm-publish

So the required checks that gate this merge are running vitest 5 on a Node version vitest 5 does not support. CI is green by luck, not by support. npm treats engines as advisory (there is no .npmrc, so engine-strict is off), so npm ci emitted an EBADENGINE warning and carried on, and this suite happens not to touch anything Node 22-only yet. Any 5.x patch that does will break main, not a PR — and it will look like an unrelated failure.

What I verified

• No removed vitest 5 API is used anywhere: no sequential, no @vitest/runner / deprecated entry-point imports, no outputFile, no attachmentsDir, no webdriverio. vitest.config.ts uses only include / reporters / maxWorkers / testTimeout / hookTimeout, all still valid.
• The "clear mocks by default before each test" breaking change is inert here — tests/unit/cache-store.test.ts is the only file using vi.fn / vi.spyOn, and both are created inside individual test bodies, so no cross-test mock state exists to clear.
• Rebased onto current main (with feat(runner): delegated repair client — the host agent repairs, no API key (#189) #192 and feat(gate): wire the one-time program-build cost into the matrix (#39 step 4) #193 now merged) and ran the full suite under vitest 5 on Node 24: green. The bump itself is fine — it is only the runner version that is wrong.

Why I did not just bump CI and merge

Node 20 is not an incidental pin. It is written into ADR-0001 ("TypeScript + Node 20+ + Playwright"), package.json engines.node: ">=20", and docs/DEVELOPMENT.md. Moving CI to Node 22 is defensible — Node 20 reached end-of-life on 2026-04-30, and >=20 stays literally true — but it has two consequences worth a decision rather than a drive-by commit:

1. It drops Node 20 verification of the product. engines.node: ">=20" promises consumers Node 20 works; today CI is what backs that promise. Bump the runner and nothing tests the minimum supported version any more.
2. It splits the toolchain floor from the runtime floor. A contributor on exactly Node 20 could no longer run npm run ci, while the package they are building still claims to support them. docs/DEVELOPMENT.md would need to say so.

Both point the same way — the dev toolchain and the published runtime floor are now different numbers — but which way you resolve it (bump CI to 22, or add a Node 20 job that runs the built product, or hold at vitest 4) is a call for you, not for a dependabot PR.

Applied

I have pushed the minimal fix to this branch: CI and release workflows moved to Node 22, engines.node left at >=20 (vitest is dev-only — consumers on Node 20 are unaffected), and docs/DEVELOPMENT.md updated to state the split explicitly.

Left open for your call, since it is a real coverage regression: nothing now exercises the product on Node 20 while engines still promises it. If you want that back, the follow-up is a second CI job on Node 20 running npm run build plus the non-vitest checks.