chore(deps): hold vitest below 5 until vitest-pool-workers supports it

[OjasMor]

Why

The npm-major group (#101) bumps vitest from 4 to 5. The control-plane integration tests run in workerd through @cloudflare/vitest-pool-workers, and its latest release (0.22.0) declares peerDependencies: { vitest: "^4.1.0" }. With vitest 5 in the group, the install ends up mixing vitest 4 (pulled in by pool-workers) and vitest 5. That also breaks the web tests' jest-dom matcher types, so the other majors in the group can't be judged on their own.

Like the TypeScript 7 hold, this one waits on the ecosystem, not on us.

What

One ignore entry in .github/dependabot.yml: vitest >= 5.0.0. The comment says to drop it once pool-workers accepts vitest 5. After it merges, Dependabot rebuilds the group without vitest. I'll then fix what the remaining majors need (TypeScript 6 needs rootDir and an explicit types list) on that PR.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Automated dependency updates will skip Vitest 5 and later while the current test environment requires Vitest 4.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: e684a59a-cdee-437a-adb6-275220da123c

📥 Commits

Reviewing files that changed from the base of the PR and between 62ee0ad and 964e967.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: This review used your included allowance. 2 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour. Your free on-demand review promotion remains active until October 9, 2026 at 6:00 PM UTC.

---

📝 Walkthrough

Walkthrough

The root npm Dependabot configuration now ignores Vitest versions 5.0.0 and later. A comment explains the Vitest 4 requirement for the Cloudflare pool workers package.

Changes

Vitest version constraint

Layer / File(s)	Summary
Add Vitest ignore rule .github/dependabot.yml	Dependabot ignores Vitest versions >= 5.0.0. A comment records the current Vitest 4 requirement and says to remove the rule when the pool supports Vitest 5.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 964e9

The change is intended to keep Dependabot from proposing Vitest 5 while the pool-workers package requires Vitest 4. No concrete merge-blocking failure is established; proceed with normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the change to hold Vitest below version 5 until vitest-pool-workers supports it.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[codos-reviewer]

Blocking: 0 · Non-blocking: 0

The npm Dependabot ignore rule correctly excludes Vitest 5+ while leaving Vitest 4 updates eligible. The PR-head YAML parses, and the pool-workers Vitest 4 peer constraint supports the hold. No issues in this change.