chore(deps-dev): bump vitest from 3.2.4 to 4.1.0#4164
Conversation
dependabot
Bot
added
dependencies
|
Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability. Example:
Projects:
Please add a Jira issue key to your PR title. |
|
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/vitest-4.1.0
branch
2 times, most recently
from
6be954c to
286ce7b
Compare
| specifier: ^3.2.4 | ||
| version: 3.2.4(@types/debug@4.1.12)(@types/node@20.12.7)(terser@5.43.1) | ||
| specifier: ^4.1.0 | ||
| version: 4.1.0(@types/node@20.12.7)(vite@5.4.21(@types/node@20.12.7)(terser@5.43.1)) |
There was a problem hiding this comment.
Vitest four needs Vite six
Medium Severity
The bump to vitest ^4.1.0 leaves the lockfile resolving vitest@4.1.0 against vite@5.4.21, while Vitest 4 declares a required vite peer of ^6.0.0 and up. Official Vitest 4 migration treats Vite 5 as unsupported, so pnpm test may fail or behave unpredictably until Vite is upgraded alongside Vitest.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit 286ce7b. Configure here.
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/vitest-4.1.0
branch
from
286ce7b to
e7c2801
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
There are 3 total unresolved issues (including 2 from previous reviews).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit e7c2801. Configure here.
| needle@https://codeload.github.com/clearbit/needle/tar.gz/84d28b5f2c3916db1e7eb84aeaa9d976cc40054b: | ||
| resolution: {tarball: https://codeload.github.com/clearbit/needle/tar.gz/84d28b5f2c3916db1e7eb84aeaa9d976cc40054b} | ||
| needle@git+https://git@github.com:clearbit/needle.git#84d28b5f2c3916db1e7eb84aeaa9d976cc40054b: | ||
| resolution: {commit: 84d28b5f2c3916db1e7eb84aeaa9d976cc40054b, repo: git@github.com:clearbit/needle.git, type: git} |
There was a problem hiding this comment.
Git needle breaks Docker install
High Severity
The lockfile refresh changes clearbit’s needle dependency from an HTTPS tarball to a git-hosted resolution. Backend images run pnpm i --frozen-lockfile on Node Alpine without the git package, so installs that must clone this dependency can fail where the previous tarball lockfile did not need git.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit e7c2801. Configure here.
Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 3.2.4 to 4.1.0. - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest) --- updated-dependencies: - dependency-name: vitest dependency-version: 4.1.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/vitest-4.1.0
branch
from
e7c2801 to
5afea76
Compare
1 participant
Bumps vitest from 3.2.4 to 4.1.0.
Release notes
Sourced from vitest's releases.
... (truncated)
Commits
4150b91chore: release v4.1.01de0aa2fix: correctly identify concurrent test during static analysis (#9846)c3cac1cfix: use isAgent check, not just TTY, for watch mode (#9841)eab68bachore(deps): update all non-major dependencies (#9824)031f02afix: allow catch/finally for async assertion (#9827)3e9e096feat(reporters): addagentreporter to reduce ai agent token usage (#9779)0c2c013chore: release v4.1.0-beta.68181e06fix:hideSkippedTestsshould not hidetest.todo(fix #9562) (#9781)a8216b0fix: manual and redirect mock shouldn'tloadortransformoriginal module...689a22afix(browser): types ofgetCDPSessionandcdp()(#9716)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.
Note
Medium Risk
Major-version test runner upgrade can break existing vitest configs, mocks, or assertions; Vitest 4 also tightens Node engine requirements compared to 3.x.
Overview
Bumps vitest from 3.2.4 to 4.1.0 in
@crowd/packages-workerand@crowd/data-access-layer, with the matchingpnpm-lock.yamlrefresh.Vitest 4 pulls in a new test stack (e.g. chai 6, updated
@vitest/*packages,obug,es-module-lexer2.x) and drops several 3.x-only pieces such asvite-node,tinypool, and the old chai helper chain. The lockfile also bumps transitive rollup / postcss versions tied to the existing vite 5.4 resolution. No application or test source files change—only dev dependency versions and lockfile entries.Note for CI/local: Vitest 4’s declared Node range is ^20 || ^22 || >=24; environments still on Node 18 may need an upgrade before
pnpm testin those workspaces passes reliably.Reviewed by Cursor Bugbot for commit 5afea76. Bugbot is set up for automated code reviews on this repo. Configure here.