build(deps-dev): upgrade vitest to v5

[claude]

Requested by David Sanders · Slack thread

This bumps vitest from ^4.1.5 to ^5.0.1. Vitest 5 makes vite a required peer dependency instead of a regular dependency, so vite is now a devDependency at ^8.0.16, the version already in the lockfile, and it still resolves to 8.0.16. No test or config changes were needed. On Linux, yarn lint, yarn build, yarn test:typecheck and yarn install --immutable pass, and yarn vitest run passes 203 of 203 tests in 11 files, the same as main. I could not run the second half of yarn test, which runs the suite inside Electron, because the sandbox couldn't download the Electron binary, so that part relies on CI.

🤖 Generated with Claude Code

https://claude.ai/code/session_01N2vvE5XzurMvQfsX7Vz7bF

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vitest@​4.1.11 ⏵ 5.0.1	+1		+1
	vite@​8.0.16

View full report

[claude]

Looks good, straightforward dev-dependency version bump. What was reviewed: package.json/yarn.lock diff for the vitest 4->5 upgrade and the new explicit vite devDependency it now requires as a peer; confirmed the lockfile changes are limited to vite/vitest and their transitive deps with no unrelated or suspicious package/registry changes; no source, build config, or runtime dependency changes are involved.

Extended reasoning...

The change is confined to package.json and yarn.lock: bumping the vitest devDependency from ^4.1.5 to ^5.0.1 and adding vite ^8.0.16 as an explicit devDependency because vitest 5 now requires vite as a peer dependency rather than pulling it in transitively. No application code, CI config, or runtime dependencies are touched, and there is no security-sensitive surface (no auth, crypto, or data handling). The lockfile diff is consistent with a mechanical yarn install after the version bump, with all changed entries traceable to vite/vitest's transitive dependency tree. No open third-party objections exist in the PR timeline, and the mechanical nature of the change supports approval without requiring human review.

[electron-npm-package-publisher]

🎉 This PR is included in version 4.3.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀