chore: bump vitest from 4.1.11 to 5.0.1

[dependabot]

Bumps vitest from 4.1.11 to 5.0.1.

Release notes

Sourced from vitest's releases.

v5.0.1

   🚀 Features

• ui:
  • Move trace attempts selector to viewer header  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in vitest-dev/vitest#11189 (5dc4b)
  • Add focused trace view layout mode  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in vitest-dev/vitest#11190 (376dc)

   🐞 Bug Fixes

• Exit 1 when vitest list fails collection  -  by @​hamed-bavar in vitest-dev/vitest#11145 and vitest-dev/vitest#11146 (6108b)
• Keep parse error details in static collection  -  by @​hamed-bavar in vitest-dev/vitest#11150 and vitest-dev/vitest#11151 (7c818)
• Avoid recursive prototype in automocking  -  by @​sheremet-va in vitest-dev/vitest#11195 (99fc5)
• Prevent false Vitest import resolution  -  by @​sheremet-va in vitest-dev/vitest#11196 (b426c)
• Keep metadata file when clearing the cache  -  by @​sheremet-va in vitest-dev/vitest#11199 (73614)
• Correct typos in error message and comments  -  by @​shinji00222 and Shinji in vitest-dev/vitest#11187 (115c3)
• Resolve ResolvedConfig exactOptionalPropertyTypes errors  -  by @​LukeAbby in vitest-dev/vitest#11175 (498fb)
• Share the server on self-referencing extends  -  by @​sheremet-va in vitest-dev/vitest#11034 (23dda)
• Warn when deprecated deps.optimizer.web is used  -  by @​im10furry in vitest-dev/vitest#11214 (2ce29)
• browser:
  • Avoid double quotes in config.define  -  by @​sheremet-va in vitest-dev/vitest#11198 (972e2)
• doctor:
  • Measure vm pools for custom environments  -  by @​sheremet-va in vitest-dev/vitest#11212 (91ab1)
• expect:
  • Correct return value in toMatchAriaSnapshot  -  by @​sheremet-va in vitest-dev/vitest#11208 (c119b)
• fakeTimers:
  • Force queueMicrotask and nextTick in toNotFake  -  by @​kingmakeruix, kingmakeruix, Hiroshi Ogawa, Codex and @​hi-ogawa in vitest-dev/vitest#11261 (a47d7)
• snapshot:
  • Report obsolete keys next to skipped tests  -  by @​hamed-bavar, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#11157 and vitest-dev/vitest#11158 (17e2b)
• types:
  • Make public declarations self-contained  -  by @​ZoeySigel in vitest-dev/vitest#11141 (45546)
• ui:
  • Fix collapse/expand suite with file name search  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in vitest-dev/vitest#11260 (0a712)
  • Fix explorer file summary count  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in vitest-dev/vitest#11125 (05982)
• utils:
  • Fix deepMerge to handle prototype  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in vitest-dev/vitest#11215 (4944c)

    View changes on GitHub

v5.0.0

Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

   🚨 Breaking Changes

• Replace loupe.inspect with pretty-format  -  by @​hi-ogawa, Claude Opus 5 (1M context) and OpenAI Codex in vitest-dev/vitest#9609 (3f802)
• Remove quotes from string values in test.for/each title $ variable (take 2)  -  by @​hi-ogawa in vitest-dev/vitest#10170 (04d37)
• Default attachmentsDir from .vitest-attachements/ to .vitest/attachments/  -  by @​MdSadiqMd in vitest-dev/vitest#10186 (1ba73)
• Remove sequential test/suite options in favor of concurrent  -  by @​hi-ogawa and OpenAI Codex in vitest-dev/vitest#10198 (9229f)
• Represent locator as an object instead of a string  -  by @​sheremet-va in vitest-dev/vitest#10212 (80f07)
• Inline expect package  -  by @​sheremet-va in vitest-dev/vitest#10221 (ad162)
• Remove deprecated entry points  -  by @​sheremet-va in vitest-dev/vitest#10222 (994c6)

... (truncated)

Commits

• 03630a5 chore: release v5.0.1 (#11275)
• a47d790 fix(fakeTimers): force queueMicrotask and nextTick in toNotFake (#11261)
• 2ce29d5 fix: warn when deprecated deps.optimizer.web is used (#11214)
• ccd6d05 docs: fix typecheck exclude default in documentation (#11223)
• 91ab158 fix(doctor): measure vm pools for custom environments (#11212)
• 23dda73 fix: share the server on self-referencing extends (#11034)
• 498fbe9 fix: resolve ResolvedConfig exactOptionalPropertyTypes errors (#11175)
• 115c3f6 fix: correct typos in error message and comments (#11187)
• 7361465 fix: keep metadata file when clearing the cache (#11199)
• 972e24b fix(browser): avoid double quotes in config.define (#11198)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

Claude finished @dependabot[bot]'s task in 2m 11s —— View job

---

Dependency review: vitest 4.1.11 → 5.0.1

• Identify the version jump and whether it crosses a major
• Check vitest config + test API usage against v5 breaking changes
• Verify the suite (via CI — local npm ci is blocked in this sandbox)
• Post review findings

Verdict: safe to merge. This crosses a major (4 → 5), but none of the v5 breaking changes touch code in this repo.

What changed

vitest ^4.1.10 → ^5.0.1 (devDependency only — nothing ships to consumers). The lockfile churn is mostly v5 inlining its own sub-packages: @vitest/expect, @vitest/runner, @vitest/snapshot, @vitest/utils, @vitest/pretty-format, tinyrainbow, pathe all disappear as separate entries. Transitively vite 8.2.2 → 8.3.0 and chai 5 → 6.2.2.

Breaking changes vs. this repo

v5 breaking change	Impact
loupe.inspect → pretty-format	None — no snapshots anywhere, and no test asserts on vitest-rendered diff output
$ variable quoting in test.for/each titles	None — the two it.each blocks (test/tools/execute-action.test.ts:445, :487) use printf %s, not $var
sequential test/suite option removed	Not used
attachmentsDir default moved	Not used
Deprecated entry points removed	None — every test imports from bare "vitest"; no vitest/node, @vitest/expect, etc.
Locator as object / browser mode	Not used
expect package inlined, chai 6	Matchers in use are all stable (toBe, toEqual, toHaveBeenCalledWith, toThrow, toMatchObject, …)

There's no vitest.config.* in the repo at all, so there's no config surface to break — the suite runs on v5 defaults. Worth noting that a silent collection failure would have been caught anyway: vitest run exits non-zero when no test files match, and CI is green on both Node 22 and 24.

One thing to be aware of (not a blocker)

vitest 5 raised its own engine floor:

"engines": { "node": "^22.12.0 || ^24.0.0 || >=26.0.0" }   // was ^20.0.0 || ^22.0.0 || >=24.0.0

package.json declares engines.node: ">=22", so Node 22.0–22.11 now satisfies this repo's floor but not vitest's. A contributor on such a version gets an EBADENGINE warning from npm ci and a dev-time-only breakage. CI is unaffected — node-version: '22' resolves to the latest 22.x, well past 22.12.

I'd leave engines alone. It describes the runtime floor for the published server, which genuinely is still Node 22.0, and CLAUDE.md makes raising it a deliberate six-file change (package.json, manifest.json, README.md, ci.yml, update-catalog.yml, @types/node) rather than something to do as a side effect of a devDependency bump. Flagging it only so the mismatch isn't a surprise later.

Other repo-policy checks

• @types/node stays at ^22.0.0, tracking the Node floor as CLAUDE.md requires. vitest 5 peer-depends on ^22.0.0 || >=24.0.0, so the pin is satisfied without loosening it. Dependabot's major-ignore rule for @types/node held — nothing here bypassed it.
• No source or test changes were needed, and the PR touches only package.json / package-lock.json. No workflow files, so no action-pinning concerns.
• typescript/strict untouched.

Note on verification

I could not run npm ci / npm test locally — network installs aren't permitted in this environment. The green CI run above (build + test on Node 22 and 24, plus the .mcpb smoke test) is the evidence here, not a local run.
· branch