Skip to content

chore(deps): bump the npm_and_yarn group across 5 directories with 4 updates - #700

Merged
proffesor-for-testing merged 7 commits into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-40823a7ab7
Sep 22, 2026
Merged

proffesor-for-testing merged 7 commits into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-40823a7ab7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 2 updates in the / directory: @vitest/mocker and adm-zip.
Bumps the npm_and_yarn group with 2 updates in the /.agents/skills/ruflo directory: @vitest/mocker and adm-zip.
Bumps the npm_and_yarn group with 2 updates in the /.agents/skills/ruflo/plugins/ruflo-graph-intelligence directory: @vitest/mocker and qs.
Bumps the npm_and_yarn group with 1 update in the /.agents/skills/ruflo/ruflo/src/ruvocal directory: devalue.
Bumps the npm_and_yarn group with 1 update in the /.agents/skills/ruflo/v3 directory: @vitest/mocker.

Updates @vitest/mocker from 4.1.4 to 5.0.1

Release notes

Sourced from @​vitest/mocker's releases.

v5.0.1

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

v5.0.0

Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

   🚨 Breaking Changes

... (truncated)

Commits

Updates adm-zip from 0.6.0 to 0.6.1

Release notes

Sourced from adm-zip's releases.

v0.6.1

Full Changelog: cthackers/adm-zip@v0.6.0...v0.6.1

  • Updated dev dependencies
  • Fixed uncaught crash in async decompression on malformed DEFLATE data
  • Fixed addLocalFolder following symlinks out of the archived folder
  • Stripped setuid/setgid/sticky bits from extracted file permissions
  • Enforced the decompression size cap on the async path and for size 0
  • Rejected archives with duplicate entry names
  • Blocked extraction from writing through symlinks inside the target
  • Routed malformed-header parse errors through the async callback
  • Rejected zip entries whose declared data extent runs past the buffer
  • Fixed addLocalFolderPromise hanging on empty folders and swallowing errors
  • Fixed addLocalFolderAsync2 mangling local paths on Windows
Commits
  • cb2cf9b Fixed addLocalFolderAsync2 mangling local paths on Windows
  • 54902b6 Fixed addLocalFolderPromise hanging on empty folders and swallowing errors
  • 73131bd Fixed CI
  • 758898d Rejected zip entries whose declared data extent runs past the buffer
  • 74b6e9f Routed malformed-header parse errors through the async callback
  • eaa35fa Blocked extraction from writing through symlinks inside the target
  • 1e015e3 Increment version
  • 05101d4 Rejected archives with duplicate entry names
  • 4916006 Enforced the decompression size cap on the async path and for size 0
  • 6a63c33 Stripped setuid/setgid/sticky bits from extracted file permissions
  • Additional commits viewable in compare view

Updates @vitest/mocker from 3.2.6 to 5.0.1

Release notes

Sourced from @​vitest/mocker's releases.

v5.0.1

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

v5.0.0

Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

   🚨 Breaking Changes

... (truncated)

Commits

Updates adm-zip from 0.6.0 to 0.6.1

Release notes

Sourced from adm-zip's releases.

v0.6.1

Full Changelog: cthackers/adm-zip@v0.6.0...v0.6.1

  • Updated dev dependencies
  • Fixed uncaught crash in async decompression on malformed DEFLATE data
  • Fixed addLocalFolder following symlinks out of the archived folder
  • Stripped setuid/setgid/sticky bits from extracted file permissions
  • Enforced the decompression size cap on the async path and for size 0
  • Rejected archives with duplicate entry names
  • Blocked extraction from writing through symlinks inside the target
  • Routed malformed-header parse errors through the async callback
  • Rejected zip entries whose declared data extent runs past the buffer
  • Fixed addLocalFolderPromise hanging on empty folders and swallowing errors
  • Fixed addLocalFolderAsync2 mangling local paths on Windows
Commits
  • cb2cf9b Fixed addLocalFolderAsync2 mangling local paths on Windows
  • 54902b6 Fixed addLocalFolderPromise hanging on empty folders and swallowing errors
  • 73131bd Fixed CI
  • 758898d Rejected zip entries whose declared data extent runs past the buffer
  • 74b6e9f Routed malformed-header parse errors through the async callback
  • eaa35fa Blocked extraction from writing through symlinks inside the target
  • 1e015e3 Increment version
  • 05101d4 Rejected archives with duplicate entry names
  • 4916006 Enforced the decompression size cap on the async path and for size 0
  • 6a63c33 Stripped setuid/setgid/sticky bits from extracted file permissions
  • Additional commits viewable in compare view

Updates @vitest/mocker from 3.2.7 to 5.0.1

Release notes

Sourced from @​vitest/mocker's releases.

v5.0.1

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

v5.0.0

Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

   🚨 Breaking Changes

... (truncated)

Commits

Updates qs from 6.15.2 to 6.16.0

Changelog

Sourced from qs's changelog.

6.16.0

  • [New] stringify: add a depth option to bound recursion depth (default Infinity)
  • [Fix] stringify: serialize Date values when a filter is provided
  • [Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set
  • [Fix] parse: flatten a collection appended to an overflowed array (#571)
  • [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
  • [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties
  • [Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
  • [Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded
  • [Docs] clarify arrayLimit is a representation threshold, not an element-count cap
  • [Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit
  • [Tests] stringify: pin current encodeDotInKeys separator-dot behavior
  • [Dev Deps] update @ljharb/eslint-config, eslint
  • [Dev Deps] update eslint, evalmd

6.15.3

  • [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
  • [Fix] utils: respect encoding of surrogate pairs across chunks (#559)
  • [Robustness] parse: throw the arrayLimit error before splitting oversized comma values
  • [Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
  • [Robustness] utils: enforce arrayLimit consistently across merge's array paths
  • [Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
  • [Deps] update side-channel
  • [Dev Deps] update eslint, mock-property, tape
  • [Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)
Commits
  • bb9379e v6.16.0
  • 62fd254 [Fix] stringify: serialize Date values when a filter is provided
  • 8859c37 [Fix] parse: enforce arrayLimit on comma groups under []= when `throwOn...
  • 8079adc [Tests] parse: remove a test that pinned []= comma groups escaping `array...
  • d56f48c [Fix] parse: flatten a collection appended to an overflowed array
  • e83d321 [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
  • 7e87a07 [Dev Deps] update @ljharb/eslint-config, eslint
  • 9a76af2 [Dev Deps] update eslint, evalmd
  • 3a890d4 [Dev Deps] update eslint, evalmd
  • b433a9b [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or dro...
  • Additional commits viewable in compare view

Updates devalue from 5.9.0 to 5.9.4

Release notes

Sourced from devalue's releases.

v5.9.4

Patch Changes

  • 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

v5.9.3

Patch Changes

  • 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
  • 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
  • dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
  • 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
  • 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
  • 8f8d78e: fix: validate revived backing buffers before constructing typed arrays
  • 46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

v5.9.2

Patch Changes

  • 8b2a456: fix: reject out-of-bounds indices

v5.9.1

Patch Changes

  • 39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references
  • 686e379: fix: emit valid JS for Node Buffer in uneval
  • 376b65c: fix: preserve -0 in float typed arrays in uneval
Changelog

Sourced from devalue's changelog.

5.9.4

Patch Changes

  • 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

5.9.3

Patch Changes

  • 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
  • 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
  • dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
  • 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
  • 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
  • 8f8d78e: fix: validate revived backing buffers before constructing typed arrays
  • 46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

5.9.2

Patch Changes

  • 8b2a456: fix: reject out-of-bounds indices

5.9.1

Patch Changes

  • 39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references
  • 686e379: fix: emit valid JS for Node Buffer in uneval
  • 376b65c: fix: preserve -0 in float typed arrays in uneval
Commits

Updates @vitest/mocker from 4.1.8 to 5.0.1

Release notes

Sourced from @​vitest/mocker's releases.

v5.0.1

   🚀 Features

   🐞 Bug Fixes

…updates

Bumps the npm_and_yarn group with 2 updates in the / directory: [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) and [adm-zip](https://github.com/cthackers/adm-zip).
Bumps the npm_and_yarn group with 2 updates in the /.agents/skills/ruflo directory: [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) and [adm-zip](https://github.com/cthackers/adm-zip).
Bumps the npm_and_yarn group with 2 updates in the /.agents/skills/ruflo/plugins/ruflo-graph-intelligence directory: [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) and [qs](https://github.com/ljharb/qs).
Bumps the npm_and_yarn group with 1 update in the /.agents/skills/ruflo/ruflo/src/ruvocal directory: [devalue](https://github.com/sveltejs/devalue).
Bumps the npm_and_yarn group with 1 update in the /.agents/skills/ruflo/v3 directory: [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker).


Updates `@vitest/mocker` from 4.1.4 to 5.0.1
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.1/packages/mocker)

Updates `adm-zip` from 0.6.0 to 0.6.1
- [Release notes](https://github.com/cthackers/adm-zip/releases)
- [Changelog](https://github.com/cthackers/adm-zip/blob/master/history.md)
- [Commits](cthackers/adm-zip@v0.6.0...v0.6.1)

Updates `@vitest/mocker` from 3.2.6 to 5.0.1
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.1/packages/mocker)

Updates `adm-zip` from 0.6.0 to 0.6.1
- [Release notes](https://github.com/cthackers/adm-zip/releases)
- [Changelog](https://github.com/cthackers/adm-zip/blob/master/history.md)
- [Commits](cthackers/adm-zip@v0.6.0...v0.6.1)

Updates `@vitest/mocker` from 3.2.7 to 5.0.1
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.1/packages/mocker)

Updates `qs` from 6.15.2 to 6.16.0
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.2...v6.16.0)

Updates `devalue` from 5.9.0 to 5.9.4
- [Release notes](https://github.com/sveltejs/devalue/releases)
- [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md)
- [Commits](sveltejs/devalue@v5.9.0...v5.9.4)

Updates `@vitest/mocker` from 4.1.8 to 5.0.1
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.1/packages/mocker)

---
updated-dependencies:
- dependency-name: "@vitest/mocker"
  dependency-version: 5.0.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: adm-zip
  dependency-version: 0.6.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@vitest/mocker"
  dependency-version: 5.0.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: adm-zip
  dependency-version: 0.6.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@vitest/mocker"
  dependency-version: 5.0.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: devalue
  dependency-version: 5.9.4
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@vitest/mocker"
  dependency-version: 5.0.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 20, 2026
@github-actions

Copy link
Copy Markdown

MCP Tools Test Summary

Validation Results

  • Validation report not found

Unit Test Results

  • Handlers: failure
  • Security: failure
  • Tools/Transport: failure
  • Root: failure

Other Results

  • Integration Tests: failure
  • Validation: failure

@github-actions

github-actions Bot commented Sep 20, 2026 •

Copy link
Copy Markdown

Test Suite Metrics

CI Test Metrics

Date: 2026-09-22 16:00:50 UTC
Commit: 085687c

Current State

  • Total test files: 1025 (target: 50)
  • Total lines: 424594 (target: 40,000)
  • Files > 600 lines: 229 (target: 0)
  • Skipped tests: 78 (target: 0)

Progress from Baseline

  • Files reduced: -599 (--140%)
  • Lines reduced: -216341 (--103%)

Generated by Optimized CI

…ge-alignment

fix(deps): align coverage provider with Vitest 5 for #700
@github-actions

Copy link
Copy Markdown

MCP Tools Test Summary

Validation Results

  • Validation report not found

Unit Test Results

  • Handlers: success
  • Security: success
  • Tools/Transport: success
  • Root: success

Other Results

  • Integration Tests: success
  • Validation: success

@github-actions

Copy link
Copy Markdown

MCP Tools Test Summary

Validation Results

  • Validation report not found

Unit Test Results

  • Handlers: success
  • Security: success
  • Tools/Transport: success
  • Root: success

Other Results

  • Integration Tests: success
  • Validation: success

@proffesor-for-testing

Copy link
Copy Markdown
Owner

Blocked after syncing with main. With #708 merged in, the branch installs and builds, and every check passes except Journey — Root-level, which fails 4 cases in tests/integration/test-runner-outcomes.test.ts: healthy, skip-only, and todo-only suites come back as status: failed, failed: 1.

Root cause (reproduced with a scratch install of vitest@5.0.1): Vitest 5's --reporter=json no longer writes the report to stdout. It writes to .vitest/json/output.json and prints only JSON report written to <path>. Both of our runner integrations parse stdout:

  • src/domains/test-execution/services/test-executor.ts (['vitest', 'run', ...files, '--reporter=json', '--no-color'], then parseVitestOutput(stdout, ...))
  • src/coordination/handlers/test-execution-handlers.ts (spawnSync('npx', ['vitest', 'run', ...testFiles, '--reporter=json']))

So under Vitest 5 there is no JSON on stdout, the parse falls through, and (correctly, since #699) the run is reported as a runner failure instead of a fabricated pass. This affects any user project on Vitest 5, not just our own CI, so it needs a product fix before this bump can land: pass --outputFile=<tmp> (supported by both v4 and v5) and read the file, or parse the JSON report written to path as a fallback. Not merging until that is in.

…itest 5

Vitest 5's --reporter=json no longer prints the report to stdout; it writes
.vitest/json/output.json and prints only "JSON report written to <path>".
Every runner integration parsed stdout, so under Vitest 5 a healthy suite was
reported as a runner failure (caught by tests/integration/test-runner-outcomes
on #700's CI). Vitest 4 behaves the same way once --outputFile is passed, so
an explicit per-run --outputFile gives both majors one contract.

Add src/shared/vitest-json-report.ts (unique temp report path, read-back with
stdout fallback, cleanup on every exit path) and route all vitest run
--reporter=json spawn sites through it: TestExecutorService, the execute-tests
MCP task handler, RetryHandlerService, FlakyTestDetector, and the
test-scheduling VitestExecutor. Jest, Mocha and node:test paths are unchanged.

Not changed: metric-collector/test-counter.ts uses `vitest list
--reporter=json`, a different command whose output was already unusable on
Vitest 4; tracked separately.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

MCP Tools Test Summary

Validation Results

  • Validation report not found

Unit Test Results

  • Handlers: success
  • Security: success
  • Tools/Transport: success
  • Root: success

Other Results

  • Integration Tests: success
  • Validation: success

…tFile

The runner-outcome integrity test proves each failure class by spawning Vitest
directly and parsing its JSON report; Vitest 5 no longer prints that report to
stdout, so read it from --outputFile like the product code does.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

MCP Tools Test Summary

Validation Results

  • Validation report not found

Unit Test Results

  • Handlers: success
  • Security: success
  • Tools/Transport: success
  • Root: success

Other Results

  • Integration Tests: success
  • Validation: success

…ommand

Codex review: with testRunner 'vitest' and args starting at 'run', the
argument-only check missed Vitest and left the detector parsing Vitest 5's
stdout notice. Include the runner command in detection and accept
path-qualified or .cmd runner names.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

MCP Tools Test Summary

Validation Results

  • Validation report not found

Unit Test Results

  • Handlers: success
  • Security: success
  • Tools/Transport: success
  • Root: success

Other Results

  • Integration Tests: success
  • Validation: success

@proffesor-for-testing proffesor-for-testing left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed and fixed. The bump itself is fine (#708 aligned the coverage provider); the initial red was a real product incompatibility: Vitest 5's --reporter=json writes the report to a file instead of stdout, and every runner integration parsed stdout. Fixed by requesting an explicit per-run --outputFile (identical behavior on Vitest 4, verified) in the test executor, the execute-tests MCP handler, the retry handler, the flaky detector, and the scheduling executor, via a shared src/shared/vitest-json-report.ts helper with cleanup on every exit path. Codex adversarial pass found one gap (flaky detector's runner-command detection), fixed. All 31 checks green on this head; the one Coverage Analysis red was a Math.random Thompson-sampling convergence flake (0.599 vs 0.6) that passed on re-run.

@proffesor-for-testing
proffesor-for-testing merged commit 51093a0 into main Sep 22, 2026
44 of 45 checks passed
@proffesor-for-testing

Copy link
Copy Markdown
Owner

Merged. Note for anyone reading later: this bump surfaced a genuine incompatibility. Vitest 5 no longer prints the JSON report to stdout, so every place Agentic QE spawns vitest run --reporter=json now passes an explicit --outputFile and reads it back (same behavior on Vitest 4). Without that, aqe test execute and the test_execute_parallel MCP tool misreported every Vitest 5 project. Thanks @rudycelekli for #708, which unblocked the install so CI could catch this.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-40823a7ab7 branch September 22, 2026 16:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants