[patrickbrandao]

Summary

Supersedes Dependabot PR #116 (closed unmerged). Bumps vitest and @vitest/coverage-v8 in packages/frontend from ^5.0.0 to ^5.0.3. Both resolve to 5.0.4. This is a dev-only change with no runtime impact, so it needs no changeset.

Why #116 failed

Dependabot regenerated package-lock.json with npm 10. That added "peer": true to about 99 optional native packages (@emnapi/*, @esbuild/*, @napi-rs/* and others), so npm ci skipped them and vitest run exited 127. Running npm install --package-lock-only with npm 10.9.2 reproduces the bug locally (102 "peer": true entries).

How the lockfile was regenerated

• Started from main's package-lock.json and ran npm install --package-lock-only with npm 11.19.1, the npm major that Node 24 bundles and CI uses.
• The "peer": true count is 1 (node_modules/typescript), the same as on main.
• vitest, @vitest/coverage-v8, @vitest/spy and @vitest/mocker move from packages/frontend/node_modules/ to the root node_modules/.
• Transitive bumps: chai 6.3.0, obug 3.0.0, std-env 4.3.0, tinybench 6.2.2, tinyexec 1.3.1, tinyrainbow 3.2.0, why-is-node-running 3.2.1, @vitest/istanbul-lib-* 1.0.2, ast-v8-to-istanbul 1.0.7.
• Dropped: siginfo and stackback, which why-is-node-running 3 no longer uses.

Migration notes

Main is already on vitest 5, and I checked the vitest 5.0.3 migration guide via Context7. This bump needs no config changes: vite.config.ts uses none of the removed entrypoints or test.workspace.

Local test results (Node 26.9.0, npm 11.19.1)

npm ci                                      ok, node_modules/.bin/vitest -> 5.0.4
npm run build -w packages/shared            ok
npm run lint      -w packages/frontend      ok
npm run typecheck -w packages/frontend      ok
npm run build     -w packages/frontend      ok
npx vitest run (packages/frontend)          201 files / 4175 tests passed

🤖 Generated with Claude Code

[patrickbrandao]

Review: #146 chore(deps): bump vitest and @vitest/coverage-v8 to ^5.0.3

Diff reviewed: git diff origin/main...1e883c24855115ac14146392680521673112c67e

Blockers: none.

Should-fix: none.

Nits: none.

Checks

• packages/frontend/package.json: the vitest and @vitest/coverage-v8 ranges go from ^5.0.0 to ^5.0.3. The lockfile resolves both to 5.0.4.
• Lockfile: every resolved URL is on registry.npmjs.org, with no new "peer": true markers. The bump is dev-only, with no runtime effect, so qa-docker isn't needed.
• CI: the commit does have runs, so CI did run despite the GitHub outage. All 19 check runs on 1e883c2 are success.
• High risk: no criterion applies.

Merge order: merge #159 first. This PR conflicts with #159 in packages/frontend/package.json (the same lines are next to each other) and in package-lock.json. Once #159 lands, merge main into this branch and regenerate the lockfile with npm 11. That creates a new head, which needs CI green and a new review. This verdict covers only the SHA below.

Head revisado: 1e883c2
Veredito: aprovado

[patrickbrandao]

Re-review: #146 chore(deps): bump vitest and @vitest/coverage-v8 to ^5.0.3

Diff reviewed: git diff origin/main...82ac66d1f1d4e64a89ea8620533128cf9fc2d2ff. The previous review was at 1e883c2. This head merges main, which now includes #159 and #160, and regenerates the lockfile with npm 11.

Blockers: none.

Should-fix: none.

Nits: none.

Checks

• Against main, the PR now changes only two lines: the vitest and @vitest/coverage-v8 ranges in packages/frontend/package.json (^5.0.0 to ^5.0.3). The ranges chore(deps): bump the patch-and-minor group (supersedes #147) #159 bumped are kept.
• Lockfile:
  • The changed entries are the vitest family (vitest, @vitest/*, tinybench, nested magic-string).
  • npm also dropped the nested tinyexec copies under @changesets/cli and lint-staged, plus siginfo and stackback. Those changes are dedupe and the removal of vitest's old dependencies.
  • Every resolved URL is on registry.npmjs.org, and there are no "peer": true markers. That confirms the regenerated lockfile came from npm 11.
• The bump is dev-only, with no runtime change, so qa-docker isn't needed.
• CI on 82ac66d: all 20 check runs are success. That includes both e2e runs, both Docker builds, the compose smoke test, and the dependabot.yml validation.
• High risk: no criterion applies.

Head revisado: 82ac66d
Veredito: aprovado