Skip to content

chore(deps-dev): bump vitest from 3.2.7 to 4.1.11 - #5409

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/vitest-4.1.11
Open

chore(deps-dev): bump vitest from 3.2.7 to 4.1.11#5409
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/vitest-4.1.11

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor

Bumps vitest from 3.2.7 to 4.1.11.

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

    View changes on GitHub

v4.1.10

   🐞 Bug Fixes

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

    View changes on GitHub

... (truncated)

Commits
  • 9bd8d46 chore: release v4.1.11 (#10995)
  • 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
  • db616d2 chore: release v4.1.10 (#10718)
  • bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
  • a7a61e7 chore: release v4.1.9 (#10598)
  • 934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
  • 7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
  • a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
  • e61f2dd chore: release v4.1.8
  • e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 31, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 31, 2026 17:10
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 31, 2026
@changeset-bot

changeset-bot Bot commented Aug 31, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 33170fa

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@github-actions github-actions Bot added 🚧 chore maintaines work, (update deps, workflos ...) 🧬 Modules labels Aug 31, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/vitest-4.1.11 branch 6 times, most recently from 33b2c1f to 4facb57 Compare August 31, 2026 20:14
Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 3.2.7 to 4.1.11.
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

---
updated-dependencies:
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@odinr
odinr force-pushed the dependabot/npm_and_yarn/vitest-4.1.11 branch from 4facb57 to 33170fa Compare September 1, 2026 06:37
@odinr

odinr commented Sep 1, 2026

Copy link
Copy Markdown
Collaborator

Dependency Update Research

Signal Notes
PR #5409
Scope manifest + lockfile
CI passing (re-running after rebase)
Branch rebased onto origin/main and force-pushed

Updated Dependencies

Dependency From To Lane Role
vitest 3.2.7 4.1.11 major test (devDependency of @equinor/fusion-framework-module-event)

Manifest change is limited to packages/modules/event/package.json: "vitest": "^3.2.7""^4.1.11".

Findings

  • Upstream changes: Vitest 4 is a major line with a reworked browser mode, changed default reporters, updated snapshot/spy semantics, and removal of several v3 deprecations.
  • Breaking changes: Vitest 4 does contain documented breaking changes relative to v3. However, the rest of this monorepo already runs Vitest 4 — the workspace root declares "vitest": "^4.1.10" and the installed root resolution is already 4.1.11. This PR therefore aligns the last remaining v3 holdout rather than performing a v3→v4 migration, which materially reduces the practical risk.
  • Security: No GitHub advisories affecting vitest@4.1.11. Package is not deprecated.
  • Release age: 4.1.11 published 2026-08-18T14:27Z — approximately 328 hours old, well past the 48-hour threshold.
  • Affected packages: @equinor/fusion-framework-module-event only, and only in devDependencies. Test tooling is not part of the package's published output.
  • Validation signal: the full suite is green on the rebased branch (182 test files / 1358 tests, 88/88 build tasks, Biome clean).

Sources

@odinr

odinr commented Sep 1, 2026

Copy link
Copy Markdown
Collaborator

Dependency Update Verdict

Signal Notes
Recommendation hold
Confidence low
Action needs review

Validation

Check Status Notes
pnpm build pass 88/88 turbo tasks successful
pnpm test pass 182 test files, 1358 tests passed
pnpm -w check pass Biome checked 2167 files, no fixes applied

Executed as the required sequence pnpm test && pnpm build && pnpm -w check (exit 0).

Changesets

Package Bump File
@equinor/fusion-framework-module-event none not required

vitest is a devDependency and test tooling only — it does not affect the published output of @equinor/fusion-framework-module-event. This matches the documented skip rule for devDependency changes in non-cookbook packages.

Assessment

  • Security: clear - No advisories affect vitest@4.1.11; not deprecated; release is ~328 hours old.
  • Compatibility: concern - This is a major version bump (3.x4.x). Mitigating context: the workspace root and every other package already run Vitest ^4.1.10, so this only aligns the last v3 holdout, and the full suite passes.
  • Impact: clear - Scoped to one package's devDependencies; no published runtime surface is affected.

Next Step

Awaiting manual review because this is a major version bump. The batch policy in .github/instructions/dependabot-pr.instructions.md classifies any major bump as low confidence and explicitly forbids auto-merging it, so this PR was not merged despite fully green validation.

Recommendation for a maintainer: this is a low-risk major in practice — it is a version-alignment catch-up to the Vitest 4 line the rest of the monorepo already uses, and validation is green. A maintainer can merge it after a quick confirmation that no v3-specific test APIs remain in packages/modules/event.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

🚧 chore maintaines work, (update deps, workflos ...) dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code 🧬 Modules

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant