chore(deps-dev): bump vitest to 5 with regenerated bun.lock (fixes #982 CI)

TR
21d ago
+32-36

Fixes the CI failure on #982 (Dependabot: vitest 4.1.11 -> 5.0.1). Supersedes #982 if merged; #982 itself can then be closed.

What changed

  • package.json: Dependabot's commit from #982 cherry-picked unchanged (vitest ^4.1.2 -> ^5.0.1).
  • bun.lock: regenerated so bun install --frozen-lockfile passes. #982 changed only package.json, so every CI job died at Install dependencies (error: lockfile had changes, but lockfile is frozen). The lockfile diff (+31/-35) is limited to vitest and its transitive deps: vitest 5.0.2, @vitest/mocker + @vitest/spy 5.0.2, @vitest/expect/runner/snapshot/utils/pretty-format removed (inlined upstream), magic-string 1.x, tinybench 6, why-is-node-running 3, plus nested pins keeping existing consumers (vite, sucrase, @jridgewell) on their previous versions. Resolved against registry.npmjs.org (no private-registry URLs).
  • No config or test changes. Vitest 5 requires Vite >= 6.4 (lockfile has 8.0.3) and Node >= 22.12 (CI uses 22).

Vitest 5 migration checklist (https://vitest.dev/guide/migration)

  • clearMocks now default true: only worker.debug-sentry.test.js asserts call counts, and it already resets the mock in beforeEach; behavior unchanged.
  • Hoisted vi.mock must be top-level: both uses (worker.http-semantics, worker.debug-sentry) are top-level.
  • sequential removal, toThrow(""), expect.poll, fake timers, bench, deprecated entry points, projects/extends: not used.
  • .vitest/ artifacts dir: already in .gitignore.
  • vitest list is now static collection, so dynamic it.each/loop tests show as template names there; test-set comparison below uses real-run JSON reporter output instead.

Evidence (local, macOS arm64, bun 1.4.0, node 22.23)

  • bun install --frozen-lockfile on #982 head: fails (reproduced). On this branch: exit 0.
  • bun run build: exit 0.
  • vitest run base (main 8b1951c, vitest 4.1.2) vs this branch (vitest 5.0.2), JSON reporter: 59 files / 712 tests / 712 passed on both; 0 test names only in one side, 0 status differences.
  • Fault injection: altering one toThrow expectation in src/services/qr.test.js makes vitest 5 exit 1 (reverted), so failures are still detected.
  • Playwright E2E: local run 282 passed / 2 skipped (PW_PORT override, same head); CI E2E (Playwright) on this PR: both runs green.

Risk

Dev-dependency only; no runtime/Worker code changes. Main risk is a test-runner behavior change masking a regression; mitigated by identical test set and pass/fail status vs base and the fault-injection check.

Rollback

Revert this PR's merge commit (restores vitest 4 and the old lockfile).

Summary by cubic

Bumps vitest from ^4.1.2 to ^5.0.1 and regenerates bun.lock so bun install --frozen-lockfile passes in CI. Supersedes #982, which only changed package.json and caused every CI job to fail at the install step.

The lockfile diff is limited to vitest and its transitive deps; no config or test changes were needed.

Migration

  • Ran the vitest 5 migration checklist; none of the breaking changes apply to this repo.
  • Confirmed identical test results vs main (712/712 passing, no name or status differences); fault injection verified failures are still detected.