chore(deps-dev): bump vitest from 2.1.9 to 3.2.6

[dependabot]

Bumps vitest from 2.1.9 to 3.2.6.

Release notes

Sourced from vitest's releases.

v3.2.6

   🐞 Bug Fixes

• Pin last supported vite-node version  -  by @​sheremet-va (16f12)

    View changes on GitHub

v3.2.5

   🚀 Features

• api: Add allowWrite and allowExec options to api [backport to v3]  -  by @​hi-ogawa and Codex in vitest-dev/vitest#10445 (af88b)

   🐞 Bug Fixes

• browser: Disable client cdp API when allowWrite/allowExec: false [backport to v3]  -  by @​hi-ogawa and Codex in vitest-dev/vitest#10456 (385a1)

    View changes on GitHub

v3.2.4

   🐞 Bug Fixes

• Use correct path for optimisation of strip-literal  -  by @​mrginglymus in vitest-dev/vitest#8139 (44940)
• Print uint and buffer as a simple string  -  by @​sheremet-va in vitest-dev/vitest#8141 (b86bf)
• browser:
  • Show a helpful error when spying on an export  -  by @​sheremet-va in vitest-dev/vitest#8178 (56007)
• cli:
  • vitest run --watch should be watch-mode  -  by @​AriPerkkio in vitest-dev/vitest#8128 (657e8)
  • Use absolute path environment on Windows  -  by @​colinaaa in vitest-dev/vitest#8105 (85dc0)
  • Throw error when --shard x/<count> exceeds count of test files  -  by @​AriPerkkio in vitest-dev/vitest#8112 (8a18c)
• coverage:
  • Ignore SCSS in browser mode  -  by @​sheremet-va in vitest-dev/vitest#8161 (0c3be)
• deps:
  • Update all non-major dependencies  -  in vitest-dev/vitest#8123 (93f32)
• expect:
  • Handle async errors in expect.soft  -  by @​lzl0304 in vitest-dev/vitest#8145 (68699)
• pool:
  • Auto-adjust minWorkers when only maxWorkers specified  -  by @​AriPerkkio in vitest-dev/vitest#8110 (14dc0)
• reporter:
  • task.meta should be available in custom reporter's errors  -  by @​AriPerkkio in vitest-dev/vitest#8115 (27df6)
• runner:
  • Preserve handler wrapping on extend  -  by @​pengooseDev in vitest-dev/vitest#8153 (a9281)
• ui:
  • Ensure ui config option works correctly  -  by @​lzl0304 in vitest-dev/vitest#8147 (42eeb)

    View changes on GitHub

v3.2.3

   🚀 Features

• browser: Use base url instead of vitest  -  by @​sheremet-va in vitest-dev/vitest#8126 (1d8eb)

... (truncated)

Commits

• b6d56f8 chore: release v3.2.6
• 16f120d fix: pin last supported vite-node version
• 2cbad0a chore: release v3.2.5
• 385a1ae fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
• af88b1f feat(api): add allowWrite and allowExec options to api [backport to v3]...
• c666d14 chore: release v3.2.4
• 8a18c8e fix(cli): throw error when --shard x/\<count> exceeds count of test files (#...
• 8abd7cc chore(deps): update tinypool (#8174)
• 93f3200 fix(deps): update all non-major dependencies (#8123)
• 0c3be6f fix(coverage): ignore SCSS in browser mode (#8161)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1329584

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[odinr]

Dependency Update Research

Signal	Notes
PR	#5212
Scope	manifest + lockfile — touches vitest devDependency range in 26 package.json files (root + most packages/*)
CI	rebase attempted, conflicted
Branch	not rebased — see below

Updated Dependencies

Dependency	From	To	Lane	Role
vitest	2.1.9	3.2.6	major	devDependency (test runner), monorepo-wide

Findings

• Rebasing onto current main produced a pnpm-lock.yaml conflict (expected — two other Dependabot lockfile-heavy merges landed on main just before this: simple-git chore(deps): bump simple-git from 3.35.2 to 3.36.0 #5211 and happy-dom chore(deps-dev): bump happy-dom from 18.0.1 to 20.8.9 #5215).
• Per .github/instructions/dependabot-pr.instructions.md ("If rebase conflicts occur, abort the rebase, mark the PR as needs-manual-intervention") and the solver skill's safety rule ("Never continue a conflicted Dependabot rebase by guessing"), I aborted rather than hand-resolving the lockfile.
• Scope risk beyond the conflict: this is a major bump of the test runner used across the entire monorepo, and main currently already resolves vitest inconsistently — root pulls in vitest@4.1.10 transitively (via @vitest/coverage-v8) while most packages still declare "vitest": "^2.0.5"-ish ranges directly. Bumping 26 manifests to ^3.2.6 narrows that gap but doesn't fully close it, and is exactly the kind of change that benefits from a full pnpm test && pnpm build && pnpm -w check pass, not a scoped one.
• Security: resolves Dependabot alerts build(deps-dev): bump @nrwl/nx-cloud from 15.0.0 to 15.0.2 #382 and build(deps): bump @ag-grid-enterprise/core from 28.1.1 to 28.2.1 #377 (critical — Vitest UI server arbitrary file read/execute when the UI is running).

Sources

• Changelog: https://github.com/vitest-dev/vitest/releases/tag/v3.2.6

---

Dependency Update Verdict

Signal	Notes
Recommendation	hold
Confidence	low
Action	needs review — not merged

Validation

Check	Status	Notes
Rebase	failed	pnpm-lock.yaml conflict, aborted per policy
pnpm build / pnpm test / pnpm -w check	skipped	not run — rebase didn't complete

Changesets

Package	Bump	File
—	not yet determined	needs the full manifest diff resolved first

Assessment

• Security: clear on the target version, but currently blocked from validating.
• Compatibility: unknown — major bump, monorepo-wide devDependency, needs a full test run once rebased.
• Impact: broad surface (26 packages) — recommend a maintainer rebase this manually (regenerate pnpm-lock.yaml via pnpm install after resolving, not a manual YAML merge) and run the full validation suite before merge.

Next Step

Awaiting manual rebase + full validation — flagged needs-manual-intervention, not merged.

[odinr]

Closing this as superseded — it's now stale relative to main.

main already bumped vitest to ^4.1.0 across nearly every package via a separate change; only packages/modules/state was missed (still ^2.0.5, resolving to the vulnerable 2.1.9). This PR's diff, based on an older main, would regress the other 25 packages from ^4.1.0 back down to ^3.2.6 while only bringing modules/state up to ^3.2.6 (still below the rest of the monorepo).

Applied a targeted fix instead: bumped only packages/modules/state's vitest devDependency to ^4.1.0 (matching everywhere else), which resolves to vitest@4.1.10 and clears alerts #382/#377. See the follow-up PR from branch fix/dependabot-security-alerts.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.