Skip to content

chore(deps-dev): bump vitest from 3.2.4 to 4.1.2#643

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/vitest-4.1.2
Closed

chore(deps-dev): bump vitest from 3.2.4 to 4.1.2#643
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/vitest-4.1.2

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 26, 2026

Bumps vitest from 3.2.4 to 4.1.2.

Release notes

Sourced from vitest's releases.

v4.1.2

This release bumps Vitest's flatted version and removes version pinning to resolve flatted's CVE related issues (vitest-dev/vitest#9975).

   🐞 Bug Fixes

    View changes on GitHub

v4.1.1

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

v4.1.0

Vitest 4.1 is out!

... (truncated)

Commits
  • fc6f482 chore: release v4.1.2
  • 6f97b55 feat: disable colors if agent is detected (#9851)
  • b3c992c fix(coverage): correct coverageConfigDefaults values and types (#9940)
  • 7c06598 fix: ensure sequential mock/unmock resolution (#9830)
  • f54abad chore: add typo-checker skill and fix typos (#9963)
  • 7aa9377 fix: don't resolve setupFiles from parent directory (#9960)
  • 1f2d318 chore: release v4.1.1
  • ebfde79 refactor: rename matchesTagsFilter to matchesTags (#9956)
  • 5611500 feat(experimental): introduce experimental.vcsProvider (#9928)
  • eec53d9 feat(experimental): expose matchesTagsFilter to test if the current filter ...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for vitest since your current version.


@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 26, 2026
@dependabot dependabot bot requested a review from a team as a code owner March 26, 2026 17:43
@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Mar 26, 2026

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: lokalise/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: f4584fdc-64fa-4d96-95af-b2087f41bfc7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

The vitest development dependency version in package.json has been updated from ^3.2.4 to ^4.1.2. The test script and all other dependency entries remain unchanged.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and specifically describes the main change: bumping the vitest development dependency from version 3.2.4 to 4.1.2.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description check ✅ Passed The PR description clearly describes a dependency version bump from vitest 3.2.4 to 4.1.2, matching the changeset perfectly.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch dependabot/npm_and_yarn/vitest-4.1.2

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@package.json`:
- Line 44: package.json currently specifies an invalid/nonexistent vitest
version and a Vite version incompatible with Vitest v4; update the dependency
entries so vitest is set to a valid v4 release (e.g., "vitest": "^4.1.1"), bump
vite to a compatible major (e.g., "vite": "^6.0.0" or later), and ensure related
Vite config packages like `@lokalise/package-vite-config` are upgraded to a v4/v5
release that supports Vite v6+; then run install and verify tests/builds to
confirm compatibility.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: lokalise/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 57e4211a-f2d6-4478-9f63-0c891bee4226

📥 Commits

Reviewing files that changed from the base of the PR and between cd468d1 and 05051b8.

⛔ Files ignored due to path filters (1)
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (1)
  • package.json

"typescript": "^5.5.4",
"vite": "^5.4.11",
"vitest": "^3.2.4"
"vitest": "^4.1.2"
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== 1) Confirm declared vitest version in package.json =="
rg -nP '"vitest"\s*:\s*"\^?4\.1\.2"' package.json

echo
echo "== 2) Find lockfile(s) and confirm resolved vitest major =="
fd 'package-lock.json|pnpm-lock.yaml|yarn.lock'
rg -nP '(^\s*vitest@|"\s*vitest"\s*:\s*"|/vitest@4\.)' package-lock.json pnpm-lock.yaml yarn.lock 2>/dev/null || true

echo
echo "== 3) Locate Vitest config files =="
fd 'vitest\.config\.(ts|mts|cts|js|mjs|cjs)|vite\.config\.(ts|mts|cts|js|mjs|cjs)'

echo
echo "== 4) Search for potentially impacted Vitest config areas =="
rg -n -C2 'setupFiles|coverage|pool|sequence|threads|deps|mock|unmock|environmentMatchGlobs' \
  $(fd 'vitest\.config\.(ts|mts|cts|js|mjs|cjs)|vite\.config\.(ts|mts|cts|js|mjs|cjs)' || true) 2>/dev/null || true

echo
echo "Review expected: lockfile resolves vitest 4.x and config usage aligns with Vitest v4 docs."

Repository: lokalise/npm-package-template

Length of output: 621


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== 1) Content of vite.config.ts =="
cat -n vite.config.ts

echo
echo "== 2) Inspect package-lock.json around line 1101 to identify nested vitest@3.0.7 source =="
sed -n '1095,1110p' package-lock.json

echo
echo "== 3) Broader context: search for dependencies that might require vitest v3 =="
rg -B5 'vitest.*3\.0\.7' package-lock.json | head -30

echo
echo "== 4) Check if any other files import/use vitest test utilities =="
rg -l 'from.*vitest|import.*vitest' --type ts --type js --type tsx --type jsx 2>/dev/null | head -10

Repository: lokalise/npm-package-template

Length of output: 1723


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== 1) Find `@lokalise/package-vite-config` version in lockfile =="
rg -n '@lokalise/package-vite-config' package-lock.json | head -5

echo
echo "== 2) Show full entry for `@lokalise/package-vite-config` with its peer deps =="
# Extract the section for this package to see its vitest peer dep requirement
sed -n '/"@lokalise\/package-vite-config"/,/^        }/p' package-lock.json | head -30

echo
echo "== 3) Check package.json for `@lokalise/package-vite-config` version constraint =="
rg '@lokalise/package-vite-config' package.json

Repository: lokalise/npm-package-template

Length of output: 1256


🌐 Web query:

@lokalise/package-vite-config npm vitest v4 compatibility

💡 Result:

@lokalise/package-vite-config is a shared Vite configuration package from Lokalise, used in their npm-package-template for building NPM packages with both CJS and ESM outputs. It is configured for Vitest testing, as evidenced by tsconfig recommendations including "vitest.config.ts" and the template's use of Vite for testing and building. Vitest v4 requires Vite >=6.0.0 and Node.js >=20.0.0. No sources report specific compatibility issues with @lokalise/package-vite-config and Vitest v4. Lokalise packages like @lokalise/node-api and lokalise-file-exchange use Vitest ^4.0.3 in devDependencies, indicating compatibility within their ecosystem. The package was last noted published around 2025-12-24, post-Vitest v4 release (2025/2026). To use with Vitest v4, ensure Vite >=6 in the config (customizable via vite.config.ts overriding the shared config) and follow Vitest v4 migration for test setup. Standard Vite/Vitest configs share via vite.config.ts test property or separate vitest.config.ts.

Citations:


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== 1) Check Vite version in this repository's lockfile =="
rg -n '"vite"' package-lock.json | grep -E '^\s*[0-9]+:\s+"vite"' | head -5

echo
echo "== 2) Show root vite dependency =="
sed -n '/"vite": {/,/^        },$/p' package-lock.json | head -20

echo
echo "== 3) Check npm registry for `@lokalise/package-vite-config` versions =="
# Use jq if available, otherwise parse manually
curl -s 'https://registry.npmjs.org/@lokalise/package-vite-config' | python3 -c "import sys, json; data = json.load(sys.stdin); versions = list(data.get('versions', {}).keys()); print('\\n'.join(sorted(versions, key=lambda x: tuple(map(int, x.split('.')))) if all(c.isdigit() or c == '.' for v in versions for c in v) else sorted(versions)[-10:]))" 2>/dev/null || echo "Could not fetch npm registry"

Repository: lokalise/npm-package-template

Length of output: 804


🌐 Web query:

vitest 4.1.2 vite peer dependency requirement

💡 Result:

Vitest 4.1.2 does not appear to exist as of 2026-03-26. The latest version is 4.1.1 (published March 23, 2026). For Vitest 4.1.x series (including 4.1.0 and 4.1.1), the Vite peer dependency requirement is ^6.0.0 || ^7.0.0 || ^8.0.0. Vite is listed as both a regular dependency and a peer dependency in the package.json. Projects using Vitest must have a compatible Vite version installed, as Vitest relies on it for its module resolution and transformation capabilities.

Citations:


Vitest v4 upgrade blocked by incompatible Vite version; vitest@^4.1.2 does not exist.

Line 44 declares vitest@^4.1.2, but this version does not exist in npm (latest is 4.1.1). More critically, vitest 4.1.x requires vite@^6.0.0 || ^7.0.0 || ^8.0.0, but this repo is locked to vite@^5.4.11. This will cause installation and build failures.

To proceed with the vitest v4 upgrade:

  • Update vite to ^6.0.0 (or newer)
  • Correct vitest to ^4.1.1 (or appropriate 4.x version)
  • Verify @lokalise/package-vite-config is updated to v4.x or v5.x for Vite v6 compatibility
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@package.json` at line 44, package.json currently specifies an
invalid/nonexistent vitest version and a Vite version incompatible with Vitest
v4; update the dependency entries so vitest is set to a valid v4 release (e.g.,
"vitest": "^4.1.1"), bump vite to a compatible major (e.g., "vite": "^6.0.0" or
later), and ensure related Vite config packages like
`@lokalise/package-vite-config` are upgraded to a v4/v5 release that supports Vite
v6+; then run install and verify tests/builds to confirm compatibility.

@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/vitest-4.1.2 branch from 05051b8 to beddd95 Compare March 26, 2026 23:40
Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 3.2.4 to 4.1.2.
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.2/packages/vitest)

---
updated-dependencies:
- dependency-name: vitest
  dependency-version: 4.1.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/vitest-4.1.2 branch from beddd95 to 7cb0534 Compare April 2, 2026 08:25
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Apr 7, 2026

Superseded by #647.

@dependabot dependabot bot closed this Apr 7, 2026
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/vitest-4.1.2 branch April 7, 2026 17:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants