[dependabot]

Bumps the development group with 2 updates: @vitest/coverage-v8 and vitest.

Updates @vitest/coverage-v8 from 5.0.4 to 5.0.5

Release notes

Sourced from @​vitest/coverage-v8's releases.

v5.0.5

   🐞 Bug Fixes

• Keep vite default fs.deny with api token file  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11578 (28dc1)
• Handle quoted file names in --changed  -  by @​sheremet-va in vitest-dev/vitest#11583 (14921)
• Add data to the import.meta.hot stub  -  by @​sheremet-va in vitest-dev/vitest#11590 (3a828)
• Set skip in skipIf, ignore undefined options  -  by @​sheremet-va in vitest-dev/vitest#11591 (d523a)
• Skip builtin loading in async leak detector  -  by @​sheremet-va in vitest-dev/vitest#11598 (fe86a)
• Keep the import frame in native loader errors  -  by @​sheremet-va in vitest-dev/vitest#11599 (9697b)
• Run hook cleanups when a later hook fails  -  by @​sheremet-va in vitest-dev/vitest#11605 (6c5a4)
• Release mocks of finished test files  -  by @​sheremet-va in vitest-dev/vitest#11607 (e9c3d)
• Abort all running tests on cancel  -  by @​sheremet-va in vitest-dev/vitest#11606 (6621a)
• browser:
  • Ignore synthetic pagehide events  -  by @​sheremet-va in vitest-dev/vitest#11582 (ca081)
  • Run plugin buildStart on server creation  -  by @​sheremet-va in vitest-dev/vitest#11593 (ea611)
  • Drop late connections of closed sessions  -  by @​sheremet-va in vitest-dev/vitest#11600 (f161e)
  • Wait 30s for the browser to close  -  by @​sheremet-va in vitest-dev/vitest#11601 (6498b)
  • Run global setup once with instances  -  by @​sheremet-va in vitest-dev/vitest#11596 (8dd67)
• reporter:
  • End reason &[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8/issues/39);failed&[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8/issues/39); on worker crash  -  by @​AriPerkkio in vitest-dev/vitest#11568 (6ae8e)

    View changes on GitHub

Commits

• 7a825db chore: release v5.0.5 (#11609)
• See full diff in compare view

Updates vitest from 5.0.4 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

• Keep vite default fs.deny with api token file  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11578 (28dc1)
• Handle quoted file names in --changed  -  by @​sheremet-va in vitest-dev/vitest#11583 (14921)
• Add data to the import.meta.hot stub  -  by @​sheremet-va in vitest-dev/vitest#11590 (3a828)
• Set skip in skipIf, ignore undefined options  -  by @​sheremet-va in vitest-dev/vitest#11591 (d523a)
• Skip builtin loading in async leak detector  -  by @​sheremet-va in vitest-dev/vitest#11598 (fe86a)
• Keep the import frame in native loader errors  -  by @​sheremet-va in vitest-dev/vitest#11599 (9697b)
• Run hook cleanups when a later hook fails  -  by @​sheremet-va in vitest-dev/vitest#11605 (6c5a4)
• Release mocks of finished test files  -  by @​sheremet-va in vitest-dev/vitest#11607 (e9c3d)
• Abort all running tests on cancel  -  by @​sheremet-va in vitest-dev/vitest#11606 (6621a)
• browser:
  • Ignore synthetic pagehide events  -  by @​sheremet-va in vitest-dev/vitest#11582 (ca081)
  • Run plugin buildStart on server creation  -  by @​sheremet-va in vitest-dev/vitest#11593 (ea611)
  • Drop late connections of closed sessions  -  by @​sheremet-va in vitest-dev/vitest#11600 (f161e)
  • Wait 30s for the browser to close  -  by @​sheremet-va in vitest-dev/vitest#11601 (6498b)
  • Run global setup once with instances  -  by @​sheremet-va in vitest-dev/vitest#11596 (8dd67)
• reporter:
  • End reason &[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39);failed&[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39); on worker crash  -  by @​AriPerkkio in vitest-dev/vitest#11568 (6ae8e)

    View changes on GitHub

Commits

• 7a825db chore: release v5.0.5 (#11609)
• 6621a72 fix: abort all running tests on cancel (#11606)
• e9c3d72 fix: release mocks of finished test files (#11607)
• 8dd67c2 fix(browser): run global setup once with instances (#11596)
• 6c5a447 fix: run hook cleanups when a later hook fails (#11605)
• 9697b38 fix: keep the import frame in native loader errors (#11599)
• 6498b66 fix(browser): wait 30s for the browser to close (#11601)
• f161e6d fix(browser): drop late connections of closed sessions (#11600)
• fe86a64 fix: skip builtin loading in async leak detector (#11598)
• 6ae8e89 fix(reporter): end reason 'failed' on worker crash (#11568)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs changes before merge.

What this changes

Updates Vitest and its V8 coverage provider from 5.0.4 to 5.0.5, including matching lockfile dependencies.

Example: Run pnpm test on Windows with the updated lockfile.

• Before: Vitest 5.0.4 skips the POSIX-only path-prefix permission cases.
• After: Vitest 5.0.5 runs ten previously skipped cases, causing permission and path-separator assertions to fail.

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The dependency update has maintenance value, but its Windows guard incompatibility causes reproducible CI failures.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot-authored maintenance PR is outside the ordinary contributor proof gate; CI annotations establish the introduced test-selection defect without proving a repaired result.
Patch quality	🦪 silver shellfish (2/6)	1 actionable review finding remain.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Contributors rely on compatible test and coverage tooling to validate filesystem safety across platforms.
Reason: The matched patch update follows established dependency maintenance and stays within development tooling; repository policy correctly requires no maintenance-only changelog entry.

Regression provenance

Possible regression — probable (reviewed change; failure trace). No predecessor PR is attributed.

Merge readiness

⛔ Needs changes before merge - 1 item remains

Keep this PR open: main still uses Vitest 5.0.4, and the update introduces a Windows test-selection regression that must be repaired before merge.

Priority: P2
Reviewed head: e9ddc80137171aac19641293380e606d82d43381

Before merge

• Preserve Windows exclusions when upgrading Vitest (P2) - Vitest 5.0.5 deliberately makes skipIf(false) set skip:false, overriding an earlier chained skip. On Windows, itPosix starts skipped, but process.getuid?.() === 0 is false, so the declarations at test/path-prefix.test.ts:255, 277, and 296 become runnable. Their ten POSIX permission and separator cases then fail, exactly matching the Node 22/24/26 Windows and Windows coverage annotations. Combine the Windows and root-user predicates into one exclusion condition in those declarations so the update preserves platform selection.

Findings

• [P2] Preserve Windows exclusions when upgrading Vitest — pnpm-lock.yaml:210

Agent review details

How this fits together

Vitest executes fs-safe's development and CI test suites; its coverage provider collects coverage without becoming a shipped filesystem runtime dependency.

flowchart LR
  A[Package manifest] --> B[pnpm lockfile]
  B --> C[Vitest runner]
  C --> D[Platform test guards]
  D --> E[Filesystem test suites]
  E --> F[CI results and coverage]

Loading

Technical review

Best possible solution:

Keep the dependency update and combine the Windows and root-user exclusions in the three affected path-prefix test declarations.

Do we have a high-confidence way to reproduce the issue?

The upstream runner change and existing chained guards explain the exact-head Windows annotations; no target code was executed locally.

Is this the best way to solve the issue?

Updating the matched Vitest packages is reasonable, provided the existing tests express their combined exclusion explicitly.

Full review comments:

• [P2] Preserve Windows exclusions when upgrading Vitest — pnpm-lock.yaml:210
  Vitest 5.0.5 deliberately makes skipIf(false) set skip:false, overriding an earlier chained skip. On Windows, itPosix starts skipped, but process.getuid?.() === 0 is false, so the declarations at test/path-prefix.test.ts:255, 277, and 296 become runnable. Their ten POSIX permission and separator cases then fail, exactly matching the Node 22/24/26 Windows and Windows coverage annotations. Combine the Windows and root-user predicates into one exclusion condition in those declarations so the update preserves platform selection.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 5147654024a7.

Provenance checked

• Vitest and V8 coverage version alignment keeps the original intent (c8b1b73: The previous tooling refresh deliberately updated Vitest and coverage together while preserving runtime and cooldown policy.)

Testing

Proof path: unit tests only.

Security

None.

Evidence

Acceptance criteria:

• On Windows: pnpm test test/path-prefix.test.ts
• On non-root POSIX: pnpm test test/path-prefix.test.ts
• On root POSIX: pnpm test test/path-prefix.test.ts
• pnpm check
• git diff --check

What I checked:

• Verified PR scope: The introduced diff updates only the coverage-provider declaration and matching Vitest dependency resolutions; main retains version 5.0.4. (pnpm-lock.yaml:210, e9ddc8013717)
• Affected platform guards: itPosix uses it.runIf(platform is not Windows), but three path-prefix declarations subsequently call skipIf(root user); on Windows that second condition is false. (test/path-prefix.test.ts:255, e9ddc8013717)
• Dependency contract explains the regression: The target executes Vitest through its package scripts, making its runner contract directly relevant. fix: set skip in skipIf, ignore undefined options vitest-dev/vitest#11591 deliberately changes skipIf(false) to set skip:false, replacing an earlier chained skip; the upstream AGENTS.md was also inspected. (packages/vitest/src/runtime/runner/suite.ts, d523a15f2824)
• Exact-head Windows failures: Node 22, 24, and 26 Windows checks and Node 22 Windows coverage all report the same ten path-prefix failures at lines 268, 287, and 304, matching the three affected declarations. One check is https://github.com/openclaw/fs-safe/actions/runs/39293996946/job/118201656546. (test/path-prefix.test.ts:268, e9ddc8013717)
• Base comparison: The corresponding Windows Node checks and coverage passed on the pinned base, including https://github.com/openclaw/fs-safe/actions/runs/39264502787/job/118124124999. (5147654024a7)
• Existing tooling direction: build(deps): refresh test tooling and Alpine LLVM pin #992 previously updated Vitest and coverage together while preserving the Node floor and dependency cooldown; this update follows that established maintenance direction. (package.json:199, c8b1b732fe32)

Labels

Label changes:

• add P2: The update breaks Windows development and CI validation without changing the shipped filesystem API.
• add merge-risk: 🚨 automation: The dependency changes test-selection behavior, causing ten POSIX-only cases to execute on Windows and fail four validation jobs.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🌊 off-meta tidepool and patch quality is 🦪 silver shellfish.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Label justifications:

• P2: The update breaks Windows development and CI validation without changing the shipped filesystem API.
• merge-risk: 🚨 automation: The dependency changes test-selection behavior, causing ten POSIX-only cases to execute on Windows and fail four validation jobs.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🌊 off-meta tidepool and patch quality is 🦪 silver shellfish.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 19, 2026, 1:39 PM ET / 17:39 UTC.

[steipete]

Consolidated into #1015, including the required Vitest 5.0.5 test-gating adaptation. The combined update has passed the full check and cross-platform CI. Thanks for the update.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml