chore(deps): update vitest to v5.0.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@vitest/coverage-v8 (source)	5.0.1 → 5.0.3
vitest (source)	5.0.1 → 5.0.3

---

Release Notes

vitest-dev/vitest (@​vitest/coverage-v8)

v5.0.3

Compare Source

   🐞 Bug Fixes

• Isolate result.status between repeats runs  -  by @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in #​11218 (5dbeb)
• Don't print an interceptor warning in browser mode  -  by @​sheremet-va in #​11377 (15cc0)
• Don't retry when test.fails expectedly failed  -  by @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in #​11219 (b2458)
• Scope cache key generators to projects  -  by @​ecoyoung in #​11281 and #​11301 (92ba7)
• browser:
  • Delay server listen until tests start running  -  by @​sheremet-va in #​11366 (7d8ed)
  • Check mock path boundaries  -  by @​saryn17, Ryosei Sato and @​sheremet-va in #​11361 and #​11362 (1c388)
  • Keep config of browser-consumed environments  -  by @​kasperpeulen and Claude in #​11378 (aafc0)
  • Ignore page crash while cancelling  -  by @​sheremet-va in #​11386 (7c367)
  • toMatchScreenshot uses wrong reference on retried tests  -  by @​macarie in #​11393 (c22ab)
• cache:
  • Revalidate imports of cached modules  -  by @​sheremet-va in #​11381 (38f98)
• deps:
  • Pin why-is-node-running to 3.2.1 to avoid users running into ERR_PNPM_TRUST_DOWNGRADE  -  by @​AriPerkkio in #​11403 (f6c9a)
• expect:
  • Pass current equality testers to expect.extend asymmetric matchers  -  by @​hi-ogawa, Hiroshi Ogawa and Claude in #​11401 (3e794)
• jsdom:
  • Support Blob on jsdom 30.1  -  by @​sheremet-va in #​11379 (6c49b)
• pool:
  • Preserve unique pool ids when groupOrder is set  -  by @​mtorp in #​11392 (50312)
• ui:
  • Split-pane handle overlapping iframe  -  by @​macarie in #​11221 (f91db)
• vitest:
  • Remove root temp dir on close  -  by @​abhinav-phi in #​11248 (7c711)
• vm:
  • Do not optimize deps from index.html  -  by @​ezefernandezyf, Hiroshi Ogawa and Codex (GPT-6) in #​11329 and #​11360 (caf28)
  • Don't reuse scripts across vite environments  -  by @​MO2k4, Martin Oehlert and Claude in #​11395 (346d3)

    View changes on GitHub

v5.0.2

Compare Source

   🐞 Bug Fixes

• Bind process in case global is overwritten  -  by @​AriPerkkio in #​11343 (0b792)
• detect-async-leaks:
  • Ignore process.stdio handles  -  by @​AriPerkkio in #​11333 (0fd6b)
• expect:
  • Fix toMatchObject with asymmetric matchers  -  by @​ShreeBohara, Claude Opus 5, @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-5) in #​11100 (42523)
• jsdom:
  • Fix Request with Blob body on jsdom 28+  -  by @​harshit-d3v in #​11295 (d1c3e)
• reporter:
  • agent to respect --silent  -  by @​Raj4478 and @​AriPerkkio in #​11271 (5b95e)
• reporters:
  • Handle concurrent createReport calls  -  by @​7rulnik in #​11278 (e8e55)
  • hanging-process to use ESM entrypoint  -  by @​AriPerkkio in #​11316 (4e91e)
• spy:
  • Fix stack overflow when spying Set.prototype.add  -  by @​fengmk2 in #​11299 (a0a93)
• ui:
  • Persist authentication cookie beyond current browser session  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #​11066 (f8819)

    View changes on GitHub

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • Between 09:00 AM and 06:59 PM, Monday through Friday (* 9-18 * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: fa83ee7

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

🤖 Claude Dependency Review

✅ Recommended Actions

None — safe to merge as-is. This is a routine patch update with bug fixes and no breaking changes.

📦 Update Summary

• Libraries: vitest and @​vitest/coverage-v8
• Version: 5.0.1 → 5.0.3
• Change Type: Patch (two patch releases: 5.0.2 and 5.0.3)

📝 Release Notes

Release notes for both versions:

• v5.0.3 Release Notes
• v5.0.2 Release Notes
• Full comparison: v5.0.1...v5.0.3

🔐 Security Assessment

• Risk: 🟢 Low
• Known vulnerabilities: None found for versions 5.0.1, 5.0.2, or 5.0.3
• Supply-chain notes:
  • No maintainer or ownership changes detected
  • No suspicious lifecycle scripts introduced
  • No unexpected new dependencies
  • Normal patch release cadence

Previous vulnerabilities (already fixed in 5.0.1):

• CVE-2026-84373 / GHSA-82fw-gwwq-j7x9: Path traversal via @​vitest/mocker (fixed in 4.1.11+, 5.0.1 already includes fix)
• GHSA-5xrq-8626-4rwp: Arbitrary file read/execution via UI server (requires 5.0.1+, already satisfied)

Note: Version 5.0.1 (current) already contains all critical security fixes. This update adds bug fixes and reliability improvements only.

🚨 Breaking Changes

None. Both 5.0.2 and 5.0.3 are patch releases containing only bug fixes.

✨ Main Changes

Bug Fixes in v5.0.3

Core Test Execution:

• Isolate result.status between repeats runs (#11218)
• Don't retry when test.fails expectedly failed (#11219)
• Scope cache key generators to projects (#11281)

Browser Mode:

• Delay server listen until tests start running (#11366)
• Check mock path boundaries (#11361)
• Keep config of browser-consumed environments (#11378)
• Ignore page crash while cancelling (#11386)
• toMatchScreenshot uses wrong reference on retried tests (#11393)

Other Improvements:

• Don't print interceptor warning in browser mode (#11377)
• Revalidate imports of cached modules (#11381)
• Pin why-is-node-running to 3.2.1 to avoid ERR_PNPM_TRUST_DOWNGRADE (#11403)
• Pass current equality testers to expect.extend asymmetric matchers (#11401)
• Support Blob on jsdom 30.1 (#11379)
• Preserve unique pool ids when groupOrder is set (#11392)
• Split-pane handle overlapping iframe in UI (#11221)
• Remove root temp dir on close (#11248)
• Don't reuse scripts across vite environments (#11395)

Bug Fixes in v5.0.2

Core Fixes:

• Bind process in case global is overwritten (#11343)
• Fix toMatchObject with asymmetric matchers (#11100)
• Fix Request with Blob body on jsdom 28+ (#11295)
• Fix stack overflow when spying Set.prototype.add (#11299)

Reporter & Detection:

• Ignore process.stdio handles in async leak detection (#11333)
• agent to respect --silent (#11271)
• Handle concurrent createReport calls (#11278)
• hanging-process to use ESM entrypoint (#11316)

UI:

• Persist authentication cookie beyond current browser session (#11066)

🔍 Impact Analysis

📁 Usage Locations

Both vitest and @​vitest/coverage-v8 are used extensively throughout the repository as devDependencies for testing purposes.

Usage Statistics:

• Test files: 469+ files containing test suites
• Test cases: 36,050+ individual tests across the codebase
• Mock usage: 1,376 occurrences of mocking APIs (vi.mock, vi.doMock, vi.useFakeTimers, vi.spyOn)
• Configuration files: 36 vitest.config.ts files across packages

Key Usage Patterns:

1. packages/sdk/vitest.config.ts (line 3)

   import { configDefaults, defineConfig } from "vitest/config";

   • Feature used: Vitest configuration API, project-based test organization
   • Impact: None — these are stable APIs with no changes in patch releases

2. packages/sdk/package.json (lines 238, 246)

   "@​vitest/coverage-v8": "5.0.3",
   "vitest": "5.0.3",

   • Feature used: Dev dependency for test execution and coverage reporting
   • Impact: None — version update only

3. Test files across all packages (469+ files)

   • Examples:
     • packages/sdk/src/vitest/plugin.test.ts
     • packages/sdk/src/configure/types/type.test.ts
     • packages/sdk/src/cli/commands/**/*.test.ts
     • example/e2e/**/*.test.ts
   • Features used:
     • Test globals (describe, test, it, expect)
     • Mocking (vi.mock, vi.spyOn, vi.useFakeTimers)
     • Custom test environments
     • Coverage reporting
     • Type testing
   • Impact: Bug fixes may improve test reliability, particularly:
     • Tests using test.fails will now behave correctly when retrying
     • Tests using mocks may be more reliable due to path boundary checks
     • Tests using coverage will benefit from cache revalidation fixes

4. vitest.config.ts files (36 files across packages)

   • Locations:
     • packages/sdk/vitest.config.ts
     • packages/shared/vitest.config.ts
     • packages/sdk-plugin-*/vitest.config.ts
     • packages/create-sdk/templates/*/vitest.config.ts
     • example/vitest.config.ts
     • llm-challenge/vitest.config.ts
   • Features used:
     • Project-based configuration
     • Custom environments
     • Coverage configuration with v8 provider
     • Type checking
     • Custom setup files
   • Impact: None — configuration APIs are stable

5. Vitest SDK integration (packages/sdk/src/vitest/)

   • Files providing test utilities for SDK users:
     • packages/sdk/src/vitest/index.ts - Main test utilities export
     • packages/sdk/src/vitest/plugin.ts - Custom vitest plugin
     • packages/sdk/src/vitest/mocks/ - Mock implementations for platform services
   • Impact: None — these use stable vitest APIs

Peer Dependency Compatibility:

From packages/sdk/package.json (line 252):

"vitest": ">=4"

The SDK declares a peer dependency on vitest >=4, and version 5.0.3 satisfies this requirement.

Summary:

All usage locations are for development and testing purposes only. Since vitest and @​vitest/coverage-v8 are:

• Listed as devDependencies (not production dependencies)
• Used exclusively for running tests
• Not part of the runtime code or distributed packages

The impact of this update is limited to the development/CI environment. The bug fixes in 5.0.2 and 5.0.3 may actually improve test reliability, particularly for:

• Tests that use test.fails with retry logic
• Tests that use mocks (improved path boundary validation)
• Tests running in projects with cache enabled (cache revalidation fixes)
• Browser mode tests (multiple stability improvements)

No code changes are required to adopt this update.

---

[pkg-pr-new]

Open in StackBlitz

@tailor-platform/create-sdk

pnpm add https://pkg.pr.new/tailor-platform/sdk/@tailor-platform/create-sdk@fa83ee7

@tailor-platform/eslint-plugin-sdk

pnpm add https://pkg.pr.new/tailor-platform/sdk/@tailor-platform/eslint-plugin-sdk@fa83ee7

@tailor-platform/sdk

pnpm add https://pkg.pr.new/tailor-platform/sdk/@tailor-platform/sdk@fa83ee7

@tailor-platform/sdk-plugin-frontend

pnpm add https://pkg.pr.new/tailor-platform/sdk/@tailor-platform/sdk-plugin-frontend@fa83ee7

@tailor-platform/sdk-plugin-seed

pnpm add https://pkg.pr.new/tailor-platform/sdk/@tailor-platform/sdk-plugin-seed@fa83ee7

@tailor-platform/sdk-plugin-setup

pnpm add https://pkg.pr.new/tailor-platform/sdk/@tailor-platform/sdk-plugin-setup@fa83ee7

@tailor-platform/sdk-plugin-tailordb-erd

pnpm add https://pkg.pr.new/tailor-platform/sdk/@tailor-platform/sdk-plugin-tailordb-erd@fa83ee7

commit: fa83ee7

[github-actions]

🗺️ ERD preview

Self-contained ERD viewer HTML built for this run. Each viewer can switch between the current schema and a diff against base branch main.

• analyticsdb: view
• tailordb: view

[github-actions]

Code Metrics Report (packages/sdk)

	main (01fd6fb)	#2513 (5574355)	+/-
Coverage	86.2%	86.2%	0.0%
Code to Test Ratio	1:0.5	1:0.5	0.0

Details

  |                    | main (01fd6fb) | #2513 (5574355) | +/-  |
  |--------------------|----------------|-----------------|------|
  | Coverage           |          86.2% |           86.2% | 0.0% |
  |   Files            |            539 |             539 |    0 |
  |   Lines            |          22959 |           22959 |    0 |
  |   Covered          |          19796 |           19796 |    0 |
  | Code to Test Ratio |          1:0.5 |           1:0.5 |  0.0 |
  |   Code             |         182454 |          182454 |    0 |
  |   Test             |          99653 |           99653 |    0 |

SDK Configure Bundle Size

	main (01fd6fb)	#2513 (5574355)	+/-
configure-index-size	13.88KB	13.88KB	0KB
dependency-chunks-size	25.61KB	25.61KB	0KB
total-bundle-size	39.49KB	39.49KB	0KB

Runtime Performance

	main (01fd6fb)	#2513 (5574355)	+/-
Generate Median	1,457ms	1,984ms	+527ms
Generate Max	1,691ms	2,114ms	+423ms
Apply Build Median	1,595ms	2,204ms	+609ms
Apply Build Max	1,640ms	2,278ms	+638ms

Type Performance (instantiations)

	main (01fd6fb)	#2513 (5574355)	+/-
tailordb-basic	48,071	48,071	0
tailordb-optional	4,777	4,777	0
tailordb-relation	4,849	4,849	0
tailordb-validate	703	703	0
tailordb-hooks	5,842	5,842	0
tailordb-object	13,771	13,771	0
tailordb-enum	1,628	1,628	0
resolver-basic	12,618	12,618	0
resolver-nested	35,917	35,917	0
resolver-array	24,554	24,554	0
executor-schedule	4,489	4,489	0
executor-webhook	1,130	1,130	0
executor-record	5,452	5,452	0
executor-resolver	6,306	6,306	0
executor-operation-function	1,118	1,118	0
executor-operation-gql	1,126	1,126	0
executor-operation-webhook	1,137	1,137	0
executor-operation-workflow	1,931	1,931	0

---

Reported by octocov