Skip to content

build(deps-dev): bump vitest from 1.6.1 to 4.1.11 - #284

Closed
dependabot[bot] wants to merge 1 commit into
developmentfrom
dependabot/npm_and_yarn/development/vitest-4.1.11
Closed

build(deps-dev): bump vitest from 1.6.1 to 4.1.11#284
dependabot[bot] wants to merge 1 commit into
developmentfrom
dependabot/npm_and_yarn/development/vitest-4.1.11

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 20, 2026

Copy link
Copy Markdown
Contributor

Bumps vitest from 1.6.1 to 4.1.11.

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

    View changes on GitHub

v4.1.10

   🐞 Bug Fixes

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

    View changes on GitHub

... (truncated)

Commits
  • 9bd8d46 chore: release v4.1.11 (#10995)
  • 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
  • db616d2 chore: release v4.1.10 (#10718)
  • bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
  • a7a61e7 chore: release v4.1.9 (#10598)
  • 934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
  • 7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
  • a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
  • e61f2dd chore: release v4.1.8
  • e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.


@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 20, 2026
Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 1.6.1 to 4.1.11.
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

---
updated-dependencies:
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/development/vitest-4.1.11 branch from b8fab1c to 1c7cb0d Compare August 20, 2026 22:48
@rubenvdlinde

Copy link
Copy Markdown
Contributor

Investigated: this cannot land as a standalone bump, and neither can #288 — but the coupling is wider than those two.

What blocks it

vitest@4 requires a newer vite than this app pins:

vitest@4.1.11  peers  vite: ^6.0.0 || ^7.0.0 || ^8.0.0
openbuild      pins   vite: ^5.4.0        (resolves 5.4.21)

and @vitest/coverage-v8@4.1.11 pins vitest to exactly 4.1.11, so #288 and this PR are one change, not two.

What I measured

Bumping only the vitest pair installs cleanly and the suite mostly runs, but:

vitest 1.6.1  ->  1378 passed, 0 failed
vitest 4.1.11 ->  1373 passed, 5 failed  (3 files)

The three ManifestDiff failures are all expected 0 to be greater than 0 after wrapper.setData(...) — the component's reactive state is not being reached at all. That is the signature of an SFC-compilation mismatch, not of a test assertion that needs updating: with vite pinned to 5 while vitest 4 expects 6+, @vitejs/plugin-vue@^5.2.1 is compiling against a toolchain vitest no longer supports.

Worth noting the tree is already strained independently of this PR — on development, @nextcloud/vue@9.9.0 -> vue-router@5.2.0 -> unplugin wants vite ^7.3.0 || ^8.0.0 and is marked invalid against the pinned 5.4.21.

What it actually needs

One coupled change across four packages:

  • vitest 1.6.1 -> 4.x
  • @vitest/coverage-v8 1.6.1 -> 4.x (exact-pinned to vitest)
  • vite 5.4.x -> 6.x/7.x
  • @vitejs/plugin-vue -> the major matching that vite

That is a build-toolchain migration — vite compiles the SFCs, so a wrong step changes how every component builds rather than just how tests run. I am deliberately not landing that unattended; it wants a session where the 5 failures can be walked through against a known-good baseline.

Leaving this open with the diagnosis rather than closing it: the bump is legitimate, it is just not a one-package job.

@rubenvdlinde

Copy link
Copy Markdown
Contributor

Superseded by the coupled upgrade PR.

vitest 4.1.11 peers @vitest/coverage-v8: 4.1.11 exactly, so neither of these can land alone — either one produces a tree npm ci refuses. The peer chain also requires vite 7 and @vitejs/plugin-vue 6, making this a four-package move rather than two bumps.

The replacement also fixes five tests that were correct-by-accident: each seeded component state while the component's own mounted-hook fetch was still in flight, and vitest 4 resolves the two in the opposite order.

@dependabot @github

dependabot Bot commented on behalf of github Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/development/vitest-4.1.11 branch August 21, 2026 05:23
rubenvdlinde added a commit that referenced this pull request Aug 21, 2026
… 6, coverage-v8 4) (#298)

Combines dependabot #284 (vitest) and #288 (@vitest/coverage-v8). They cannot
land separately: vitest 4.1.11 peers `@vitest/coverage-v8: 4.1.11` EXACTLY, so
either PR alone produces a tree `npm ci` refuses. The peer chain drags in two
more packages, so this is a four-package move:

    vitest                 ^1.6.1 -> ^4.1.11
    @vitest/coverage-v8    ^1.6.1 -> ^4.1.11   (exact-pinned to vitest)
    vite                   ^5.4.0 -> ^7.3.6    (vitest 4 peers ^6 || ^7 || ^8)
    @vitejs/plugin-vue     ^5.2.1 -> ^6.0.8    (needed for vite 7)

vite 7, not vite 8, deliberately. vite 8.2.2 is the current latest, but this
repo's `.npmrc` sets `min-release-age=2` — a supply-chain cooldown that makes
the lockfile lag newly published versions ON PURPOSE. Pulling a package inside
its cooldown window is how you get a lock that resolves differently in CI than
locally. vite 7.3.6 is well outside it and satisfies vitest 4's peer range.

Five tests failed, all the same latent race
-------------------------------------------
Three in ManifestDiff.spec.js, one in PageDesignerHost.spec.js, one in
ApplicationDetailHeader.spec.js. None is a vitest bug and none needed a
production change — every one is a test seeding component state while that
component's own mounted-hook fetch is still in flight.

ManifestDiff is the clearest. The test mounts, then immediately does:

    await wrapper.setData({ fromBlob: sampleFrom, toBlob: sampleTo })

with a comment claiming this "skips the async fetch". It does not skip it, it
RACES it. The mocked axios resolves `{from: null, to: null}`, and whichever
settles second wins. Under vitest 1 setData won; under vitest 4 the fetch does,
nulls `fromBlob` straight back out, and `diffParts` computes over two empty
strings and returns []. Verified directly rather than guessed — a probe printed
`fromBlob: null` immediately after an awaited setData, while `diffLines` itself
was confirmed to be a working function returning correct hunks.

PageDesignerHost is the same shape wearing different clothes: it arms
`mockRejectedValueOnce` before the mount-time `load()` has settled, so the
mount's own request eats the rejection and the explicit `load()` succeeds.
ApplicationDetailHeader assigns `wrapper.vm.versions` while the mounted hook is
still fetching and assigning that same field.

Fixed by letting the mount settle first (`await flushPromises()` /
`await flush(wrapper)`) before seeding, with a comment at each site saying what
the ordering depends on. These tests were correct-by-accident for three major
versions.

    before: 3 files failed, 5 tests failed, 1373 passed
    after:  141 files passed, 1378 tests passed

The coverage baseline is recalibrated, and that number needs reading carefully
-------------------------------------------------------------------------------
tests/.coverage-baseline.json vitest: 85.18 -> 64.72.

This is NOT 20 points of lost coverage. The suite is identical — 1378 tests
before and after. The instrument changed:

    coverage-v8 v1:  src/App.vue = 235 lines   (exactly its `wc -l`)
    coverage-v8 v4:  src/App.vue = 24 lines
    across src/**:   59,333 -> 10,097 lines, over the same ~200 files

v1 treated every physical line as coverable — blank lines, comments and Vue
template markup included, nearly all of which score covered for free. v4 remaps
through `ast-v8-to-istanbul` to executable lines only. 64.72% of real statements
is a stricter bar than 89.63% of a file's line count, so the ratchet is being
recalibrated, not relaxed. The baseline file carries a `_note` explaining this
so nobody "restores" 85.18 — under v4 it is unreachable and meaningless.

Flagging explicitly for review: this repo does NOT currently run the vitest
ratchet in CI. `frontend-checks` is `["check:manifest", "test:l10n",
"check:gitignore", "check:nc-floor", "format"]`, and `enable-coverage-guard:
true` refers to the separate PHP clover guard (`.coverage-baseline` = 57.39).
So no CI gate changes either way here — but leaving 85.18 in place would make
the ratchet fail instantly the day someone wires it up, which is why it is
corrected rather than left alone.

Verified with the commands CI runs
----------------------------------
  npm ci                        rc=0
  npx vitest run                141/141 files, 1378/1378 tests
  npm run test:coverage         rc=0
  npm run test:coverage-ratchet rc=0 (holds at floor)
  npm run build                 rc=0
  npm run lint                  rc=0
  npm run stylelint             rc=0
  npx prettier --check          rc=0

Closes #284
Closes #288

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant