Repository navigation
chore: bump vitest from 4.1.11 to 5.0.5 - #84
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
|
Claude finished @dependabot[bot]'s task in 1m 40s —— View job Dependency review — vitest 4.1.11 → 5.0.5
Verdict: safe to merge. The one blocking concern from the previous review is now resolved by the rebase, and CI is green on both matrix legs. What changedMajor bump, dev-only. Node floor — previously flagged, now resolvedvitest 5.0.5 declares That's been fixed on
The dev floor is now exactly vitest 5's minimum — zero slack. Worth knowing for the next bump: a vitest minor that raises to e.g. Usage check — nothing to migrate
CIBoth legs green on Follow-up checksNothing blocking. One thing to keep an eye on: this repo now has two packages gating the dev floor at 22.12 (vitest 5 and Vite 8). If either raises it again, the floor moves as a set — don't let |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| "tsx": "^4.19.0", | ||
| "typescript": "^5.7.0", | ||
| "vitest": "^4.1.10" | ||
| "vitest": "^5.0.5" |
There was a problem hiding this comment.
vitest 5 narrows its supported runtimes to ^22.12.0 || ^24.0.0 || >=26.0.0 (4.x accepted ^20 || ^22 || >=24). This repo declares engines.node: ">=22", so a contributor on Node 22.0–22.11 now gets EBADENGINE on install and can't run npm test.
CI won't catch it: node-version: '22' in ci.yml resolves to the newest 22.x (this run used v22.23.3), never the bottom of the declared range.
Since vitest is dev-only and files: ["dist"] ships no test code, the runtime floor for consumers is unaffected — so this is a contributor-experience gap, not a published-package break. Worth a deliberate decision rather than a silent drift.
Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 4.1.11 to 5.0.5. - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest) --- updated-dependencies: - dependency-name: vitest dependency-version: 5.0.5 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/vitest-5.0.5
branch
from
October 22, 2026 12:31
34c0d65 to
cabef1d
Compare
dangrondahl
added a commit
that referenced
this pull request
Oct 22, 2026
…pendabot (#87) Gives more confidence before the next release by adding checks for things that so far were only tested by unit tests, or not at all. The new checks immediately turned up two bugs that were already on `main`, and both are fixed here: a mistyped test, and a `.mcpb` bundle that doesn't start on Node 22.0–22.6. ## Fix: the `.mcpb` bundle didn't start on Node 22.0–22.6 `pack-mcpb.sh` deleted `package.json` from the bundle, so nothing declared `dist/` as ESM. Node 22.7+ detects ESM from the syntax and prints a warning. Earlier versions parse the file as CommonJS and fail with `Cannot use import statement outside a module`. Both `engines` and `manifest.json` allow those versions. The bundle now ships a one-line `package.json` with `{ "type": "module" }`, and nothing from the repo's own `package.json`. I reproduced the failure on the official Node 22.6.0 binary, and confirmed the fixed bundle starts on 22.0.0, 22.6.0 and 22.7.0. ## Type-check tests and scripts `tsconfig.json` is `src`-only because it emits `dist/`, and vitest strips types without checking them. So a type error in `test/` or `scripts/` never failed anything. One had already slipped through: the fetch mock in `test/client/kosli-client.test.ts` was typed `ReturnType<typeof vi.fn>`, which doesn't match `KosliClient`'s `fetchFn`. That is fixed here. `tsconfig.test.json` and `npm run typecheck` cover the TypeScript in `src`, `test` and `scripts`. `scripts/sync-version.mjs` is plain JS and isn't covered. CI runs the typecheck after the build. ## Stdio smoke test `scripts/smoke.ts` (`npm run smoke`) starts a built server over real stdio and checks three things: - the version it advertises matches `package.json` - it lists exactly the three tools - the tools carry the right safety hints: `execute_write_action` is marked `destructiveHint` and not read-only, and `execute_read_action` and `search_actions` are marked `readOnlyHint`. These hints are what make an MCP client ask before a write, and no other test checks them. - `search_actions` finds `list_environments` A failed tool call reports the server's own error message rather than a JSON parse error. This covers what `test/server.test.ts` can't, because that test runs in memory: whether the bin starts, whether the JSON imports load, and whether a bundle's `node_modules` resolve. The test is offline by default. It does one live read only when `KOSLI_API_TOKEN` and `KOSLI_SMOKE_ORG` are both set, and CI never sets them, so it's fork-safe. CI now runs: 1. build 2. **typecheck** 3. test 4. **smoke `dist/`** 5. pack 6. **unzip the `.mcpb`, run `mcpb validate` on its manifest, and smoke-test it** 7. **on the leg that sets `consumer-floor` in the matrix: switch to exactly Node 22.0.0 and smoke-test the bundle again** There's also a **negative check**: the smoke test must fail against a missing entry point. That way a later refactor can't turn the smoke steps into checks that always pass. Some notes on those steps: - Validating the bundled manifest, not the repo's copy, matters: the repo's `manifest.json` holds a placeholder version, and the real one is only injected at pack time. - The 22.0.0 step exists because the matrix floor is the *dev* floor (vitest needs a newer 22.x, see #47), so nothing tested the version users are promised. The smoke test doesn't need vitest, so it can run there. I rehearsed it locally on the real 22.0.0 binary: it fails on the old bundle and passes on the fixed one. - `@anthropic-ai/mcpb` is now a devDependency rather than an `npx` pin, so Dependabot keeps it up to date. It adds 49 dev-only packages. None of them ship (`files: ["dist"]`), and the server's own `zod` is unchanged at 4.3.6. ## Release workflow: publish only after every check `release.yml` used to run only build and test, then `npm publish`, and only then build the bundle. So a failed pack could leave a version on npm with no GitHub Release. It now runs the same checks as CI: 1. build, typecheck, test 2. smoke `dist/` 3. pack, `mcpb validate`, smoke the bundle 4. only then `npm publish` and the GitHub Release `npm publish` can't be undone, so it stays last. This also checks the bundle under the `npm@latest` that the release job installs, which CI never uses. Both jobs now have a `timeout-minutes` (15 for CI, 20 for release) instead of the 6-hour default. ## Dependabot grouping and cooldown - **Actions:** all SHA bumps go in one group. They edit the same lines, so as separate PRs they conflict (#80 and #82 do today). - **npm dev dependencies:** minor and patch bumps are grouped. - **`@modelcontextprotocol/sdk`:** its minor and patch bumps get their own group, because it's the only runtime dependency. - **Majors** stay one PR each. - **Cooldown:** new releases wait 7 days before being proposed. Security updates aren't affected. ## Docs `CONTRIBUTING.md` gets a "Testing locally" section covering typecheck, smoke (offline and live), MCP Inspector, Claude Code against a checkout, and installing the `.mcpb`. `README.md` and `CLAUDE.md` are updated to match. ## Verification On Node 24 locally: - `build`, `typecheck` and `npm test` (110 tests) pass. - The smoke test passes against `dist/` and against the unzipped bundle. - The smoke test exits 1 when the server fails to start. - `mcpb validate` passes on the bundled manifest, which carries version `0.5.0`. - The live-API smoke test passed against a real org (with SDK 1.30.1). - The bundle smoke test passes on Node 22.0.0, 22.6.0 and 22.7.0. Not run locally: the Node 22 matrix leg, which CI covers. Not run: `release.yml` itself, which only runs on a tag. Its new steps are the same commands CI runs. After merge, check the next Dependabot run is still green. `cooldown` support varies by ecosystem, and an unsupported key invalidates the whole config, not just that block. ## Merge order for the open PRs Suggested order once this lands: #47, then this PR, then #80 → #82 → #83 → #74 → #79 → #84 → #45. Before #79 (SDK), rerun the live smoke test on its branch. #47 conflicts with this PR on the matrix line: when resolving, change the `include:` entry to `node-version: '22.12'` as well. Merge #45 (TypeScript 7) last, after diffing `dist/` output against 5.9.
Contributor
Author
|
Superseded by #93. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps vitest from 4.1.11 to 5.0.5.
Release notes
Sourced from vitest's releases.
... (truncated)
Commits
7a825dbchore: release v5.0.5 (#11609)6621a72fix: abort all running tests on cancel (#11606)e9c3d72fix: release mocks of finished test files (#11607)8dd67c2fix(browser): run global setup once with instances (#11596)6c5a447fix: run hook cleanups when a later hook fails (#11605)9697b38fix: keep the import frame in native loader errors (#11599)6498b66fix(browser): wait 30s for the browser to close (#11601)f161e6dfix(browser): drop late connections of closed sessions (#11600)fe86a64fix: skip builtin loading in async leak detector (#11598)6ae8e89fix(reporter): end reason'failed'on worker crash (#11568)