chore: bump vitest from 4.1.11 to 5.0.5 by dependabot[bot] · Pull Request #93 · kosli-dev/mcp-server

dependabot · 2026-10-22T13:29:57Z

Bumps vitest from 4.1.11 to 5.0.5.

Release notes

v5.0.5

   🐞 Bug Fixes

Keep vite default fs.deny with api token file - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11578 (28dc1)

Handle quoted file names in --changed - by @sheremet-va in vitest-dev/vitest#11583 (14921)

Add data to the import.meta.hot stub - by @sheremet-va in vitest-dev/vitest#11590 (3a828)

Set skip in skipIf, ignore undefined options - by @sheremet-va in vitest-dev/vitest#11591 (d523a)

Skip builtin loading in async leak detector - by @sheremet-va in vitest-dev/vitest#11598 (fe86a)

Keep the import frame in native loader errors - by @sheremet-va in vitest-dev/vitest#11599 (9697b)

Run hook cleanups when a later hook fails - by @sheremet-va in vitest-dev/vitest#11605 (6c5a4)

Release mocks of finished test files - by @sheremet-va in vitest-dev/vitest#11607 (e9c3d)

Abort all running tests on cancel - by @sheremet-va in vitest-dev/vitest#11606 (6621a)

browser:

Ignore synthetic pagehide events - by @sheremet-va in vitest-dev/vitest#11582 (ca081)

Run plugin buildStart on server creation - by @sheremet-va in vitest-dev/vitest#11593 (ea611)

Drop late connections of closed sessions - by @sheremet-va in vitest-dev/vitest#11600 (f161e)

Wait 30s for the browser to close - by @sheremet-va in vitest-dev/vitest#11601 (6498b)

Run global setup once with instances - by @sheremet-va in vitest-dev/vitest#11596 (8dd67)

reporter:

End reason &[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39);failed&[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39); on worker crash - by @AriPerkkio in vitest-dev/vitest#11568 (6ae8e)

    View changes on GitHub

v5.0.4

   🚀 Features

experimental:

Tag cache directories with CACHEDIR.TAG - by @lifeiscontent in vitest-dev/vitest#11461 (a8ea3)

Support test.ui.theme option - by @sheremet-va in vitest-dev/vitest#11499 (1da66)

Highlight selector multiple matches in trace view - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11489 (5abba)

Print how many tests were affected and a total when running --changed - by @sheremet-va in vitest-dev/vitest#11424 (a2336)

Add an option to cache dependencies instead of statically parsing them - by @sheremet-va in vitest-dev/vitest#11515 (c0601)

Add fit and zoom controls to trace viewer - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11490 (f5dd9)

   🐞 Bug Fixes

Fail the run on git and location filter errors - by @sheremet-va in vitest-dev/vitest#11430 (30d03)

Enable fsModuleCache by default - by @sheremet-va in vitest-dev/vitest#11435 (ad208)

Track project files and mocks with --changed - by @sheremet-va in vitest-dev/vitest#11432 (b0f2b)

Refactor caching, fix : in project and change the shape of results cache - by @sheremet-va in vitest-dev/vitest#11453 (9673c)

Keep full $ string values when taskTitleValueFormatTruncate is 0 - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11485 (4f7e1)

Resolve node builtins in client environments - by @sheremet-va in vitest-dev/vitest#11417 (56b31)

Fix module graph builtin externals after #11421 - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11491 and vitest-dev/vitest#11421 (008e1)

Wrap module mocks during in-source testing - by @sheremet-va in vitest-dev/vitest#11505 (36d19)

Handle line endings in snapshot - by @sheremet-va in vitest-dev/vitest#11522 (4c468)

Respect root in projects - by @sheremet-va in vitest-dev/vitest#11521 (26642)

Resolve mocks in directories with spaces - by @sheremet-va in vitest-dev/vitest#11539 (caaef)

api:

Publish the api token atomically - by @umairnawaz333 in vitest-dev/vitest#11323 (6f990)

browser:

... (truncated)

Commits

7a825db chore: release v5.0.5 (#11609)
6621a72 fix: abort all running tests on cancel (#11606)
e9c3d72 fix: release mocks of finished test files (#11607)
8dd67c2 fix(browser): run global setup once with instances (#11596)
6c5a447 fix: run hook cleanups when a later hook fails (#11605)
9697b38 fix: keep the import frame in native loader errors (#11599)
6498b66 fix(browser): wait 30s for the browser to close (#11601)
f161e6d fix(browser): drop late connections of closed sessions (#11600)
fe86a64 fix: skip builtin loading in async leak detector (#11598)
6ae8e89 fix(reporter): end reason 'failed' on worker crash (#11568)
Additional commits viewable in compare view

claude · 2026-10-22T13:30:23Z

Claude finished @dependabot[bot]'s task in 3m 22s —— View job

Dependency review — vitest 4.1.11 → 5.0.5

Verdict: safe to merge. A major bump, but it lands on the part of vitest this repo barely touches. One doc follow-up, no blockers.

What actually changed

	4.1.11	5.0.5
`engines.node`	`^20.0.0 \|\| ^22.0.0 \|\| >=24.0.0`	`^22.12.0 \|\| ^24.0.0 \|\| >=26.0.0`
`vite`	direct dependency	required peer (`^6.4.0 \|\| ^7.0.0 \|\| ^8.0.0`)
assertions	`@vitest/expect`	`chai@^6` + `@types/chai` as direct deps
internals	`@vitest/{expect,runner,snapshot,utils,pretty-format}`	folded into `vitest`
`@types/node` peer	`^20 \|\| ^22 \|\| >=24`	`^22.0.0 \|\| >=24.0.0`

Lockfile: 11 packages removed, 2 added — net smaller tree. Vite itself only moves 8.2.2 → 8.3.4 (minor), not a Vite major.

Why the blast radius is small here

There is no vitest.config.* in this repo. Every config-shape breaking change in v5 — workspace/projects, pool defaults, the reshaped results cache, --changed behaviour — is a no-op.
The suite uses only describe / it / expect / vi.fn / vi.spyOn / vi.stubGlobal / mockReset / it.each with %s titles. No snapshots, no vi.mock, no fake timers, no expect.extend, no globals: true. That is exactly the surface v5 left alone — and it.each uses positional %s, so the 5.0.4 $-value title-truncation changes don't apply.
Chai 6 under expect is the one real behaviour risk (deep-equal edge cases, error message wording). The assertions in use are toBe / toEqual / toMatchObject / expect.objectContaining / expect.stringContaining / toHaveBeenCalledWith / toBeInstanceOf — all green.

Node floor: no change needed, but the rationale moved

.nvmrc 22.12, CI matrix ['22.12', '24'], update-catalog.yml 22.12, release.yml 24 — all inside the new range. engines.node (>=22) is the consumer floor and correctly stays put; the consumer-floor: 22.0.0 bundle smoke leg doesn't run vitest.

What did change: the 22.12 dev floor now comes from vitest's own engines, not transitively from Vite 8, and the new range also excludes Node 23 and 25. CLAUDE.md:44 and CONTRIBUTING.md:7 still explain it the old way — inline comment with details and a fix link. Docs-only; nothing to change in package.json.

`@types/node` — unaffected, rule still holds

The new peer range ^22.0.0 || >=24.0.0 is satisfied by the pinned ^22.12.0. No pressure to bump it off the Node 22 major, and the dependabot.yml major-ignore for @types/node is intact.

Worth knowing (optional, not blocking)

Vite is now a required peer that the repo doesn't declare. npm ci installs it from the lock deterministically (both CI legs prove it), but the Vite major the dev toolchain gets is now governed by vitest's peer range rather than a pin inside vitest. If the lock is ever regenerated from scratch, Vite could in principle resolve to 6 or 7 — whose engines differ — and the dev floor would shift without anyone editing a file. Adding vite to devDependencies would make that visible and Dependabot-tracked. Your call; the current setup is not broken.

CI

test (node 22.12)   pass   42s
test (node 24)      pass   30s

Both legs cover build → typecheck → test → smoke dist/ → pack .mcpb → mcpb validate → smoke the unzipped bundle, and 22.12 also smoke-tests the bundle on the 22.0.0 consumer floor. No follow-up test needed.
· branch

#96) ## Why `npm audit --omit=dev` reports 8 advisories (1 critical, 3 high) in the locked runtime dependencies. This lockfile is what the `.mcpb` bundle installs from (`pack-mcpb.sh` copies it before `npm install --omit=dev`), so that's where users get them, along with CI and any scan of the repo. The npm package doesn't ship a lockfile, so `npx` users already resolve current versions within the SDK's ranges. All of them come in indirectly through `@modelcontextprotocol/sdk`: | Package | Before → after | Pulled in by | |---|---|---| | `proxy-addr` (critical) | 2.0.7 → 2.0.8 | express | | `hono` | 4.12.12 → 4.13.13 | SDK | | `@hono/node-server` | 1.19.13 → 2.1.5 | SDK (allows `^1.19.9 \|\| ^2.0.5`) | | `fast-uri` | 3.1.0 → 3.1.9 | ajv | | `ip-address`, `express-rate-limit` | 10.1.0 → 10.7.4, 8.3.2 → 8.7.1 | SDK | | `qs`, `body-parser` | 6.15.1 → 6.16.1, 2.2.2 → 2.4.0 | express | Most of these belong to the SDK's HTTP server transports, which this server doesn't use, since it only speaks stdio. Scanners still flag them in the release. Nothing would have fixed them otherwise. The weekly Dependabot version updates bump only direct dependencies, and Dependabot security updates were off. The repo also showed 0 Dependabot alerts, because the dependency graph was off. Both are being switched on in the repo settings. ## What `npm audit fix --omit=dev`. Only `package-lock.json` changes, and `package.json` is untouched. Every new version stays within the range its parent declares. The other lockfile changes (`content-type`, `type-is`, `iconv-lite`, `hasown`, `side-channel`, `es-object-atoms`) are patch or minor bumps that npm needed to resolve the fixed versions. ## Checked - `npm audit --omit=dev`: 0 vulnerabilities, down from 8. - `npm install --package-lock-only` leaves the lockfile unchanged, so it's consistent with `package.json`. - Locally: build, typecheck, 122 tests, and the smoke test against `dist/`. Before the rebase onto #79's merge commit I also ran it against the unzipped `.mcpb` (manifest validated). The bundle ships `@hono/node-server` 2.1.5. CI repeats all of this, plus the bundle on Node 22.0.0. ## Not in this PR - **Dev-only advisories (10).** They never ship. `@anthropic-ai/mcpb`'s `node-forge` and `tmp` have no fix yet. The `vite`/`vitest` ones should move with #93 (vitest 5). - **Declaring `zod` directly:** #95.

dangrondahl · 2026-10-23T09:46:49Z

@dependabot rebase

Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 4.1.11 to 5.0.5. - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest) --- updated-dependencies: - dependency-name: vitest dependency-version: 5.0.4 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

claude · 2026-10-23T09:51:28Z

    "tsx": "^4.19.0",
    "typescript": "^5.7.0",
-    "vitest": "^4.1.10"
+    "vitest": "^5.0.5"


vitest 5 narrows its own engines.node from ^20.0.0 || ^22.0.0 || >=24.0.0 to ^22.12.0 || ^24.0.0 || >=26.0.0.

Nothing breaks — .nvmrc (22.12), the CI matrix (22.12, 24), update-catalog.yml (22.12) and release.yml (24) all satisfy it — but the reason for the 22.12 dev floor has moved. Two docs still attribute it to Vite transitively:

CLAUDE.md:44 — "because vitest pulls Vite 8, which requires it"

CONTRIBUTING.md:7 — "vitest pulls Vite 8, which requires ^20.19.0 || >=22.12.0"

Vitest now requires 22.12 directly, and its range also excludes Node 23 and 25 — so "≥ 22.12" is no longer the whole rule. Worth rewording so the next person moving the floor checks vitest's engines, not Vite's. (ci.yml:25-27 carries the same stale comment; I can't edit workflow files.)

Fix this →

Release prep for **0.6.0**. A draft for now: it gets rebased once #97 (CodeQL) merges, then marked ready. `npm version minor --no-git-tag-version` moves `package.json`, `package-lock.json` and the generated `src/version.ts` together. `manifest.json` gets the version at pack time. Nothing else changes. ## What's in 0.6.0 (since 0.5.0) ### ⚠️ Changes that affect existing setups - **No configured org (#65).** `KOSLI_ORG` and the Desktop extension's *Organization* setting are removed. Every org-scoped call names its org through the execute tools' `org` input, so no request lands in an org the caller didn't name. An existing config that still sets `KOSLI_ORG` starts fine and logs that the value is ignored, but calls that relied on the default are now refused until an org is given. - **Node ≥ 22 (#38).** It was ≥ 20. ### Fixes - **Evidence downloads work again (#88, fixes #86).** Since 16 Oct, every `get_attestation_evidence` call failed: our token was forwarded to the pre-signed S3 URL. Text files come back as text, and binary files return a clear error. - **The `.mcpb` bundle starts on Node 22.0 – 22.6 (#87).** It didn't before. - **No known vulnerabilities in the bundled dependencies (#96).** `npm audit --omit=dev` is clean. ### Features - **`org` input on the execute tools (#65).** - **`User-Agent` carries the version (#41):** `kosli-mcp-server/<version>`. ### Dependencies - **Runtime:** `@modelcontextprotocol/sdk` 1.29.0 → 1.32.1 (#29, #71, #79). - **Dev:** TypeScript 7 (#45), with emitted output byte-identical to 5.9. vitest 5 (#93). - **Catalog:** regenerated from the OpenAPI spec (#50, #53, #60, #69, #78). ### Release confidence (CI only) Typecheck of tests and scripts, a stdio smoke test against `dist/` and the unzipped bundle (including Node 22.0.0), `mcpb validate`, and `release.yml` publishing only after every check (#87). There's also a phased Claude review (#90), Dependabot grouping with a 7-day cooldown, and CodeQL (#97). ## Checked locally on this branch - Build, typecheck, 122 tests. - The smoke test reports `server advertises version 0.6.0`, both from `dist/` and from the unzipped bundle. - `kosli-mcp-server-0.6.0.mcpb`: the manifest says 0.6.0 and `mcpb validate` passes. ## Before tagging (after merge) - [ ] Rebase onto `main` once #97 merges, then mark ready. - [ ] Install the 0.6.0 `.mcpb` in Claude Desktop, including an upgrade over 0.5.0 with an org configured. - [ ] Run `KOSLI_API_TOKEN=… KOSLI_SMOKE_ORG=<org> npm run smoke` on `main`. - [ ] Download one piece of evidence via `get_attestation_evidence`. - [ ] `git tag -a v0.6.0 -m "v0.6.0" <merge commit> && git push origin v0.6.0`. `release.yml` does the rest.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 22, 2026

dependabot Bot mentioned this pull request Oct 22, 2026

chore: bump vitest from 4.1.11 to 5.0.5 #84

Closed

dangrondahl mentioned this pull request Oct 23, 2026

fix(deps): update the SDK's transitive dependencies to clear npm audit #96

Merged

dependabot Bot changed the title ~~chore: bump vitest from 4.1.11 to 5.0.4~~ chore: bump vitest from 4.1.11 to 5.0.5 Oct 23, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/vitest-5.0.4 branch from 07182a8 to 0f5c198 Compare October 23, 2026 09:48

claude Bot reviewed Oct 23, 2026

View reviewed changes

dangrondahl approved these changes Oct 23, 2026

View reviewed changes

dangrondahl merged commit 9b8fb78 into main Oct 23, 2026
5 checks passed

dangrondahl deleted the dependabot/npm_and_yarn/vitest-5.0.4 branch October 23, 2026 10:01

dangrondahl mentioned this pull request Oct 23, 2026

chore: bump version to 0.6.0 #98

Merged

5 tasks

Navigation Menu

Repository navigation

chore: bump vitest from 4.1.11 to 5.0.5 - #93

chore: bump vitest from 4.1.11 to 5.0.5#93
dangrondahl merged 1 commit into
mainfrom
dependabot/npm_and_yarn/vitest-5.0.4

dependabot Bot commented on behalf of github Oct 22, 2026 •

edited

Loading

Uh oh!

claude Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

dangrondahl commented Oct 23, 2026

Uh oh!

claude Bot Oct 23, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v5.0.5

🐞 Bug Fixes

View changes on GitHub

v5.0.4

🚀 Features

🐞 Bug Fixes

Uh oh!

claude Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency review — vitest 4.1.11 → 5.0.5

What actually changed

Why the blast radius is small here

Node floor: no change needed, but the rationale moved

@types/node — unaffected, rule still holds

Worth knowing (optional, not blocking)

CI

Uh oh!

dangrondahl commented Oct 23, 2026

Uh oh!

claude Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Oct 22, 2026 •

edited

Loading

claude Bot commented Oct 22, 2026 •

edited

Loading

`@types/node` — unaffected, rule still holds