chore(deps-dev): bump vitest from 4.0.15 to 4.1.0 - #624
Conversation
Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 4.0.15 to 4.1.0. - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest) --- updated-dependencies: - dependency-name: vitest dependency-version: 4.1.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
Closing as part of consolidating dependency automation on a single updater (#631). Dependabot's security updates and Renovate were both filing the same bumps — #624 and #625 are both Dependabot alerts stay on; Renovate reads them through |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
19 dependency PRs were open, the oldest from **February 2025**. This is
not a backlog anyone neglected — the automation was *structurally
incapable* of merging any of them, for three independent reasons, none
of which produces a visible failure anywhere.
## Why nothing merged
| # | Mechanism | Fault |
| --- | --- | --- |
| 1 | `.github/mergify.yml` (extends `unional/.github`) | every rule
ends in `merge: { method: rebase }`. This repo has `allow_rebase_merge:
false` — merge commits only. Mergify asks for a method the repo refuses
and the PR sits `CLEAN` forever. |
| 2 | the same file's Renovate rule | gates on `label=safe-update`.
Nothing applies that label: `.github/renovate.json` extended
`github>unional/renovate-preset`, which is two lines (`config:base` +
`:preserveSemverRanges`) and sets no labels. |
| 3 | `.github/workflows/automerge-dependabot.yml` | `gh pr merge --auto
--rebase` — fails for reason 1 too. |
Reasons 1 and 2 are independent: fixing either alone still merges
nothing.
## One updater, one merge mechanism
**Renovate**, with **GitHub-native auto-merge**. `platformAutomerge:
true` arms GitHub's own auto-merge, which *feeds* the merge queue
instead of bypassing it the way a bot's own `merge` action does.
`.github/renovate.json` now carries the config directly rather than
extending the two-line preset:
- minor / patch / pin / digest, and **all** devDependency updates →
automerge.
- majors of anything a consumer resolves → manual, under a `major-`
branch prefix.
- `minimumReleaseAge: "3 days"` mirrors the 24h npm soak in `.npmrc` at
the PR level, so Renovate does not open a PR for a package that just
landed. `vulnerabilityAlerts` drops that to 1 day and automerges.
- `ignorePaths` adds `old/**`. Renovate had been filing PRs against
`old/checker`, which is not a pnpm workspace member, is not installed,
and is now `private`. #560 (`@types/jest` v30) was one of those.
- **`ts-5.4` / `ts-5.5` disabled.** They are npm aliases pinning those
exact TypeScript minors so `test:type` proves the emitted declarations
still compile on the oldest supported compilers. Bumping them to
`~5.9.0` deletes the matrix. #530 and #531 had been asking to do
precisely that since February 2025.
`.github/mergify.yml` and the Dependabot automerge workflow are deleted.
Dependabot's version updates are retired in favour of Renovate — the two
were filing the same bump twice (#624 and #625 are both `vitest` 4.1.0).
## Incidental fix
`@size-limit/esbuild-why` had been automerged to `^12.0.0` while
`size-limit` and `@size-limit/preset-small-lib` stayed on `^11.1.5` — a
plugin a full major ahead of the host it plugs into. All three now on
`^13.0.3`.
## Release impact
**None. No changeset.** Nothing here reaches the published artifact: CI
config, lint-time tooling, and a devDependency.
`pnpm verify` green locally: 7/7 turbo tasks, including `size` on
size-limit 13.
1 participant
Bumps vitest from 4.0.15 to 4.1.0.
Release notes
Sourced from vitest's releases.
... (truncated)
Commits
4150b91chore: release v4.1.01de0aa2fix: correctly identify concurrent test during static analysis (#9846)c3cac1cfix: use isAgent check, not just TTY, for watch mode (#9841)eab68bachore(deps): update all non-major dependencies (#9824)031f02afix: allow catch/finally for async assertion (#9827)3e9e096feat(reporters): addagentreporter to reduce ai agent token usage (#9779)0c2c013chore: release v4.1.0-beta.68181e06fix:hideSkippedTestsshould not hidetest.todo(fix #9562) (#9781)a8216b0fix: manual and redirect mock shouldn'tloadortransformoriginal module...689a22afix(browser): types ofgetCDPSessionandcdp()(#9716)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.