build(deps-dev): bump @vitest/coverage-v8 from 3.2.4 to 4.0.18 in /peek#2112
build(deps-dev): bump @vitest/coverage-v8 from 3.2.4 to 4.0.18 in /peek#2112dependabot[bot] wants to merge 40 commits intomainfrom
Conversation
Bumps [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) from 3.2.4 to 4.0.18. - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.18/packages/coverage-v8) --- updated-dependencies: - dependency-name: "@vitest/coverage-v8" dependency-version: 4.0.18 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
❌ UI Smoke Test Review —
|
This comment has been minimized.
This comment has been minimized.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| "@typescript/native-preview": "^7.0.0-dev.20260304.1", | ||
| "@vitejs/plugin-react": "^5.1.4", | ||
| "@vitest/coverage-v8": "^3.2.4", | ||
| "@vitest/coverage-v8": "^4.0.18", |
There was a problem hiding this comment.
[HIGH] Coverage plugin major is incompatible with pinned Vitest major
This bumps @vitest/coverage-v8 to ^4.0.18, but the same file still pins vitest to ^3.2.4 (peek/package.json, line 139). @vitest/coverage-v8@4.0.18 has a peer dependency on vitest@4.0.18, so npm ci now fails with ERESOLVE could not resolve due to the peer conflict.
Concrete failure: running cd peek && npm ci on this PR fails before tests/build can run.
Please keep these majors aligned (either keep coverage on v3.x for now, or upgrade vitest and related Vitest packages to v4 together).
Dependency Update AnalysisSummary: This PR upgrades
|
| Check | Result |
|---|---|
| Breaking changes | |
| Testable in PR | ✅ Yes (CI runs on pull_request), but push |
Changelog highlights (v3.2.4 → v4.0.18)
From upstream Vitest releases:
v4.0.0introduces breaking changes (e.g., removed deprecated APIs/options, reporter changes including removal ofbasic, pool/runtime changes, and coverage-related deprecations removed).v4.0.18is primarily bug fixes/experimental updates on top of v4.
Practical implication for this PR: moving from 3.x to 4.x should be treated as a migration-level change, not a routine patch/minor update.
Usage in this repository
- Declared in
peek/package.json:123as a devDependency. - Coverage provider is configured in
peek/vitest.config.ts:22-24withprovider: "v8". - Coverage script uses it via
peek/package.json:38(vitest ... --coverage). - Make target
test-unit-coverageruns that script (Makefile:255-257). - CI workflow:
pull_request+pushtrigger exists (.github/workflows/ci.yml:4-5,:21-22).- PR path runs changed-file unit tests (
.github/workflows/ci.yml:110-113). - Coverage run is only on push (
.github/workflows/ci.yml:114-116).
Compatibility signal observed in this PR diff:
@vitest/coverage-v8@4.0.18declares peer deps forvitest: 4.0.18inpeek/package-lock.json.- Repo still declares
vitest: ^3.2.4inpeek/package.json:139.
Compatibility assessment
- High-confidence risk: peer-version mismatch (
coverage-v8@4vsvitest@3) is likely incompatible and should be aligned before merge. - Node runtime compatibility appears acceptable for this repo (CI uses Node 24), but the key blocker is Vitest major alignment.
- Suggested follow-up: update
vitest(and any related Vitest packages/config touched by v4 migration notes) in the same PR or keep coverage package on v3.
Labels Applied
- Recommended:
needs-human-review(major version bump + likely peer compatibility issue). - No labels were applied by this run.
What is this? | From workflow: Dependency Review
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
Dependency Update AnalysisSummary: This PR upgrades Dependency:
|
| Check | Result |
|---|---|
| Breaking changes | |
| Testable in PR |
Changelog highlights (v3.2.4 → v4.0.18)
From Vitest releases:
v4.0.0introduces multiple breaking changes (including removal of deprecated APIs/options and other runner/reporter changes).v4.0.18is primarily incremental (bug fixes + one experimental hook), with no new headline breaking changes in that patch release.
Relevant source references:
https://api.github.com/repos/vitest-dev/vitest/releases/tags/v4.0.0https://api.github.com/repos/vitest-dev/vitest/releases/tags/v4.0.18
Usage in this repository
- Dependency declaration updated in:
peek/package.json:123peek/package-lock.json:65
- Coverage provider is configured in:
peek/vitest.config.ts:37-39(coverage.provider: "v8")
- Coverage command wiring:
peek/package.json:38(test:coverage→vitest ... --coverage)Makefile:255-257(test-unit-coveragecallsnpm run test:coverage).github/workflows/ci.yml:114-116runsmake test-unit-coverageonly on push.
Compatibility assessment
The lockfile shows a direct peer mismatch after this bump:
@vitest/coverage-v8@4.0.18peers onvitest: 4.0.18(peek/package-lock.json:6458-6461)- Repo still depends on
vitest: ^3.2.4(peek/package-lock.json:81, resolved package atpeek/package-lock.json:17288-17290)
So this PR updates only the coverage plugin to Vitest 4 while the core test runner remains on Vitest 3. That is a high-likelihood incompatibility for coverage execution and should be reviewed/validated carefully (ideally by upgrading vitest in lockstep or confirming compatibility matrix from upstream).
Testability note:
- CI is triggered on
pull_requestfor these paths (.github/workflows/ci.yml:3-13), but the coverage run path itself is currently push-only (.github/workflows/ci.yml:114-116), so the exact coverage behavior is not fully exercised in PR checks.
Labels Applied
No labels applied in this run.
What is this? | From workflow: Dependency Review
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
Dependency Update AnalysisSummary: This PR upgrades
|
| Check | Result |
|---|---|
| Breaking changes | |
| Testable in PR | push only (.github/workflows/ci.yml lines 115-116) |
Changelog highlights (v3.2.4 → v4.0.18)
v4.0.0release explicitly marks multiple breaking changes (reporter removals/renames, deprecated API removals, config/type removals, Vite 5 support removal, module-runner changes, coverage option deprecations removed).v4.0.18is a patch release with mostly fixes/experimental additions, but it is still on top of the 4.x breaking baseline.- In this PR diff,
@vitest/coverage-v8now declares peer depsvitest: 4.0.18and optional@vitest/browser: 4.0.18(frompeek/package-lock.jsonpatch block aroundnode_modules/@vitest/coverage-v8``).
Usage in this repository
- Dependency declaration:
peek/package.json:123("@vitest/coverage-v8": "^4.0.18"). - Vitest version remains:
peek/package.json:139("vitest": "^3.2.4"). - Coverage usage:
peek/vitest.config.ts:37-39setscoverage.provider = "v8"and reporters. - Coverage command:
peek/package.json:38(test:coveragerunsvitest ... --coverage). - CI trigger context:
- PR path runs
make test-unit(.github/workflows/ci.yml:111-112). - Coverage run is only on
push(.github/workflows/ci.yml:115-116).
- PR path runs
Compatibility assessment
- This is a major semver bump for a test tool dependency.
- The updated package peers on Vitest 4, but the repo still pins Vitest 3 (
peek/package.json:139), which is a concrete mismatch and may cause install/runtime incompatibility in coverage flows. - Because PR CI does not execute the coverage path, this specific upgrade is not fully validated before merge.
Recommended follow-up:
- Upgrade
vitestto a compatible 4.x version in the same PR (or pin coverage plugin back to 3.x). - Run coverage in PR context at least once for dependency bumps in this area (or add a temporary PR job when
peek/package*.jsonchanges).
Labels Applied
No labels applied by this run. Based on policy, this change qualifies for:
needs-human-review(major bump + breaking changes + peer compatibility concern)higher-risk(coverage execution path is push-only, not PR-validated)
What is this? | From workflow: Dependency Review
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
|
🤖 AI Assistant 🤖 7 Enabled Automations • 0 Disabled AutomationsEnabled automations
TroubleshootingThis control panel only adds or removes labels on the PR.
|
Dependency Update AnalysisSummary: This PR bumps
|
| Check | Result |
|---|---|
| Breaking changes | |
| Testable in PR | push to main, not PR runs |
Changelog highlights (v3.2.4 → v4.0.18)
v4.0.0includes a large breaking-change set (official release notes): removed deprecated APIs/types/options, removed Vite 5 support, reporter changes, and coverage-related deprecations cleanup.v4.0.18itself is mostly small fixes + one experimental hook (onModuleRunner), but the risk is dominated by the earlier 4.x breaking transition.- Source:
vitest-dev/vitestrelease notes forv4.0.0,v4.0.18, and priorv3.2.4.
Usage in this repository
- Dependency declaration updated in
peek/package.json:123. - Coverage provider is actively used in
peek/vitest.config.ts:37-40(provider: "v8"). - Coverage command path:
peek/package.json:38→test:coverage = vitest run --config vitest.config.ts --coverage --passWithNoTestsMakefile:255-257(test-unit-coveragerunsnpm run test:coverage).github/workflows/ci.yml:114-116runsmake test-unit-coverageonly on push.
- PR path skips coverage by design:
.github/workflows/ci.yml:110-113runsmake test-uniton PRsMakefile:229-230explicitly notes coverage thresholds are skipped for incremental PR runs.
Compatibility assessment
@vitest/coverage-v8@4.0.18declares peervitest: 4.0.18(peek/package-lock.json:6506-6509).- Repo still declares
vitest: ^3.2.4inpeek/package.json:139, and lockfile resolvesvitest@3.2.4(peek/package-lock.json:17336-17339). - This is a concrete major-version/peer-alignment mismatch in the current PR diff and warrants human review before merge.
- Because PR CI does not exercise coverage mode, this mismatch may evade PR-time validation.
Labels Applied
No labels were applied by this run. Recommended labels based on policy: needs-human-review (major bump + breaking-change surface + peer mismatch) and higher-risk (coverage path not validated in PR context).
What is this? | From workflow: Dependency Review
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
Dependency Update AnalysisSummary: This PR updates one npm devDependency (
|
| Check | Result |
|---|---|
| Breaking changes | 3.x → 4.x), and Vitest 4.0 release notes include a breaking-changes section and migration guide. |
| Testable in PR | ✅ Yes — relevant workflows run on pull_request for peek/package*.json changes. |
Changelog highlights (v3.2.4 → v4.0.18)
v4.0.18itself is mostly fixes/features, but this upgrade crosses the Vitest 4 major boundary.vitestv4.0.0release notes explicitly call out breaking changes and a migration guide, including removal/deprecation cleanup in reporter/coverage-related areas.- Source checked:
vitest-dev/vitestreleases forv3.2.4,v4.0.0, andv4.0.18.
Usage in this repository
- Declared in
peek/package.json:123as"@vitest/coverage-v8": "^4.0.18". vitestremains"^3.2.4"inpeek/package.json:139.- Coverage provider is used in
peek/vitest.config.ts:37-40(coverage.provider: "v8"). - CI/workflow coverage context:
Makefile:255-257runs coverage viatest-unit-coverage(npm run test:coverage)..github/workflows/ci.yml:4-13includespull_requesttrigger forpeek/package*.json..github/workflows/ci.yml:103-116installs deps withnpm ciand runs PR tests.
Compatibility assessment
- The updated package now peers on
vitest@4.0.18, while this repo still pinsvitest@^3.2.4. - I verified this directly by running
cd peek && npm ci, which fails withERESOLVE:Could not resolve dependency: peer vitest@"4.0.18" from@vitest/coverage-v8@4.0.18
- Result: this PR is not currently installable as-is; it needs coordinated Vitest major upgrade (or reverting coverage package to the 3.x line).
Labels Applied
- No labels applied in this run.
- Recommended:
needs-human-review(major bump + confirmed install-time peer conflict).
What is this? | From workflow: Dependency Review
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
Dependency Update AnalysisSummary: This PR updates
|
| Check | Result |
|---|---|
| Breaking changes | |
| Testable in PR | ✅ Yes — PR CI runs npm ci on pull_request and currently fails with ERESOLVE |
Changelog highlights (v3.2.4 → v4.0.18)
v4.0.0release includes an explicit Breaking Changes section (e.g., removed deprecated coverage options, removed deprecated APIs,workspace→projects, reporter changes, Node 18 support dropped in the v4 series).v4.0.18itself is mainly bug fixes + one experimental hook; no additional major break announcement in that patch release.
Sources: vitest-dev/vitest releases for tags v4.0.0 and v4.0.18.
Usage in this repository
- Dependency declaration:
peek/package.json:123("@vitest/coverage-v8": "^4.0.18"in this PR). - Core test runner is still pinned to Vitest 3:
peek/package.json:139("vitest": "^3.2.4"). - Coverage execution path:
peek/package.json:38→test:coveragerunsvitest ... --coverageMakefile:255-257→make test-unit-coveragecallsnpm run test:coverage.github/workflows/ci.yml:114-116runsmake test-unit-coverageonpush.
- PR CI installation path:
.github/workflows/ci.yml:103-105runscd peek && npm ci(including onpull_request).
Compatibility assessment
- The new package requires
vitest@4.0.18as a peer dependency (from lockfile peer metadata), while this repo still depends onvitest@^3.2.4. - Verified locally in this workflow run:
cd peek && npm cifails with:Could not resolve dependency: peer vitest@"4.0.18" from@vitest/coverage-v8@4.0.18Found: vitest@3.2.4
- This is a blocking compatibility issue until either:
vitestis upgraded to the matching 4.x line (and config/tests validated for Vitest 4 migration), or@vitest/coverage-v8is kept on a 3.x version compatible with Vitest 3.
Labels Applied
- Recommended:
needs-human-review(major bump + confirmed install-time breakage). higher-risknot indicated: this change is exercised in PR context vianpm cionpull_request.
What is this? | From workflow: Dependency Review
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
Dependency Update AnalysisSummary:
|
| Check | Result |
|---|---|
| Breaking changes | |
| Testable in PR | pull_request, but coverage path is only executed on push |
Changelog highlights (v3.2.4 → v4.0.18)
v4.0.0introduces a large breaking-change set (Vitest 4 migration): deprecated APIs removed, default behavior changes, and migration guide required.- Coverage-related breaking note in
v4.0.0: deprecated coverage options were removed in favor ofvitest/nodeexports. v4.0.18itself is mostly bug fixes/experimental additions and does not appear to add major new breakage versus earlier 4.x.- Source checked:
vitest-dev/vitestreleases forv4.0.0,v4.0.18, and baselinev3.2.4.
Usage in this repository
Primary usage is via Vitest coverage CLI path:
peek/package.json:38 "test:coverage": "vitest run --config vitest.config.ts --coverage --passWithNoTests"
Makefile:255-257 test-unit-coverage -> npm run test:coverage
.github/workflows/ci.yml:114-116 Unit tests with coverage (full) runs on push only
Related version declarations:
peek/package.json:123 "`@vitest/coverage-v8`": "^4.0.18"
peek/package.json:139 "vitest": "^3.2.4"
@vitest/coverage-v8@4.0.18 declares peer dependency vitest: 4.0.18 (from the lockfile diff), while repo still pins Vitest 3.x.
Compatibility assessment
- Major bump (
3.x→4.x) is inherently higher risk for test tooling. - Peer dependency mismatch is present now (
coverage-v8expects Vitest 4, repo still has Vitest 3), which is the main compatibility concern and can cause install/runtime issues depending on resolver behavior. - CI validation gap: PR path runs changed-file unit tests, but the explicit coverage execution path (
make test-unit-coverage) is push-only inci.yml, so the updated coverage provider is not fully exercised before merge.
Recommended follow-up: upgrade vitest to a compatible 4.x version in the same PR (or revert @vitest/coverage-v8), then re-run full unit+coverage checks.
Labels Applied
- No labels applied in this run.
- Recommended:
needs-human-review(major bump + peer mismatch) andhigher-risk(coverage path validated on push-only workflow step).
What is this? | From workflow: Dependency Review
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
Dependency Update AnalysisSummary: This PR updates one npm devDependency (
|
| Check | Result |
|---|---|
| Breaking changes | |
| Testable in PR | ✅ Yes — CI runs on pull_request for peek/package*.json changes |
Changelog highlights (v3.2.4 → v4.0.18)
v4.0.0release explicitly includes a "🚨 Breaking Changes" section and links to a migration guide.- Notable Vitest 4 breaks include removal of deprecated APIs/options and runtime/config behavior changes (e.g., deprecated coverage options removed, Vite 5 support removed in Vitest core, reporter changes).
v4.0.18itself is mainly bug fixes, but it is still on the Vitest 4 major line.
Usage in this repository
- Dependency declaration changed in
peek/package.json(devDependency): line 123. - Lockfile updated in
peek/package-lock.json. - Coverage is enabled via
provider: "v8"inpeek/vitest.config.tslines 37-40. - PR validation path exists:
.github/workflows/ci.ymltriggers onpull_requestforpeek/package*.jsonand runs lint/build/tests (including unit tests on PRs).
Compatibility assessment
- The updated package now declares peer dependencies
vitest: 4.0.18and@vitest/browser: 4.0.18(optional) in lockfile metadata. - This repo still pins
vitestto^3.2.4inpeek/package.json(line 139), and lockfile still resolvesnode_modules/vitestto3.2.4. - That major-version peer mismatch is the key risk: coverage plugin and test runner are on different major lines, which can cause runtime incompatibilities even if install succeeds.
- Recommended remediation: upgrade
vitest(and related@vitest/*packages) to the 4.x line in the same PR, then run the existing CI test matrix.
Labels Applied
- Recommended:
needs-human-review(major bump + peer-major mismatch with current Vitest 3 usage). higher-risk: not recommended, because this change is exercised bypull_requestCI.
What is this? | From workflow: Dependency Review
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
|
/ai please resolve issues with this PR |
|
/ai please resolve issues with this PR |
TL;DRCI failed before tests/build because Remediation
Investigation detailsRoot CauseBoth failing jobs stop at Install dependencies due to an npm Evidence
Validation
Follow-up
What is this? | From workflow: PR Actions Detective Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not. |
|
I attempted to resolve this by merging the latest Please recreate/update the PR branch from current What is this? | From workflow: Address Merge Conflict Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not. |
…-v8-4.0.18 Resolve package-lock merge conflicts while preserving the dependency bump. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
Dependency Update AnalysisSummary:
|
| Check | Result |
|---|---|
| Breaking changes | |
| Testable in PR |
Changelog highlights (v3.2.4 → v4.0.18)
v4.0.0includes many breaking changes across Vitest (release notes explicitly mark "🚨 Breaking Changes").- Relevant examples: removal of deprecated coverage options, removal of deprecated APIs/types, reporter changes, runner/pool behavior changes, and module-runner migration.
v4.0.18itself is mostly bugfix/experimental polish overv4.0.17.
Sources:
vitest-dev/vitestreleasev4.0.0vitest-dev/vitestreleasev4.0.18
Usage in this repository
- Dependency declaration changed in
peek/package.json:@vitest/coverage-v8:^3.2.4→^4.0.18(peek/package.json#L123)vitestremains^3.2.4(peek/package.json#L139)
- Coverage is used via Vitest config:
coverage.provider: "v8"inpeek/vitest.config.ts#L39-L42
- CI execution paths:
- PRs run
make test-unit(.github/workflows/ci.yml#L98-L100) - Coverage (
make test-unit-coverage) runs onpushonly (.github/workflows/ci.yml#L102-L104)
- PRs run
Compatibility assessment
- The lockfile diff shows
@vitest/coverage-v8@4.0.18with peer depsvitest: 4.0.18(and optional@vitest/browser: 4.0.18), while this PR keepsvitest@^3.2.4. - That version skew is an unsupported pairing upstream and is the primary risk in this PR.
- Because PR CI does not execute coverage mode, this specific integration risk is not fully validated before merge.
Recommendation:
- Prefer updating
vitestto^4.xin the same PR (or pin@vitest/coverage-v8back to the3.xline) so core + coverage packages stay aligned.
Labels Applied
No labels applied (no allowed classification label set was provided in this run).
What is this? | From workflow: Dependency Review
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
There was a problem hiding this comment.
Requesting changes due to a blocking lockfile consistency issue.
npm ci --legacy-peer-deps fails because package-lock.json is out of sync with package.json for @opentelemetry/sdk-trace-base (lockfile reflects 2.5.1 while the manifest requires ^2.6.0). Please regenerate the lockfile from the current manifest so clean installs succeed.
What is this? | From workflow: PR Review
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
1 participant
Bumps
@vitest/coverage-v8from 3.2.4 to 4.0.18.The body of this PR is automatically managed by the workflow runtime.
The body of this PR is automatically managed by the Update PR Body workflow.