[claude]

Bumps vitest from ^5.0.1 (locked at 5.0.1) to ^5.0.5. 5.0.5 carries the fix for GHSA-p458-7748-mcp3, which affects @vitest/ui and @vitest/browser. This repo doesn't depend on either of those, so it wasn't affected; this just keeps the vitest family on the patched release.

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vitest@​5.0.1 ⏵ 5.0.5			+1	+1

View full report

[claude]

I reviewed this vitest bump and found no bugs. CODEOWNERS assigns every path to a code-owner team, so I'm leaving approval to one of its members.

What was reviewed:

• yarn.lock matches package.json. vitest, @ vitest/mocker and @ vitest/spy all resolve to 5.0.5, and the peer pins were updated to match.
• The two major bumps (obug 3, why-is-node-running 3.2.1) are used only by vitest. Dropping siginfo and stackback follows from why-is-node-running 3, which no longer depends on them.
• tinyexec ^1.3.0 is still locked separately for another dependent, so splitting its entry is expected.

Extended reasoning...

The change bumps one devDependency range in package.json (vitest ^5.0.1 to ^5.0.5) and regenerates the matching yarn.lock entries. It changes no source code and touches no security-sensitive runtime code, since it only changes test tooling. The new transitive majors are used only inside vitest, and the repo already requires Node >=22.12.0. The deciding fact is .github/CODEOWNERS, which assigns all paths (*) to a code-owner team, so a code owner should approve rather than this automated review.