[claude]

Requested by David Sanders · Slack thread

This bumps vitest and @vitest/coverage-v8 to ^5.0.1. It also fixes the existing peer mismatch where coverage-v8 was locked at 4.1.1 and vitest at 4.1.11. Vitest 5 no longer depends on vite and lists it as a required peer instead, so vite is added as a devDependency at ^8.0.16, the version already in the lockfile, which keeps vite and rolldown at their current locked versions. Vitest 5 needs Node ^22.12.0 or newer, so CI moves from Node 20 to 22. Instead of hardcoding 22.x, a new .nvmrc at the repo root sets Node 22, and the Test and Lint workflows both read it with node-version-file: .nvmrc, so future bumps are a one-line change. No test or config changes were needed: build, lint, all 57 tests and the coverage run pass locally on Node 22.

🤖 Generated with Claude Code

https://claude.ai/code/session_01N2vvE5XzurMvQfsX7Vz7bF

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​vitest/​coverage-v8@​4.1.1 ⏵ 5.0.1			+1
	vitest@​4.1.11 ⏵ 5.0.1	+1		+1
	vite@​8.0.16

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		High CVE: npm nanoid: custom generators can loop indefinitely when size is zero CVE: GHSA-2v37-7h3g-55p8 nanoid: custom generators can loop indefinitely when size is zero (HIGH) Affected versions: < 3.3.18; >= 4.0.0 < 5.1.6 Patched version: 3.3.18 From: package.json → npm/vite@8.0.16 → npm/nanoid@3.3.17 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/nanoid@3.3.17. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[claude]

Looks good, straightforward dependency and CI version bump.

Reviewed: both CI workflows (lint.yml, test.yml) consistently bump Node from 20.x to 22.x with no other stale version references (no .nvmrc or engines field to update); package.json's vitest/@ vitest/coverage-v8 (^5.0.1) and new vite (^8.0.16) devDependency versions match exactly what's resolved in yarn.lock; the vite version is pinned to the version already present in the prior lockfile as the PR description claims.

Extended reasoning...

Change touches only CI workflow YAML and dependency manifests/lockfile (no application or security-sensitive code). Verified via diff that both workflows were updated consistently and that package.json's new devDependency versions (vitest 5.0.1, @ vitest/coverage-v8 5.0.1, vite 8.0.16) match the corresponding yarn.lock entries exactly, with no engines/.nvmrc inconsistency left behind. This is a small, mechanical, well-scoped version bump with no design decisions or ambiguity, so a human need not review it.

[claude]

Looks good — the dsanders11 feedback about the hardcoded Node version has been addressed by switching both lint.yml and test.yml to node-version-file: .nvmrc, keeping the two workflows consistent. Checked the vitest 4→5 bump, the new explicit vite ^8.0.16 devDependency (needed since vitest 5 makes vite a peer instead of a direct dep), the .nvmrc pin to Node 22, and the yarn.lock regeneration — all consistent with the stated intent and no other issues found.

Extended reasoning...

Small, mechanical CI/toolchain change: adds .nvmrc (Node 22), points both GitHub Actions workflows at it via node-version-file instead of a hardcoded version, and bumps vitest/@ vitest/coverage-v8 to v5 plus adds vite as an explicit devDependency, with yarn.lock regenerated. No security-sensitive surface (no auth/crypto/data-handling code touched). The one open inline objection (dsanders11 on lint.yml:22) was addressed by the follow-up commit that made both workflows consistent, and the bug hunt reported no findings, so I'm acknowledging the fix and approving.