[claude]

This moves vitest from 5.0.1 to 5.0.5. 5.0.5 carries the fix for GHSA-p458-7748-mcp3, which affects @vitest/ui and @vitest/browser. This repo doesn't use either of those, so it wasn't exposed; the bump just keeps vitest on the patched release. The lockfile only moves vitest and its own dependencies. Lint, build and yarn test (including the Electron binary tests) pass locally on Linux with Node 22.

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vitest@​5.0.1 ⏵ 5.0.5			+1	+1

View full report

[claude]

I reviewed this vitest bump and didn't find any bugs. All files in this repo have code owners, so a code owner should still take a look, mainly to confirm the transitive changes below match upstream vitest 5.0.5.

What was reviewed:

• package.json and the workspace entry in yarn.lock both use vitest ^5.0.5. vite ^8.0.16 still satisfies the ^6.4.0 || ^7.0.0 || ^8.0.0 peer range.
• The PR description lists only some of the lockfile changes. It also moves two of vitest's dependencies up a major version: obug goes from 2.2.1 to 3.0.0, and why-is-node-running goes from ^2.3.0 to an exact pin of 3.2.1, which removes siginfo and stackback. tinybench changes from a 6.1.4 pin to ^6.2.2, std-env moves to 4.3.0, and tinyexec 1.3.1 is added alongside 1.3.0.

Extended reasoning...

Only package.json (one devDependency range) and yarn.lock (the regenerated vitest subtree) change, and no source code is touched. Nothing here involves auth, crypto or data handling, though new dependency versions do mean new third-party code runs in dev and CI. I didn't approve because .github/CODEOWNERS assigns every path to a code-owner team. The lockfile also pulls in transitive major-version bumps that the PR description doesn't mention, and those are worth a quick check against upstream.