[claude]

This bumps vitest from ^5.0.1 to ^5.0.5 and @vitest/coverage-v8 from 5.0.1 to 5.0.5 (still pinned exactly), and the lockfile moves both from 5.0.1 to 5.0.5 along with vitest's own dependencies. 5.0.5 carries the fix for GHSA-p458-7748-mcp3, which affects @vitest/ui and @vitest/browser. This repo doesn't use either of those, so it wasn't exposed, and the bump keeps the vitest packages in step. Every package that changed in the lockfile was published at least 7 days ago. Lint and tsc pass locally, and all 144 tests pass with coverage.

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​vitest/​coverage-v8@​5.0.1 ⏵ 5.0.5	+1		+1
	vitest@​5.0.1 ⏵ 5.0.5			+1	+1

View full report

[claude]

I reviewed this dev-only vitest bump and didn't find any bugs. Every path in the repo has CODEOWNERS (* in .github/CODEOWNERS), so a code owner still needs to sign off.

What was reviewed:

• yarn.lock matches package.json. The workspace entry and the vitest/@ vitest/coverage-v8 peer pins all move together to 5.0.5.
• The new versions of obug (3.0.0) and why-is-node-running (3.2.1) are only used inside vitest and coverage-v8. No repo source imports them.
• Nothing else in the lockfile still needs siginfo or stackback. The old tinyexec ^1.3.0 entry is still needed by another dependency, so keeping it alongside the new ^1.3.1 entry is correct.

Extended reasoning...

This change only touches package.json devDependencies (vitest and @ vitest/coverage-v8, 5.0.1 to 5.0.5) and the regenerated yarn.lock. No runtime dependencies or source files change. It touches no security-sensitive code, though it does pull in new third-party package versions, all with matching lockfile checksums. Approval was withheld only because .github/CODEOWNERS assigns every path to code owner teams.