build(deps-dev): upgrade vitest to v5

[claude]

Requested by David Sanders · Slack thread

This bumps vitest from ^4.1.11 to ^5.0.1 and @vitest/coverage-v8 from the exact 4.1.0 pin to the exact 5.0.1 pin. That also fixes the old peer mismatch between the two, which yarn used to warn about. Vitest 5 lists vite as a required peer instead of a dependency, so I added vite as a devDependency at ^8.2.2, the version already in the lockfile. No test or config changes were needed. The json and junit reporters still honor --outputFile, and coverage still goes to coverage/. The Electron binary download is blocked in the environment I used, so I ran the suite with plain Node 22.22 instead of the tools/vitest.ts Electron wrapper. The results match main (902 pass), and the only failure is the Algolia-backed npm-search test, which also fails on main there because it needs network access.

🤖 Generated with Claude Code

https://claude.ai/code/session_01N2vvE5XzurMvQfsX7Vz7bF

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​vitest/​coverage-v8@​4.1.0 ⏵ 5.0.1			+1
	vitest@​4.1.11 ⏵ 5.0.1	+1		+1
	vite@​8.2.2

View full report

[coveralls]

coverage: 87.341% (-0.01%) from 87.352% — vitest-5 into main

[claude]

I reviewed this PR and didn't find any bugs. Because this bumps vitest and @ vitest/coverage-v8 across a major version boundary (and pulls in vite as a new direct devDependency), a human look would still be worthwhile before merging.

• Checked the version bumps: vitest ^4.1.11 → ^5.0.1, @ vitest/coverage-v8 pinned 4.1.0 → 5.0.1, and vite added as an explicit devDependency (^8.2.2) since vitest 5 makes it a required peer rather than a transitive dependency.
• Verified in yarn.lock that coverage-v8 5.0.1's peer requirement (vitest 5.0.1 exact) matches the new vitest version, so the prior peer-mismatch warning is resolved for now.
• Noticed coverage-v8's dependency tree no longer pulls in the external istanbul-reports package, replacing it with a new first-party @ vitest/istanbul-lib-report package; I could not confirm from the lockfile alone whether all previously supported report formats (text/html/json/clover) are still produced.

Extended reasoning...

The change is confined to package.json and yarn.lock — a devDependency major-version bump for vitest/@ vitest/coverage-v8 plus a new explicit vite devDependency — with no application or test source changes, so it touches no security-sensitive surface. I confirmed the vitest/coverage-v8 peer version alignment now matches, resolving the previously-warned mismatch for this pair of versions. The one thing I could not settle from static review is whether coverage-v8's replacement of the external istanbul-reports package with a first-party @ vitest/istanbul-lib-report package preserves all report formats (text/html/json/clover) that CI/Coveralls rely on, since I had no network access to inspect that package's contents. That unresolved question, on a change that affects CI coverage reporting, is why a human confirming an actual --coverage run still seems worthwhile even though no concrete bug was found.