[claude]

Requested by David Sanders · Slack thread

This upgrades vitest from v4 to 5.0.1 and bumps @vitest/coverage-v8 from the stale exact pin of 3.0.5 to 5.0.1, since the coverage package peer-pins vitest exactly. Vitest 5 makes vite a required peer instead of a dependency, so vite is now listed as a devDependency (^8.0.16, the version previously in the lockfile). No test or config changes were needed; lint, build, and all 235 tests pass locally, and coverage runs cleanly. The release workflow's Node 20.x setup was left alone because that job only installs, builds, and publishes; the tests it depends on run through test.yml on Node 22.12.x.

🤖 Generated with Claude Code

https://claude.ai/code/session_01N2vvE5XzurMvQfsX7Vz7bF

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​vitest/​coverage-v8@​3.0.5 ⏵ 5.0.1			+7
	vitest@​4.1.11 ⏵ 5.0.1	+1		+1
	vite@​8.3.0

View full report

[claude]

Looks good, straightforward dev-dependency version bump.

• Checked package.json: @ vitest/coverage-v8 and vitest are both pinned/ranged to align on 5.0.1, and the new explicit vite devDependency matches the version already resolved in the old lockfile.
• Checked yarn.lock: resolved versions (vitest@ 5.0.1, @ vitest/coverage-v8@ 5.0.1, vite@ 8.3.0) are consistent with the package.json ranges, and the large deletion count is explained by the dependency graph shrinking under vite/vitest v5+v8.
• Considered whether the exact coverage-v8 pin vs. caret vitest range could drift out of lockstep in the future, and whether the repo's 7-day npm age gate could block this exact install — both are pre-existing/config-level risks unrelated to correctness of this change, not introduced bugs.

Extended reasoning...

This is a dev-only dependency bump (vitest v4→v5, coverage-v8 v3→v5, new explicit vite v8 devDependency) plus a mechanically regenerated yarn.lock; no application/runtime code changed, so there is no security-sensitive surface. package.json and yarn.lock are mutually consistent, the PR description's claims match the diff, no CODEOWNERS restriction applies, and the bug hunter's dry_streak exit plus two ruled-out theoretical lockstep/age-gate concerns support a low-risk mechanical change.

[electron-npm-package-publisher]

🎉 This PR is included in version 3.0.2 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀