build(deps-dev): bump vitest from 2.1.9 to 4.1.11 in /web by dependabot[bot] · Pull Request #16 · UnicoLab/smlcode

dependabot · 2026-08-23T22:43:16Z

Bumps vitest from 2.1.9 to 4.1.11.

Release notes

v4.1.11

   🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

v4.1.10

   🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)

vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)

browser:

Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)

Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)

mocker:

Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)

pool:

Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

browser:

Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)

Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

... (truncated)

Commits

9bd8d46 chore: release v4.1.11 (#10995)
9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
db616d2 chore: release v4.1.10 (#10718)
bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
a7a61e7 chore: release v4.1.9 (#10598)
934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
e61f2dd chore: release v4.1.8
e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.

…io, infra

…hardening

…metrics

… block, 13 language packs

…s (v0.17.0)

…tstrap actually install deps - web/tsconfig.json excludes test files; new tsconfig.test.json typechecks them - HITLPopup.test.tsx: type mocks against the real PendingResponse<T>; drop an invented ShellAsk.reason field the server never sends - Makefile: web-deps target with npm ci -> npm install fallback for the stale lockfile; bootstrap no longer short-circuits on a stale ui/assets directory - cmd/slmcode/ui is now build output only (.gitkeep tracked); the placeholder page moved into Go so building the UI cannot dirty a tracked file - release workflow verifies a real Studio bundle is embedded, strips sourcemaps, installs golangci-lint, and validates the tag against version.go - install scripts: real checksum verification on Windows, no sudo for --user installs, loud warning when SHA256SUMS is unavailable - slmcode update: fix the Windows asset name, downgrade guard, --user/--system - RELEASE.md, changelog breaking-changes table, docs

dependabot · 2026-08-23T22:43:17Z

Labels

The following labels could not be found: dependencies, javascript. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

…gs (config was already v2, tool was v1)�[0m �[38;5;243m 2�[0m �[38;5;243m 3�[0m �[38;5;249m`.golangci.yml` is v2-format but the installed golangci-lint binary was�[0m �[38;5;243m 4�[0m �[38;5;249mv1.64, so `make check` silently never ran the real lint gate. Upgrading to�[0m �[38;5;243m 5�[0m �[38;5;249mv2.13.1 surfaced 95 findings: 66 staticcheck QF1012 (WriteString(Sprintf)�[0m �[38;5;243m 6�[0m �[38;5;249m-> Fprintf, auto-fixed) and 28 gosec findings reviewed per-file and either�[0m �[38;5;243m 7�[0m �[38;5;249mfixed or annotated with a `//nolint:gosec // reason` matching this repo's�[0m �[38;5;243m 8�[0m �[38;5;249mexisting convention.�[0m

…e reachable through a symlink mismatch�[0m �[38;5;243m 2�[0m �[38;5;243m 3�[0m �[38;5;249ms.rootDir() returns the configured root as-is, but every path derived from�[0m �[38;5;243m 4�[0m �[38;5;249mworkspacePath()/resolveWorkspacePath() is passed through EvalSymlinks. On�[0m �[38;5;243m 5�[0m �[38;5;249mmacOS $TMPDIR (and thus every t.TempDir() workspace root) is itself a�[0m �[38;5;243m 6�[0m �[38;5;249msymlink into /private, so filepath.Rel(s.rootDir(), resolvedPath) never�[0m �[38;5;243m 7�[0m �[38;5;249mmatched — silently defeating every ".slmcode/ harness state" check built on�[0m �[38;5;243m 8�[0m �[38;5;249mtop of it:�[0m �[38;5;243m 9�[0m �[38;5;243m 10�[0m �[38;5;249m - GET /api/workspace/file?path=.slmcode/auth.json served the operator's�[0m �[38;5;243m 11�[0m �[38;5;249m provider API keys over HTTP.�[0m �[38;5;243m 12�[0m �[38;5;249m - GET /api/workspace/tree advertised auth.json in the listing.�[0m �[38;5;243m 13�[0m �[38;5;249m - The review queue could both display and apply a write into�[0m �[38;5;243m 14�[0m �[38;5;249m .slmcode/hooks.json (arbitrary-bash-on-next-run) via a crafted�[0m �[38;5;243m 15�[0m �[38;5;249m .slmcode/pending/*.patch.json entry.�[0m �[38;5;243m 16�[0m �[38;5;243m 17�[0m �[38;5;249mAdded Server.realRootDir(), which applies the same EvalSymlinks-or-fallback�[0m �[38;5;243m 18�[0m �[38;5;249mresolution as resolveWorkspacePath, and routed the three affected�[0m �[38;5;243m 19�[0m �[38;5;249mfilepath.Rel(s.rootDir(), ...) call sites through it.�[0m �[38;5;243m 20�[0m �[38;5;243m 21�[0m �[38;5;249mCaught by pkg/server/adversarial_secrets_test.go�[0m �[38;5;243m 22�[0m �[38;5;249m(TestAdvNoAPIKeyLeakOverHTTP, TestAdvPendingQueueCannotTargetHarnessState),�[0m �[38;5;243m 23�[0m �[38;5;249mwhich were failing on main before this change.�[0m

…ed both reviewers, doubling real LLM calls�[0m �[38;5;243m 2�[0m �[38;5;243m 3�[0m �[38;5;249mspeculate() cancels a losing slot's goroutine only before it reaches the�[0m �[38;5;243m 4�[0m �[38;5;249mexecutor; once dispatched, a fast/local executor runs it to completion�[0m �[38;5;243m 5�[0m �[38;5;249mregardless. reviewSlots() launched the primary reviewer and the strict�[0m �[38;5;243m 6�[0m �[38;5;249msecond reviewer fully concurrently with no head start, so against a fast�[0m �[38;5;243m 7�[0m �[38;5;249mexecutor both real LLM calls always completed before either could cancel�[0m �[38;5;243m 8�[0m �[38;5;249mthe other — the "1 race, up to 2 real requests" design always spent 2,�[0m �[38;5;243m 9�[0m �[38;5;249mnever 1.�[0m �[38;5;243m 10�[0m �[38;5;243m 11�[0m �[38;5;249mThis doubled review calls per correction round, which both blew the�[0m �[38;5;243m 12�[0m �[38;5;249mcall-budget escalation threshold (14 real calls against a budget of 10) and�[0m �[38;5;243m 13�[0m �[38;5;249mduplicated review-prompt entries per round, misaligning correction-content�[0m �[38;5;243m 14�[0m �[38;5;249mchecks that expect one review per CORRECTOR-PASS-N.�[0m �[38;5;243m 15�[0m �[38;5;243m 16�[0m �[38;5;249mAdded an optional per-slot Delay to SpecSlot, honored in speculate()'s�[0m �[38;5;243m 17�[0m �[38;5;249mdispatch loop: a delayed slot waits out the delay (or bails immediately if�[0m �[38;5;243m 18�[0m �[38;5;249mthe race is already won) before ever reaching the executor. reviewSlots()�[0m �[38;5;243m 19�[0m �[38;5;249mnow gives reviewer-strict a 20ms head start — well under real LLM latency,�[0m �[38;5;243m 20�[0m �[38;5;249mso production still races both reviewers as before, but long enough for a�[0m �[38;5;243m 21�[0m �[38;5;249mfast/local/test executor to let the primary win outright and skip the�[0m �[38;5;243m 22�[0m �[38;5;249msecond dispatch.�[0m �[38;5;243m 23�[0m �[38;5;243m 24�[0m �[38;5;249mCaught by pkg/loop/retry_ladder_test.go�[0m �[38;5;243m 25�[0m �[38;5;249m(TestCorrectionRoundsSeeThePreviousCorrection,�[0m �[38;5;243m 26�[0m �[38;5;249mTestCallBudgetExhaustionEscalatesWithAUsefulState).�[0m

…he CSS bundle and its own SSE marker�[0m �[38;5;243m 2�[0m �[38;5;243m 3�[0m �[38;5;249mdiscoverAssets() found the CSS <link> by taking a +-200-char window around�[0m �[38;5;243m 4�[0m �[38;5;249mrel="stylesheet" and grabbing the first href="/assets/..." in it. On a real�[0m �[38;5;243m 5�[0m �[38;5;249mVite build, the preceding <link rel="modulepreload" href="...js"> tags for�[0m �[38;5;243m 6�[0m �[38;5;249mroute chunks sit inside that window and their href comes first in document�[0m �[38;5;243m 7�[0m �[38;5;249morder, so the "CSS path" it returned was actually a JS chunk�[0m �[38;5;243m 8�[0m �[38;5;249m(assets/react-*.js) whenever the head had two or more modulepreload tags�[0m �[38;5;243m 9�[0m �[38;5;249mahead of the stylesheet link. Fixed to search only within the matched�[0m �[38;5;243m 10�[0m �[38;5;249m<link ...> tag's own boundaries.�[0m �[38;5;243m 11�[0m �[38;5;243m 12�[0m �[38;5;249mSeparately, the JS-corpus marker list checked for the literal "/api/events"�[0m �[38;5;243m 13�[0m �[38;5;249msubstring, but createEventSource() builds that URL as `${BASE}/events`�[0m �[38;5;243m 14�[0m �[38;5;249m(BASE="/api"), so the two halves never appear contiguous in the bundle —�[0m �[38;5;243m 15�[0m �[38;5;249mevery other marker in the list is a bare path for the same reason (client.ts's�[0m �[38;5;243m 16�[0m �[38;5;249mrequest() prepends BASE separately). Changed the marker to "/events" to�[0m �[38;5;243m 17�[0m �[38;5;249mmatch.�[0m

Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 2.1.9 to 4.1.11. - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) --- updated-dependencies: - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

piotrlaczkowski · 2026-08-27T17:27:56Z

Superseded by #22, which landed this bump together with the rest of the backlog. Merging these individually would have meant one rebase+CI cycle each, since every web PR touches the same lockfile.

Delivered on main in ff347b2.

dependabot · 2026-08-27T17:27:59Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

claude added 10 commits August 23, 2026 14:32

wave-a checkpoint: tool layer, context engineering, terminal UX, stud…

7bbe216

…io, infra

wave-b checkpoint: constrained decoding, memory+evolve, lint cleanup

a713c01

wave-c checkpoint: inner loop correctness, orchestrator wiring, plan …

a1d795c

…hardening

wave-d checkpoint: config surface, cross-package gaps, docs rewrite

5b6718e

wave-e checkpoint: final wiring, token streaming, first-attempt edit …

d09a3b4

…metrics

wave-f: residual wiring, dead code removal, lint to zero, e2e smoke test

26a13ef

wave-g: adversarial review fixes, language packs, UX validation

9bcb36d

wave-h: engine cancellation fixes, studio token hardening, UX outcome…

d3f9046

… block, 13 language packs

wave-i: retry convergence, stall bounds, CLI wiring, release readines…

5800b1e

…s (v0.17.0)

piotrlaczkowski and others added 6 commits August 24, 2026 09:40

chore(web): regenerate package-lock.json

f6c2ac7

dependabot Bot force-pushed the dependabot/npm_and_yarn/web/vitest-4.1.11 branch from b4f1c3d to 94aa726 Compare August 24, 2026 08:25

piotrlaczkowski force-pushed the main branch 2 times, most recently from a85446a to 1d710eb Compare August 24, 2026 09:52

piotrlaczkowski mentioned this pull request Aug 27, 2026

build(deps): React 19, Vite 8, Vitest 4 and the GitHub Actions majors #22

Merged

piotrlaczkowski closed this Aug 27, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/web/vitest-4.1.11 branch August 27, 2026 17:28

Navigation Menu

Uh oh!

build(deps-dev): bump vitest from 2.1.9 to 4.1.11 in /web - #16

build(deps-dev): bump vitest from 2.1.9 to 4.1.11 in /web#16
dependabot[bot] wants to merge 16 commits into
mainfrom
dependabot/npm_and_yarn/web/vitest-4.1.11

dependabot Bot commented on behalf of github Aug 23, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Aug 23, 2026

Uh oh!

piotrlaczkowski commented Aug 27, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v4.1.11

🐞 Bug Fixes

View changes on GitHub

v4.1.10

🐞 Bug Fixes

View changes on GitHub

v4.1.9

🐞 Bug Fixes

View changes on GitHub

v4.1.8

🐞 Bug Fixes

View changes on GitHub

v4.1.7

🐞 Bug Fixes

View changes on GitHub

Uh oh!

dependabot Bot commented on behalf of github Aug 23, 2026

Labels

Uh oh!

piotrlaczkowski commented Aug 27, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot Bot commented on behalf of github Aug 23, 2026 •

edited

Loading