build(deps-dev): bump the development-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the development-dependencies group with 3 updates in the / directory: @types/node, typescript and vitest.

Updates @types/node from 25.3.3 to 26.5.1

Commits

• See full diff in compare view

Updates typescript from 5.9.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).
• fixed issues query for TypeScript 6.0.3 (Stable).

Downloads are available on:

• npm

TypeScript 6.0

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).

Downloads are available on:

• npm

TypeScript 6.0.1 RC

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).

Downloads are available on:

• npm

TypeScript 6.0 Beta

For release notes, check out the release announcement.

• fixed issues query for Typescript 6.0.0 (Beta).

Downloads are available on:

• npm

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates vitest from 4.1.11 to 5.0.1

Release notes

Sourced from vitest's releases.

v5.0.1

   🚀 Features

• ui:
  • Move trace attempts selector to viewer header  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in vitest-dev/vitest#11189 (5dc4b)
  • Add focused trace view layout mode  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in vitest-dev/vitest#11190 (376dc)

   🐞 Bug Fixes

• Exit 1 when vitest list fails collection  -  by @​hamed-bavar in vitest-dev/vitest#11145 and vitest-dev/vitest#11146 (6108b)
• Keep parse error details in static collection  -  by @​hamed-bavar in vitest-dev/vitest#11150 and vitest-dev/vitest#11151 (7c818)
• Avoid recursive prototype in automocking  -  by @​sheremet-va in vitest-dev/vitest#11195 (99fc5)
• Prevent false Vitest import resolution  -  by @​sheremet-va in vitest-dev/vitest#11196 (b426c)
• Keep metadata file when clearing the cache  -  by @​sheremet-va in vitest-dev/vitest#11199 (73614)
• Correct typos in error message and comments  -  by @​shinji00222 and Shinji in vitest-dev/vitest#11187 (115c3)
• Resolve ResolvedConfig exactOptionalPropertyTypes errors  -  by @​LukeAbby in vitest-dev/vitest#11175 (498fb)
• Share the server on self-referencing extends  -  by @​sheremet-va in vitest-dev/vitest#11034 (23dda)
• Warn when deprecated deps.optimizer.web is used  -  by @​im10furry in vitest-dev/vitest#11214 (2ce29)
• browser:
  • Avoid double quotes in config.define  -  by @​sheremet-va in vitest-dev/vitest#11198 (972e2)
• doctor:
  • Measure vm pools for custom environments  -  by @​sheremet-va in vitest-dev/vitest#11212 (91ab1)
• expect:
  • Correct return value in toMatchAriaSnapshot  -  by @​sheremet-va in vitest-dev/vitest#11208 (c119b)
• fakeTimers:
  • Force queueMicrotask and nextTick in toNotFake  -  by @​kingmakeruix, kingmakeruix, Hiroshi Ogawa, Codex and @​hi-ogawa in vitest-dev/vitest#11261 (a47d7)
• snapshot:
  • Report obsolete keys next to skipped tests  -  by @​hamed-bavar, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#11157 and vitest-dev/vitest#11158 (17e2b)
• types:
  • Make public declarations self-contained  -  by @​ZoeySigel in vitest-dev/vitest#11141 (45546)
• ui:
  • Fix collapse/expand suite with file name search  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in vitest-dev/vitest#11260 (0a712)
  • Fix explorer file summary count  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in vitest-dev/vitest#11125 (05982)
• utils:
  • Fix deepMerge to handle prototype  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in vitest-dev/vitest#11215 (4944c)

    View changes on GitHub

v5.0.0

Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

   🚨 Breaking Changes

• Replace loupe.inspect with pretty-format  -  by @​hi-ogawa, Claude Opus 5 (1M context) and OpenAI Codex in vitest-dev/vitest#9609 (3f802)
• Remove quotes from string values in test.for/each title $ variable (take 2)  -  by @​hi-ogawa in vitest-dev/vitest#10170 (04d37)
• Default attachmentsDir from .vitest-attachements/ to .vitest/attachments/  -  by @​MdSadiqMd in vitest-dev/vitest#10186 (1ba73)
• Remove sequential test/suite options in favor of concurrent  -  by @​hi-ogawa and OpenAI Codex in vitest-dev/vitest#10198 (9229f)
• Represent locator as an object instead of a string  -  by @​sheremet-va in vitest-dev/vitest#10212 (80f07)
• Inline expect package  -  by @​sheremet-va in vitest-dev/vitest#10221 (ad162)
• Remove deprecated entry points  -  by @​sheremet-va in vitest-dev/vitest#10222 (994c6)

... (truncated)

Commits

• 03630a5 chore: release v5.0.1 (#11275)
• a47d790 fix(fakeTimers): force queueMicrotask and nextTick in toNotFake (#11261)
• 2ce29d5 fix: warn when deprecated deps.optimizer.web is used (#11214)
• ccd6d05 docs: fix typecheck exclude default in documentation (#11223)
• 91ab158 fix(doctor): measure vm pools for custom environments (#11212)
• 23dda73 fix: share the server on self-referencing extends (#11034)
• 498fbe9 fix: resolve ResolvedConfig exactOptionalPropertyTypes errors (#11175)
• 115c3f6 fix: correct typos in error message and comments (#11187)
• 7361465 fix: keep metadata file when clearing the cache (#11199)
• 972e24b fix(browser): avoid double quotes in config.define (#11198)
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vitest@​4.1.11 ⏵ 5.0.1	+1		+1
	@​types/​node@​25.3.3 ⏵ 26.5.1	+1		+1	+1
	typescript@​5.9.3 ⏵ 7.0.2			-1		+10

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Network access: npm vitest in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package-lock.json → npm/vitest@5.0.1 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/vitest@5.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Dynamic code execution: npm vitest Eval Type: Function Location: Package overview From: package-lock.json → npm/vitest@5.0.1 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/vitest@5.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm rolldown is 72.0% likely to have a medium risk anomaly Notes: This module is a legitimate-looking HMR client but contains a high-impact execution mechanism: it dynamically imports modules from server-provided data.path and injects/executess module scripts from server-provided data.url, both driven by untrusted WebSocket JSON messages. If the WebSocket server/transport is compromised (notably if ws:// is used without TLS), an attacker could potentially trigger remote code execution in the client. No overt stealth/persistence/credential theft behavior is present in the snippet, but the trust boundary and dynamic code loading make the security risk significant for any non-fully-trusted development setup. Confidence: 0.72 Severity: 0.66 From: package-lock.json → npm/vitest@5.0.1 → npm/rolldown@1.2.8 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rolldown@1.2.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[mackenly]

Includes TypeScript major (5.9 → 7.0). Needs human review before merge.

• Bot

[mackenly]

@dependabot rebase

[mackenly]

@dependabot rebase