[claude]

This moves vitest and @vitest/coverage-v8 from 5.0.1 to 5.0.5. 5.0.5 carries the fix for GHSA-p458-7748-mcp3, which affects @vitest/ui and @vitest/browser. This repo doesn't use either of those, so it wasn't exposed; the bump just keeps the vitest family in step. The lockfile only moves vitest and its own dependencies. Lint, build and test:ci pass locally on Linux with Node 22.

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​vitest/​coverage-v8@​5.0.1 ⏵ 5.0.5	+1		+1
	npm/​vitest@​5.0.1 ⏵ 5.0.5			+1	+1

View full report

[claude]

I reviewed this PR and didn't find any bugs. CODEOWNERS assigns every path in the repo to a code-owner team, so one of its members should still sign off.

What was reviewed:

• package.json and yarn.lock agree: both ranges are now ^5.0.5, and every 5.0.1 peer pin in the vitest and @ vitest/coverage-v8 entries now says 5.0.5.
• The two major-version moves come in through vitest's own dependencies: obug goes to 3.0.0, and why-is-node-running goes to 3.2.1, which no longer depends on siginfo or stackback. Both of those packages are removed from the lockfile, and nothing else references them.
• The tinyexec split is expected: lint-staged still needs ^1.3.0 and vitest now needs ^1.3.1. No packages outside vitest's dependency tree changed.

Extended reasoning...

The change touches only package.json and yarn.lock. It bumps two devDependency ranges (vitest and @ vitest/coverage-v8, 5.0.1 to 5.0.5) and regenerates the lockfile entries for vitest's dependency tree. There is no runtime code, and nothing that ships in dist changes. It touches no security-sensitive code. I deferred instead of approving only because .github/CODEOWNERS assigns every path to a code-owner team.