[claude]

• I have read the contribution documentation for this project.
• I agree to follow the code of conduct that this project follows, as appropriate.
• The changes are appropriately documented (if applicable).
• The changes have sufficient test coverage (if applicable).
• The testsuite passes successfully on my local machine (if applicable).

Summarize your changes:

This bumps the yarn catalog entry for vitest from ^5.0.1 to ^5.0.5 (in .yarnrc.yml and the mirrored catalog field in the root package.json), which moves the root and all 25 workspaces from vitest 5.0.1 to 5.0.5, along with its own @vitest/mocker/@vitest/spy and new dependency ranges in the lockfile. 5.0.5 carries the fix for GHSA-p458-7748-mcp3, which affects @vitest/ui and @vitest/browser; this repo uses neither, so it wasn't exposed, and the bump just keeps vitest current. On Linux, yarn build, yarn lint, yarn constraints, yarn knip and the whole fast project (66 files, 711 passed, 6 todo) pass; the slow and slow-verdaccio projects are left to CI.

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​vitest@​5.0.1 ⏵ 5.0.5			+1	+1

View full report

[claude]

I reviewed this vitest bump and didn't find any bugs. A code owner still needs to sign off, because .github/CODEOWNERS assigns every path in the repo to a team.

What was reviewed:

• The catalog entry in .yarnrc.yml and the mirrored catalog field in package.json both move to ^5.0.5, so they stay in sync.
• The yarn.lock entries match vitest 5.0.5's own dependency ranges. Two new transitive majors come from vitest: obug 3.0.0 and a pinned why-is-node-running 3.2.1, which no longer depends on siginfo or stackback. tinyexec moves to ^1.3.1.
• No other workspace dependency resolutions changed. This is dev/test tooling only, and enableScripts: false is unchanged.

Extended reasoning...

The change touches three files: .yarnrc.yml, package.json and yarn.lock. It bumps the vitest catalog version from ^5.0.1 to ^5.0.5 and updates vitest's transitive dev dependencies in the lockfile. It changes no source code. The only sensitive surface is supply chain: new lockfile checksums for test tooling, with install scripts still disabled. The change is simple and consistent, but approval is blocked because the catch-all * rule in .github/CODEOWNERS assigns every changed path to a code-owner team.