From f48c279ccf025f11a2253badcbdbd8b5bc63af82 Mon Sep 17 00:00:00 2001 From: Alexander Ivanov Date: Tue, 25 Aug 2026 12:23:59 +0300 Subject: [PATCH] Ignore vitest majors in Dependabot, closing the gap that broke PR #65 PR #65 ("Bump the npm-development group with 3 updates", Dependabot's auto-supersede of #62 after the @eslint/js ignore fix merged) bumped vitest from 2.1.9 to 4.1.11. vitest 4 depends on vite 8's bundled rolldown, which needs native bindings that fail to resolve here, plus several transitive deps requiring a newer Node.js than this repo's pinned 22.11.0. Reproduced locally: npm ci warns EBADENGINE, npm run test fails with "Cannot find module '@rolldown/binding-wasm32-wasi'". Co-Authored-By: Claude Sonnet 5 --- .github/dependabot.yml | 7 +++ .../.openspec.yaml | 3 ++ .../proposal.md | 49 +++++++++++++++++++ .../2026-08-25-ignore-vitest-major/tasks.md | 16 ++++++ 4 files changed, 75 insertions(+) create mode 100644 openspec/changes/archive/2026-08-25-ignore-vitest-major/.openspec.yaml create mode 100644 openspec/changes/archive/2026-08-25-ignore-vitest-major/proposal.md create mode 100644 openspec/changes/archive/2026-08-25-ignore-vitest-major/tasks.md diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 176d74c2..90c69edd 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -24,6 +24,13 @@ updates: # updates"). - dependency-name: "@eslint/js" versions: [">=10.0.0"] + # vitest 4's toolchain (vite 8 / rolldown) needs native bindings that + # fail to resolve here ("Cannot find module + # '@rolldown/binding-wasm32-wasi'") and a newer Node.js than this + # repo's pinned 22.11.0 (seen live in PR #65, "Bump the + # npm-development group with 3 updates"). + - dependency-name: "vitest" + versions: [">=3.0.0"] - package-ecosystem: github-actions directory: / schedule: diff --git a/openspec/changes/archive/2026-08-25-ignore-vitest-major/.openspec.yaml b/openspec/changes/archive/2026-08-25-ignore-vitest-major/.openspec.yaml new file mode 100644 index 00000000..9a88f355 --- /dev/null +++ b/openspec/changes/archive/2026-08-25-ignore-vitest-major/.openspec.yaml @@ -0,0 +1,3 @@ +schema: spec-driven +created: 2026-08-25 +skip_specs: true diff --git a/openspec/changes/archive/2026-08-25-ignore-vitest-major/proposal.md b/openspec/changes/archive/2026-08-25-ignore-vitest-major/proposal.md new file mode 100644 index 00000000..c0c77fc2 --- /dev/null +++ b/openspec/changes/archive/2026-08-25-ignore-vitest-major/proposal.md @@ -0,0 +1,49 @@ +## Why + +The user reported on 2026-08-25 that CI failed after merging the +`@eslint/js` Dependabot ignore fix. Investigation found Dependabot had +auto-superseded PR #62 with PR #65 ("Bump the npm-development group with 3 +updates": `vitest`, `@types/vscode`, `happy-dom`) once the ignore rule +merged — confirming that fix worked — but PR #65's own CI run failed. +Reproduced locally by checking out the PR branch into an isolated worktree: +`npm ci` succeeds but logs `EBADENGINE` warnings for `jsdom@30.0.1`, +`rolldown@1.2.5`, `undici@8.9.0`, `vite@8.2.2`, and `whatwg-url@17.1.0`, all +requiring a newer Node.js than this repo's pinned `22.11.0`. Running the +test suite then fails outright: + +``` +Error: Cannot find native binding. npm has a bug related to optional +dependencies (https://github.com/npm/cli/issues/4828) ... +cause: Error: Cannot find module '@rolldown/binding-wasm32-wasi' +``` + +`vitest` jumped from `2.1.9` to `4.1.11` (a two-major bump) in that PR; +`vitest` 4 depends on `vite` 8, which now bundles `rolldown` as its default +bundler and requires native platform bindings that fail to resolve in this +environment. This is the same class of problem as the already-archived +`pin-dependabot-typescript-eslint` and `ignore-eslint-js-major` changes: a +Dependabot-proposed major bump breaks this repo's pinned toolchain. + +## What Changes + +- Add an `ignore` entry for `vitest` (versions `>=3.0.0`) to the `npm` + update block in `.github/dependabot.yml`, alongside the existing + `typescript`, `eslint`, and `@eslint/js` entries. +- No change to the grouping, schedule, or the `github-actions` update block. +- Does not itself resolve PR #65 (Dependabot manages that PR's lifecycle, + same as it auto-superseded PR #62 once the matching ignore rule for + `@eslint/js` merged) — out of scope for a repository file change. + +## Capabilities + +### New Capabilities + +(none) + +### Modified Capabilities + +(none; CI/tooling configuration change, not a specified behavior) + +## Impact + +- `.github/dependabot.yml` diff --git a/openspec/changes/archive/2026-08-25-ignore-vitest-major/tasks.md b/openspec/changes/archive/2026-08-25-ignore-vitest-major/tasks.md new file mode 100644 index 00000000..f6c0fac3 --- /dev/null +++ b/openspec/changes/archive/2026-08-25-ignore-vitest-major/tasks.md @@ -0,0 +1,16 @@ +## 1. Close the gap + +- [x] 1.1 Add an `ignore` entry for `vitest` (versions `>=3.0.0`) to the + `npm` update block in `.github/dependabot.yml`. + +## 2. Verification + +- [x] 2.1 `.github/dependabot.yml` parses as valid YAML (verified with + `node node_modules/js-yaml/bin/js-yaml.js .github/dependabot.yml`). +- [x] 2.2 Reproduced the reported failure locally: checked out PR #65's + branch (`dependabot/npm_and_yarn/npm-development-ad59ef59ec`) into an + isolated worktree; `npm ci` warns about unsupported Node engines for + several `vitest@4` transitive deps, and `npm run test` fails with + "Cannot find module '@rolldown/binding-wasm32-wasi'" — the exact failure + this change prevents going forward. +- [x] 2.3 Run `openspec change validate --strict ignore-vitest-major`.