build(deps-dev): bump the development-minor-and-patch group with 2 updates

[dependabot]

Bumps the development-minor-and-patch group with 2 updates: @types/node and vitest.

Updates @types/node from 26.0.1 to 26.1.0

Commits

• See full diff in compare view

Updates vitest from 4.1.9 to 4.1.10

Release notes

Sourced from vitest's releases.

v4.1.10

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

Commits

• db616d2 chore: release v4.1.10 (#10718)
• bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

Codex review: needs changes before merge. Reviewed July 6, 2026, 12:13 PM ET / 16:13 UTC.

Summary
This PR modifies pnpm-lock.yaml for a grouped dev-dependency update, raising @types/node to 26.1.0 and refreshing peer/transitive lock entries around Vitest/Vite.

Reproducibility: yes. for the PR defect: the PR-head lockfile can be inspected directly and still resolves vitest to 4.1.9 despite the advertised 4.1.10 update.

Review metrics: 1 noteworthy metric.

• Dependency surface: 1 lockfile changed; 0 manifest files changed. The lockfile-only scope makes the unresolved Vitest version easy to verify before merge.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🌊 off-meta tidepool
Patch quality: 🦪 silver shellfish
Result: blocked by patch quality or review findings.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Regenerate or recreate the lockfile so vitest resolves to 4.1.10 and rerun the standard pnpm checks.

Risk before merge

• [P1] Merging as-is would leave Vitest locked at 4.1.9 while the PR metadata says the 4.1.10 test-runner patch update landed.

Maintainer options:

1. Decide the mitigation before merge
   Regenerate or recreate the Dependabot lockfile so Vitest itself resolves to 4.1.10 alongside @types/node 26.1.0, then let the standard pnpm checks validate it.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• [P2] This is a narrow mechanical lockfile repair: make the grouped dependency update actually lock Vitest 4.1.10 and rerun package validation.

Security
Cleared: The diff only changes registry-pinned dev-dependency lockfile entries, and the PR metadata shows dependency review and secret scanning checks passed.

Review findings

• [P2] Update the locked Vitest package too — pnpm-lock.yaml:32

Review details

Best possible solution:

Regenerate or recreate the Dependabot lockfile so Vitest itself resolves to 4.1.10 alongside @types/node 26.1.0, then let the standard pnpm checks validate it.

Do we have a high-confidence way to reproduce the issue?

Yes for the PR defect: the PR-head lockfile can be inspected directly and still resolves vitest to 4.1.9 despite the advertised 4.1.10 update.

Is this the best way to solve the issue?

No; the maintainable fix is to regenerate or recreate the grouped dependency update so the lockfile matches the intended direct dependency versions.

Full review comments:

• [P2] Update the locked Vitest package too — pnpm-lock.yaml:32
  The PR says it bumps vitest to 4.1.10, but the generated lockfile still resolves the importer and package snapshot to 4.1.9. Merging this would only refresh peers/transitives and leave the advertised direct test-runner update unapplied.
  Confidence: 0.94

Overall correctness: patch is incorrect
Overall confidence: 0.94

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 140b0ac6ac19.

Label changes

Label changes:

• add P3: This is a routine dev-dependency maintenance PR with low user-facing urgency.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🌊 off-meta tidepool and patch quality is 🦪 silver shellfish.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This is a Dependabot bot lockfile-only PR, so the external contributor real-behavior proof gate does not apply; package checks are the relevant validation.

Label justifications:

• P3: This is a routine dev-dependency maintenance PR with low user-facing urgency.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🌊 off-meta tidepool and patch quality is 🦪 silver shellfish.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This is a Dependabot bot lockfile-only PR, so the external contributor real-behavior proof gate does not apply; package checks are the relevant validation.

Evidence reviewed

Acceptance criteria:

• [P1] pnpm install --frozen-lockfile.
• [P1] pnpm typecheck.
• [P1] pnpm lint.
• [P1] pnpm test.
• [P1] pnpm build.

What I checked:

• Repository policy read: The full target AGENTS.md was read; its pnpm/Node 22 validation guidance and generated-file cautions informed the review and work recommendation. (AGENTS.md:1, 140b0ac6ac19)
• PR head still locks Vitest 4.1.9: On the PR head, the importer keeps vitest resolved to 4.1.9(...), not 4.1.10. (pnpm-lock.yaml:32, 1933aed6b3a9)
• No Vitest 4.1.10 package entry: Searching the PR-head lockfile finds only vitest@4.1.9 entries and no vitest@4.1.10 lock entry. (pnpm-lock.yaml:702, 1933aed6b3a9)
• PR metadata advertises a Vitest bump: The PR commit metadata says this grouped update includes vitest version 4.1.10, so the lockfile result is incomplete for the stated change. (1933aed6b3a9)
• Recent dependency ownership history: The current Vitest lock line is tied by blame to the recent dev-dependency refresh merged at chore: refresh development dependencies #152. (pnpm-lock.yaml:32, 140b0ac6ac19)

Likely related people:

• steipete: Authored and merged the recent dev-dependency refresh that currently owns the Vitest lockfile line via chore: refresh development dependencies #152. (role: recent area contributor; confidence: high; commits: 140b0ac6ac19, 0cd24d07a262; files: package.json, pnpm-lock.yaml)
• dependabot[bot]: Previously updated the same dev-dependency area by bumping @types/node to the current main lock version before this grouped update. (role: dependency automation history; confidence: medium; commits: bfe68d807be8; files: package.json, pnpm-lock.yaml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.