chore(deps): upgrade Vitest and refresh pending release notes by steipete · Pull Request #198 · openclaw/clawpatch · GitHub
Skip to content

chore(deps): upgrade Vitest and refresh pending release notes - #198

Merged
steipete merged 1 commit into
mainfrom
triage/20260905-dependencies
Sep 5, 2026
Merged

chore(deps): upgrade Vitest and refresh pending release notes#198
steipete merged 1 commit into
mainfrom
triage/20260905-dependencies

Conversation

@steipete

@steipete steipete commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What Problem This Solves

The development test suite still uses Vitest 4 after Vitest 5 cleared the repository's two-day minimum release age. The pending 0.7.3 notes also repeat dependency updates and omit the Rust source-group mapping delivered in #186.

Why This Change Was Made

Upgrade Vitest to 5.0.0 and regenerate the pnpm lockfile. Consolidate all user-visible changes since v0.7.2 under Unreleased, including credit for @joshuaboys's Rust module mapping. Runtime dependencies, the CLI's Node.js minimum, and the existing Vite override remain unchanged.

User Impact

Development maintenance and complete release notes; there is no new CLI behavior in this PR. Vitest's runner and assertion dependencies are now bundled upstream, reducing the installed dependency graph. No version bump, tag, or publication is included.

Evidence

  • Node 24.20.0, pnpm 11.25.0: typecheck, lint, format check, and build passed.
  • Real built CLI: a synthetic Node/Rust workspace mapped four features with zero cross-language context links; 15 Rust modules mapped to two source groups, capped at 12 files each.
  • Package dry run: 244 files, including dist/cli.js, with no local state, fixtures, or test files.
  • CI on the exact head passed the full Linux suite, build, packaged CLI smoke, and Windows command-execution tests. CodeQL, dependency review, and secret scanning also passed.
  • Local packaged-install smoke passed: 13 mapped features, including three CUDA features. A focused local Vitest 5 run (pnpm test src/exec.test.ts) completed with 19 passed and two skipped tests. Local full-suite attempts were interrupted during filesystem stalls; the full-suite pass is from CI.
  • Independent local and branch-mode reviews of the combined dependency and changelog diff found no actionable P0–P2 findings.

Issue #169 remains a separate product decision; this PR does not implement or close it.

Completed runner output on this head (Linux job log):

RUN v5.0.0
Test Files  31 passed (31)
Tests       924 passed | 2 skipped (926)
Duration    40.42s
packaged CLI smoke mapped 13 features (3 CUDA)

Focused local runner output, Node 24.20.0 / pnpm 11.25.0:

$ pnpm test src/exec.test.ts
RUN v5.0.0
Test Files  1 passed (1)
Tests       19 passed | 2 skipped (21)
Duration    9.68s

@steipete
steipete requested a review from a team as a code owner September 5, 2026 18:25
@clawsweeper

clawsweeper Bot commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

@clawsweeper clawsweeper Bot added P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Sep 5, 2026
@steipete

steipete commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Ready to land at 33af4f766e242db981d31fde9c41fd68d727d519.

CI passed the full Linux pnpm test suite, typecheck, lint, formatting, build, packaged CLI smoke, and Windows execution tests. CodeQL, dependency review, and secret scanning also passed on this head.

Local proof used Node 24.20.0 and pnpm 11.25.0:

pnpm typecheck
pnpm lint
pnpm format:check
pnpm build
pnpm pack:smoke
npm pack --dry-run --json --ignore-scripts

The packaged-install smoke executed the installed CLI and mapped 13 features, including three CUDA features. A separate built-CLI run on synthetic Node/Rust input mapped four features with zero cross-language context links; adding 15 Rust module files produced two source groups capped at 12 files. The package dry run included 244 files and dist/cli.js, with no local state, fixtures, or tests.

Local full-suite attempts were interrupted during host filesystem stalls; the full-suite success above is from CI. Independent local and branch-mode autoreviews against origin/main completed with no actionable P0–P2 findings. Released changelog sections are unchanged byte for byte, and the pending notes now include the Rust source-group contribution from @joshuaboys.

Issue #169 remains pending the documented mapping-scope decision. Recommended release: patch 0.7.3 after landing and final release checks.

Completed Vitest runner evidence, added after the initial automated review captured CI in progress:

Linux CI, Node 26, pnpm test:
RUN v5.0.0
Test Files  31 passed (31)
Tests       924 passed | 2 skipped (926)
Duration    40.42s

Local Node 24.20.0, pnpm test src/exec.test.ts:
RUN v5.0.0
Test Files  1 passed (1)
Tests       19 passed | 2 skipped (21)
Duration    9.68s

The full Linux job log is linked from CI above. Both the development runner and the installed CLI have now completed their real workflows on this revision.

@clawsweeper

clawsweeper Bot commented Sep 5, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge. Reviewed September 5, 2026, 2:28 PM ET / 18:28 UTC.

ClawSweeper review

What this changes

Upgrades the development test runner to Vitest 5, refreshes its lockfile, and consolidates unreleased notes including previously merged Rust mapping improvements.

Merge readiness

⛔ Blocked before merge - 2 items remain

The upgrade remains distinct from main and the patch has no identified correctness defect. The supplied CLI smoke is useful, but it does not demonstrate the upgraded test runner completing in the contributor’s setup.

Priority: P3
Reviewed head: 33af4f766e242db981d31fde9c41fd68d727d519

Review scores

Measure Result What it means
Overall readiness 🦐 gold shrimp (3/6) The patch is focused and has no identified defect, but proof does not yet cover completion of the changed runner workflow.
Proof confidence 🦐 gold shrimp (3/6) Needs stronger real behavior proof before merge: The reported built-CLI mapping smoke provides useful runtime assurance, but package.json changes the Vitest runner and the captured evidence does not show that upgraded development command completing in the contributor’s setup; partial CI success is supplemental. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality 🐚 platinum hermit (4/6) No actionable review findings were identified.

Verification

Check Result Evidence
Real behavior Needs proof Needs stronger real behavior proof before merge: The reported built-CLI mapping smoke provides useful runtime assurance, but package.json changes the Vitest runner and the captured evidence does not show that upgraded development command completing in the contributor’s setup; partial CI success is supplemental. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed 8 items Complete policy inspection: Read the full root AGENTS.md and applied its pnpm, validation, focused-change, and changelog guidance. No applicable nested policy or maintainer-notes directory was found.
Verified introduced scope: The complete pinned base-to-head diff changes only CHANGELOG.md, package.json, and pnpm-lock.yaml: 55 additions and 112 deletions. Runtime dependencies, scripts, permissions, and publishing configuration are unchanged.
Main still defers the major upgrade: Main’s package manifest retains Vitest 4.1.11. Its raw commit message explicitly defers Vitest 5 while preserving the 48-hour package-age policy. No provided merged PR supersedes this upgrade; the latest supplied release is v0.7.2.
Findings None None.
Security None None.

How this fits together

Vitest runs clawpatch’s TypeScript tests during development and CI. It is a development dependency and is excluded from the installed CLI’s runtime dependencies.

flowchart LR
  A[Package manifest and lockfile] --> B[Development installation]
  B --> C[Vitest 5 runner]
  D[TypeScript tests and configuration] --> C
  C --> E[Test results]
  E --> F[CI validation]
Loading

Before merge

  • Add real behavior proof - Needs stronger real behavior proof before merge: The reported built-CLI mapping smoke provides useful runtime assurance, but package.json changes the Vitest runner and the captured evidence does not show that upgraded development command completing in the contributor’s setup; partial CI success is supplemental. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
  • Complete next step (P2) - Provide terminal output or a terminal screenshot showing the upgraded test workflow completing on this head, with private paths and credentials redacted. Updating the PR body should trigger review; otherwise ask a maintainer to comment @clawsweeper re-review.
Agent review details

Security

None.

Review metrics

Metric Value Why it matters
Change scope 3 metadata files; 0 production or test source files changed The upgrade is confined to development dependencies and pending release notes.

Technical review

Best possible solution:

Keep this as a focused development-tool upgrade with accurate unreleased notes and demonstrated compatibility with the existing test workflow.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is dependency maintenance, and source inspection did not identify a concrete introduced bug.

Is this the best way to solve the issue?

Yes: updating the existing dependency and lockfile is the narrowest approach, and the changelog consolidation matches the supplied merged-work history.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 089150abad84.

Labels

Label changes:

  • add P3: This is routine development-tool maintenance and release-note cleanup without an identified user-facing regression.
  • add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
  • add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The reported built-CLI mapping smoke provides useful runtime assurance, but package.json changes the Vitest runner and the captured evidence does not show that upgraded development command completing in the contributor’s setup; partial CI success is supplemental. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

  • P3: This is routine development-tool maintenance and release-note cleanup without an identified user-facing regression.
  • rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The reported built-CLI mapping smoke provides useful runtime assurance, but package.json changes the Vitest runner and the captured evidence does not show that upgraded development command completing in the contributor’s setup; partial CI success is supplemental. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

  • Complete policy inspection: Read the full root AGENTS.md and applied its pnpm, validation, focused-change, and changelog guidance. No applicable nested policy or maintainer-notes directory was found. (AGENTS.md:1, 33af4f766e24)
  • Verified introduced scope: The complete pinned base-to-head diff changes only CHANGELOG.md, package.json, and pnpm-lock.yaml: 55 additions and 112 deletions. Runtime dependencies, scripts, permissions, and publishing configuration are unchanged. (package.json:47, 33af4f766e24)
  • Main still defers the major upgrade: Main’s package manifest retains Vitest 4.1.11. Its raw commit message explicitly defers Vitest 5 while preserving the 48-hour package-age policy. No provided merged PR supersedes this upgrade; the latest supplied release is v0.7.2. (package.json:47, 089150abad84)
  • Development compatibility boundary: Vitest 5 requires Node 22.12+ within supported release lines; the unchanged Vite dependency already requires Node 22.12+ on Node 22. CI uses Node 26. The package smoke installs runtime dependencies with --omit=dev, so this diff does not establish a new CLI runtime minimum. (pnpm-lock.yaml:810, 33af4f766e24)
  • Upstream migration contract: The official Vitest 5 migration guide identifies changed mock defaults, top-level hoisting requirements, and removed APIs. The target directly invokes Vitest through its test script and imports vitest/config; inspected configuration and mock usage did not establish a concrete migration defect.
  • Captured proof and check coverage: The fully supplied PR body reports Node 24.20.0/pnpm 11.25.0 checks, a built-CLI Node/Rust mapping smoke, and package contents inspection. It explicitly says local full-suite attempts were interrupted. The captured checks show Windows exec tests passed while the main test job remained in progress. The CLI observations exercise unchanged mapper behavior rather than completion of the upgraded development runner. (33af4f766e24)

Likely related people:

  • Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

  • Add a redacted terminal transcript showing Vitest 5 completing the existing test workflow in a real development checkout, including Node/pnpm versions and the reviewed commit.

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper

clawsweeper Bot commented Sep 5, 2026

Copy link
Copy Markdown
Contributor

@steipete
steipete merged commit 536acaf into main Sep 5, 2026
14 of 15 checks passed
@steipete
steipete deleted the triage/20260905-dependencies branch September 5, 2026 18:40
@clawsweeper clawsweeper Bot mentioned this pull request Sep 5, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@steipete