chore(deps-dev): Bump vitest from 4.1.11 to 5.0.2 in /agent-governance-python/agent-os/extensions/mcp-server in the vitest group across 1 directory by dependabot[bot] · Pull Request #4117 · microsoft/agent-governance-toolkit

dependabot · 2026-09-23T22:42:50Z

Bumps the vitest group with 1 update in the /agent-governance-python/agent-os/extensions/mcp-server directory: vitest.

Updates vitest from 4.1.11 to 5.0.2

Release notes

v5.0.2

   🐞 Bug Fixes

Bind process in case global is overwritten - by @AriPerkkio in vitest-dev/vitest#11343 (0b792)

detect-async-leaks:

Ignore process.stdio handles - by @AriPerkkio in vitest-dev/vitest#11333 (0fd6b)

expect:

Fix toMatchObject with asymmetric matchers - by @ShreeBohara, Claude Opus 5, @hi-ogawa, Hiroshi Ogawa and Codex (GPT-5) in vitest-dev/vitest#11100 (42523)

jsdom:

Fix Request with Blob body on jsdom 28+ - by @harshit-d3v in vitest-dev/vitest#11295 (d1c3e)

reporter:

agent to respect --silent - by @Raj4478 and @AriPerkkio in vitest-dev/vitest#11271 (5b95e)

reporters:

Handle concurrent createReport calls - by @7rulnik in vitest-dev/vitest#11278 (e8e55)

hanging-process to use ESM entrypoint - by @AriPerkkio in vitest-dev/vitest#11316 (4e91e)

spy:

Fix stack overflow when spying Set.prototype.add - by @fengmk2 in vitest-dev/vitest#11299 (a0a93)

ui:

Persist authentication cookie beyond current browser session - by @hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#11066 (f8819)

    View changes on GitHub

v5.0.1

   🚀 Features

ui:

Move trace attempts selector to viewer header - by @hi-ogawa, Hiroshi Ogawa and Codex in vitest-dev/vitest#11189 (5dc4b)

Add focused trace view layout mode - by @hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in vitest-dev/vitest#11190 (376dc)

   🐞 Bug Fixes

Exit 1 when vitest list fails collection - by @hamed-bavar in vitest-dev/vitest#11145 and vitest-dev/vitest#11146 (6108b)

Keep parse error details in static collection - by @hamed-bavar in vitest-dev/vitest#11150 and vitest-dev/vitest#11151 (7c818)

Avoid recursive prototype in automocking - by @sheremet-va in vitest-dev/vitest#11195 (99fc5)

Prevent false Vitest import resolution - by @sheremet-va in vitest-dev/vitest#11196 (b426c)

Keep metadata file when clearing the cache - by @sheremet-va in vitest-dev/vitest#11199 (73614)

Correct typos in error message and comments - by @shinji00222 and Shinji in vitest-dev/vitest#11187 (115c3)

Resolve ResolvedConfig exactOptionalPropertyTypes errors - by @LukeAbby in vitest-dev/vitest#11175 (498fb)

Share the server on self-referencing extends - by @sheremet-va in vitest-dev/vitest#11034 (23dda)

Warn when deprecated deps.optimizer.web is used - by @im10furry in vitest-dev/vitest#11214 (2ce29)

browser:

Avoid double quotes in config.define - by @sheremet-va in vitest-dev/vitest#11198 (972e2)

doctor:

Measure vm pools for custom environments - by @sheremet-va in vitest-dev/vitest#11212 (91ab1)

expect:

Correct return value in toMatchAriaSnapshot - by @sheremet-va in vitest-dev/vitest#11208 (c119b)

fakeTimers:

Force queueMicrotask and nextTick in toNotFake - by @kingmakeruix, kingmakeruix, Hiroshi Ogawa, Codex and @hi-ogawa in vitest-dev/vitest#11261 (a47d7)

snapshot:

Report obsolete keys next to skipped tests - by @hamed-bavar, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#11157 and vitest-dev/vitest#11158 (17e2b)

... (truncated)

Commits

428e2e5 chore: release v5.0.2 (#11357)
0b79231 fix: bind process in case global is overwritten (#11343)
597df56 docs: correct stale config defaults (#11354)
ea1c44f docs: sequence.setupFiles default is 'list' (#11351)
0fd6b97 fix(detect-async-leaks): ignore process.stdio handles (#11333)
4e91e56 fix(reporters): hanging-process to use ESM entrypoint (#11316)
1a57929 docs(browser): fix locators.exact default (#11338)
5b95efb fix(reporter): agent to respect --silent (#11271)
f58a209 docs: correct benchmark.exclude and watch defaults (#11268)
d1c3ecc fix(jsdom): fix Request with Blob body on jsdom 28+ (#11295)
Additional commits viewable in compare view

azure-pipelines · 2026-09-23T22:43:00Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

github-actions · 2026-09-23T22:43:07Z

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

github-actions · 2026-09-23T22:43:11Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/@jridgewell/sourcemap-codec

1.6.0

Unknown

npm/@vitest/mocker

5.0.2

Unknown

npm/@vitest/spy

5.0.2

Unknown

npm/es-module-lexer

2.3.2

🟢 4.3

Details

Check	Score	Reason
Code-Review	⚠️ 1	Found 5/30 approved changesets -- score normalized to 1
Maintained	🟢 10	30 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy	⚠️ 0	security policy file not detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/expect-type

1.4.0

🟢 4.4

Details

Check	Score	Reason
Maintained	⚠️ 0	1 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	🟢 10	security policy file detected
Pinned-Dependencies	⚠️ 1	dependency not pinned by hash detected -- score normalized to 1
Code-Review	🟢 3	Found 10/27 approved changesets -- score normalized to 3
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 9	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 6	branch protection is not maximal on development and all release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/magic-string

1.4.2

🟢 5.2

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 5	Found 17/30 approved changesets -- score normalized to 5
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed

npm/obug

2.2.1

Unknown

npm/picomatch

4.0.7

🟢 6.8

Details

Check	Score	Reason
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	🟢 5	Found 7/13 approved changesets -- score normalized to 5
Maintained	🟢 10	30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	🟢 5	SAST tool is not run on all commits -- score normalized to 5

npm/std-env

4.3.0

Unknown

npm/tinybench

6.2.0

Unknown

npm/tinyexec

1.3.1

Unknown

npm/vitest

5.0.2

Unknown

npm/why-is-node-running

3.2.2

🟢 3.8

Details

Check	Score	Reason
Code-Review	⚠️ 1	Found 4/30 approved changesets -- score normalized to 1
Binary-Artifacts	🟢 10	no binaries found in the repo
Maintained	⚠️ 0	0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Security-Policy	⚠️ 0	security policy file not detected
Packaging	⚠️ -1	packaging workflow not detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

Scanned Files

agent-governance-python/agent-os/extensions/mcp-server/package-lock.json

github-actions · 2026-09-23T22:43:41Z

📦 Dependency diff (SBOM)

Comparing main → dependabot/npm_and_yarn/agent-governance-python/agent-os/extensions/mcp-server/vitest-35be175f02.

Summary: ➕ 0 added · ➖ 0 removed · 🔄 1 bumped

🔄 Bumped

`cargo` (1)

Package	From	To
rustls	0.23.45	0.23.42

Bumps the vitest group with 1 update in the /agent-governance-python/agent-os/extensions/mcp-server directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Updates `vitest` from 4.1.11 to 5.0.2 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.2/packages/vitest) --- updated-dependencies: - dependency-name: vitest dependency-version: 5.0.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: vitest ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 23, 2026

dependabot Bot requested review from MohammadHaroonAbuomar, liamcrumm and Prayag (prayagupa) as code owners September 23, 2026 22:42

dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 23, 2026

github-actions Bot removed the dependencies Pull requests that update a dependency file label Sep 23, 2026

github-actions Bot added the size/XL Extra large PR (500+ lines) label Sep 23, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/agent-governance-python/agent-os/extensions/mcp-server/vitest-35be175f02 branch 3 times, most recently from 0edf2f9 to f72274a Compare September 29, 2026 14:53

dependabot Bot force-pushed the dependabot/npm_and_yarn/agent-governance-python/agent-os/extensions/mcp-server/vitest-35be175f02 branch 2 times, most recently from 219d48a to 2b6db25 Compare October 6, 2026 14:26

dependabot Bot force-pushed the dependabot/npm_and_yarn/agent-governance-python/agent-os/extensions/mcp-server/vitest-35be175f02 branch from 2b6db25 to 4e54a97 Compare October 6, 2026 14:47

Navigation Menu

Repository navigation

chore(deps-dev): Bump vitest from 4.1.11 to 5.0.2 in /agent-governance-python/agent-os/extensions/mcp-server in the vitest group across 1 directory - #4117

dependabot Bot commented on behalf of github Sep 23, 2026 •

edited

Loading

Uh oh!

azure-pipelines Bot commented Sep 23, 2026

Uh oh!

github-actions Bot commented Sep 23, 2026

Uh oh!

github-actions Bot commented Sep 23, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 23, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v5.0.2

🐞 Bug Fixes

View changes on GitHub

v5.0.1

🚀 Features

🐞 Bug Fixes

Uh oh!

azure-pipelines Bot commented Sep 23, 2026

Uh oh!

github-actions Bot commented Sep 23, 2026

PR Review Summary

Uh oh!

github-actions Bot commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

github-actions Bot commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📦 Dependency diff (SBOM)

🔄 Bumped

cargo (1)

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 23, 2026 •

edited

Loading

github-actions Bot commented Sep 23, 2026 •

edited

Loading

github-actions Bot commented Sep 23, 2026 •

edited

Loading

`cargo` (1)