chore(deps): bump @vitest/mocker and vitest in /samples/streaming-chat by dependabot[bot] · Pull Request #2270 · github/squad

dependabot · 2026-10-21T20:27:34Z

Bumps @vitest/mocker to 4.1.12 and updates ancestor dependency vitest. These dependencies need to be updated together.

Updates @vitest/mocker from 4.1.9 to 4.1.12

Release notes

Sourced from @vitest/mocker's releases.

v4.1.12

   🐞 Bug Fixes

mocker: Harden manual and redirect mocks [backport to v4] - by @sheremet-va in vitest-dev/vitest#11580 (b8253)

    View changes on GitHub

v4.1.11

   🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

v4.1.10

   🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)

vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

Commits

4766ce1 chore: release v4.1.12 (#11610)
b825313 fix(mocker): harden manual and redirect mocks [backport to v4] (#11580)
9bd8d46 chore: release v4.1.11 (#10995)
fe5a11d fix(mocker): restrict redirect mocks to the fs allowlist [backport to v4] (#1...
db616d2 chore: release v4.1.10 (#10718)
See full diff in compare view

Updates vitest from 4.1.9 to 4.1.12

Release notes

Sourced from vitest's releases.

v4.1.12

   🐞 Bug Fixes

mocker: Harden manual and redirect mocks [backport to v4] - by @sheremet-va in vitest-dev/vitest#11580 (b8253)

    View changes on GitHub

v4.1.11

   🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

v4.1.10

   🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)

vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

Commits

4766ce1 chore: release v4.1.12 (#11610)
5bf2197 chore: delete wdio folder from v4 branch to avoid falsy release (#11581)
9bd8d46 chore: release v4.1.11 (#10995)
9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
db616d2 chore: release v4.1.10 (#10718)
bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) to 4.1.12 and updates ancestor dependency [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). These dependencies need to be updated together. Updates `@vitest/mocker` from 4.1.9 to 4.1.12 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.12/packages/mocker) Updates `vitest` from 4.1.9 to 4.1.12 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.12/packages/vitest) --- updated-dependencies: - dependency-name: "@vitest/mocker" dependency-version: 4.1.12 dependency-type: indirect - dependency-name: vitest dependency-version: 4.1.12 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-10-29T14:06:25Z

👋 Friendly nudge — this PR has had no activity for 7 days.

What needs attention:

👀 No approving reviews yet. Request a review from a teammate.
⬇️ 44 commits behind dev. Rebase to pick up latest changes.

If this PR is abandoned, please close it. If it's blocked on something external, leave a comment so the team knows.
This is an automated check that runs on weekdays. It won't nudge the same PR more than once per week.

github-actions · 2026-11-06T14:05:45Z

👋 Friendly nudge — this PR has had no activity for 7 days.

What needs attention:

👀 No approving reviews yet. Request a review from a teammate.
⬇️ 59 commits behind dev. Rebase to pick up latest changes.

If this PR is abandoned, please close it. If it's blocked on something external, leave a comment so the team knows.
This is an automated check that runs on weekdays. It won't nudge the same PR more than once per week.

…t/multi-456d42d8d4

github-actions · 2026-11-09T17:13:02Z

🟡 Impact Analysis — PR #2270

Risk tier: 🟡 MEDIUM

📊 Summary

Metric	Count
Files changed	2
Files added	0
Files modified	2
Files deleted	0
Modules touched	1
Critical files	1

🎯 Risk Factors

2 files changed (≤5 → LOW)
1 module(s) touched (≤1 → LOW)
Critical files touched: samples/streaming-chat/package.json

📦 Modules Affected

root (2 files)

samples/streaming-chat/package-lock.json
samples/streaming-chat/package.json

⚠️ Critical Files

samples/streaming-chat/package.json

This report is generated automatically for every PR. See #733 for details.

github-actions · 2026-11-09T17:13:10Z

🔒 Security Review

Authoritative evidence: scanners from the PR base commit, posted by the default-branch workflow_run reporter.
Results for head commit dd1a91295523a23df47feee6150d430ec95e775b.

🔒 Security review: 1 info.

Severity	Category	Finding	Location
ℹ️ info	new-dependency	1 new/changed dependency version(s) in samples/streaming-chat/package.json. Verify these packages are trusted and necessary.	`samples/streaming-chat/package.json:19`

Automated security review — informational only.

github-actions · 2026-11-09T17:13:16Z

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit dd1a912

PR Scope: 🔧 Infrastructure

⚠️ 3 item(s) to address before review

Status	Check	Details
❌	Single commit	4 commits — consider squashing before review
✅	Not in draft	Ready for review
✅	Branch up to date	Up to date with dev
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	No source files changed — changeset not required
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
❌	Copilot threads resolved	1 unresolved Copilot thread(s) — fix and resolve before merging
✅	CI passing	All checks passing

Files Changed (2 files, +216 −290)

File	+/−
`samples/streaming-chat/package-lock.json`	+215 −289
`samples/streaming-chat/package.json`	+1 −1

Total: +216 −290

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

Copilot

🟡 Changes recommended

The lockfile contains stale metadata for the local SDK dependency that conflicts with the committed SDK manifest and undermines reproducible installs.

1 open issue

Refresh lockfile metadata for the local SDK dependency · New

1 file not reviewed

samples/streaming-chat/package-lock.json: Generated file

What changed in this PR

Updates the streaming-chat sample’s Vitest tooling from 4.1.9 to 4.1.12, including related transitive dependencies.

Changes:

Bumps the sample’s vitest development dependency.
Updates @vitest/*, Vite, Rolldown, and related packages.
Refreshes the sample lockfile, but its local SDK metadata must be regenerated to match the current SDK manifest.

File	Summary
`samples/streaming-chat/package.json`	Bumps the declared Vitest version to `^4.1.12`.
`samples/streaming-chat/package-lock.json`	Updates Vitest and its dependency tree. The local `file:../../packages/squad-sdk` entry is stale and should be regenerated against the current SDK manifest.

_{Review effort: Lite (auto)}

+      "version": "1.2.0-preview.1",
      "license": "MIT",
      "dependencies": {
-        "@github/copilot-sdk": "^1.0.8",
-        "vscode-jsonrpc": "^9.0.1"
+        "@github/copilot-sdk": "^1.0.19",
+        "vscode-jsonrpc": "^9.0.3"


…t/multi-456d42d8d4

bradygaster · 2026-11-09T19:59:57Z

Final dependency triage: refreshed head dd1a912 passes all current-head hosted checks, but the unresolved local-SDK lock review is still factual. samples/streaming-chat/package-lock.json records ../../packages/squad-sdk version 1.2.0-preview.1 and @github/copilot-sdk ^1.0.19; this head actually contains SDK 2.0.0-preview.4 and the deliberate >=1.0.19 <1.0.29-0 constraint. I did not merge or dismiss the review. A lock synchronization repair needs clean install/build validation; even unchanged dev is externally blocked locally by configured-feed 404 for locked hono@4.13.17 and unavailable direct official npm connectivity. No unvalidated repair or constraint weakening was pushed.

dependabot Bot requested review from bradygaster and tamirdresher as code owners October 21, 2026 20:27

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 21, 2026

Merge branch 'dev' into dependabot/npm_and_yarn/samples/streaming-cha…

9173fe9

…t/multi-456d42d8d4

Copilot AI auto review requested due to automatic review settings November 9, 2026 17:12

Copilot started reviewing November 9, 2026 17:13

View session

Copilot AI reviewed Nov 9, 2026

View reviewed changes

Comment thread samples/streaming-chat/package-lock.json

Comment on lines +25 to +29

"version": "1.2.0-preview.1",

"license": "MIT",

"dependencies": {

"@github/copilot-sdk": "^1.0.8",

"vscode-jsonrpc": "^9.0.1"

"@github/copilot-sdk": "^1.0.19",

"vscode-jsonrpc": "^9.0.3"

bradygaster added 2 commits November 9, 2026 09:23

Merge branch 'dev' into dependabot/npm_and_yarn/samples/streaming-cha…

9717208

…t/multi-456d42d8d4

Merge branch 'dev' into dependabot/npm_and_yarn/samples/streaming-cha…

dd1a912

…t/multi-456d42d8d4

Navigation Menu

Repository navigation

chore(deps): bump @vitest/mocker and vitest in /samples/streaming-chat - #2270

chore(deps): bump @vitest/mocker and vitest in /samples/streaming-chat#2270
dependabot[bot] wants to merge 4 commits into
devfrom
dependabot/npm_and_yarn/samples/streaming-chat/multi-456d42d8d4

dependabot Bot commented on behalf of github Oct 21, 2026

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

github-actions Bot commented Nov 6, 2026

Uh oh!

github-actions Bot commented Nov 9, 2026

Uh oh!

github-actions Bot commented Nov 9, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 9, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

bradygaster commented Nov 9, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github Oct 21, 2026

v4.1.12

🐞 Bug Fixes

View changes on GitHub

v4.1.11

🐞 Bug Fixes

View changes on GitHub

v4.1.10

🐞 Bug Fixes

View changes on GitHub

v4.1.12

🐞 Bug Fixes

View changes on GitHub

v4.1.11

🐞 Bug Fixes

View changes on GitHub

v4.1.10

🐞 Bug Fixes

View changes on GitHub

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

github-actions Bot commented Nov 6, 2026

Uh oh!

github-actions Bot commented Nov 9, 2026

🟡 Impact Analysis — PR #2270

📊 Summary

🎯 Risk Factors

📦 Modules Affected

⚠️ Critical Files

Uh oh!

github-actions Bot commented Nov 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔒 Security Review

Uh oh!

github-actions Bot commented Nov 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🛫 PR Readiness Check

⚠️ 3 item(s) to address before review

Files Changed (2 files, +216 −290)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

bradygaster commented Nov 9, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Nov 9, 2026 •

edited

Loading

github-actions Bot commented Nov 9, 2026 •

edited

Loading