chore(deps): consolidate October toolchain updates

.github/dependabot.yml

@@ -35,6 +35,7 @@ updates:
       vitest:
         patterns:
           - "vitest"
+          - "@vitest/coverage-v8"
           - "@vitest/*"
       react:
         # Runtime + its types must move together, including on majors (18 -> 19).

.github/workflows/ci.yml

@@ -32,6 +32,20 @@ jobs:
           node-version: 24
           cache: pnpm
 
+      - name: Verify Vitest runner and coverage pins match
+        run: |
+          node --input-type=module <<'NODE'
+          import assert from 'node:assert/strict';
+          import { readFileSync, readdirSync } from 'node:fs';
+          const coverage = JSON.parse(readFileSync('package.json', 'utf8')).devDependencies['@vitest/coverage-v8'];
+          assert.ok(coverage, 'Missing @vitest/coverage-v8 pin');
+          for (const name of readdirSync('packages')) {
+            const pkg = JSON.parse(readFileSync(`packages/${name}/package.json`, 'utf8'));
+            const runner = pkg.devDependencies?.vitest;
+            if (runner) assert.equal(runner, coverage, `${pkg.name}: Vitest runner/provider pins must match`);
+          }
+          NODE
+
       # No committed .npmrc, so the default public npm registry applies; the
       # committed pnpm-lock.yaml is registry-portable (integrity-only, no absolute
       # tarball URLs — kept so by the `pnpm-lock-portable` pre-commit hook), so

docs/06-field-notes.md

@@ -315,6 +315,12 @@ Base: `~/.vscode-server/data/User/`
   Vitest 5 drops Node 20, and jsdom 30.1.1 requires `^22.22.2 || ^24.15.0 || >=26.0.0`;
   the root development engine range follows that requirement. CI/dev containers remain on Node 24;
   the bundled gateway's separately staged `Node >=20` runtime manifest is unchanged.
+- **Vitest grouping is not a compatibility gate (2026-10-14).** Despite the first-match
+  `vitest`/`@vitest/*` group, #106 updated runners to 5.0.3 while #107 put coverage 5.0.3 in the
+  development group. Both PRs had green CI independently. The grouping now explicitly names
+  `@vitest/coverage-v8`, and the Node CI job asserts every declared workspace Vitest runner pin
+  equals the root coverage-provider pin before installing dependencies. Consolidate split updates;
+  do not rely on group placement or a successful coverage run to establish version alignment.
 - **Extension packaging must be a PR gate, not a release-only surprise (2026-10-05).**
   The vsce 4 major requires Node >=22 and changes packaging dependencies and credential storage.
   A successful build/typecheck/test does not exercise `vsce package`. CI now runs the same

package.json

@@ -26,13 +26,13 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@vitest/coverage-v8": "5.0.2",
-    "eslint": "^10.11.0",
+    "@vitest/coverage-v8": "5.0.3",
+    "eslint": "^10.12.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-react-hooks": "^7.1.1",
-    "globals": "^17.12.0",
+    "globals": "^17.13.0",
     "prettier": "^3.9.9",
     "typescript": "^5.9.3",
-    "typescript-eslint": "^8.70.1"
+    "typescript-eslint": "^8.71.1"
   }
 }

packages/extension/package.json

@@ -242,13 +242,13 @@
     "zod": "^4.6.5"
   },
   "devDependencies": {
-    "@types/node": "^26.6.3",
-    "@types/vscode": "^1.138.0",
-    "@types/ws": "^8.18.1",
+    "@types/node": "^26.6.4",
+    "@types/vscode": "^1.140.0",
+    "@types/ws": "^8.18.2",
     "@vscode/vsce": "^4.0.0",
     "esbuild": "0.28.2",
     "tsx": "^4.23.15",
     "typescript": "^5.9.3",
-    "vitest": "5.0.2"
+    "vitest": "5.0.3"
   }
 }

packages/gateway/package.json

@@ -34,10 +34,10 @@
     "ws": "^8.22.0"
   },
   "devDependencies": {
-    "@types/node": "^26.6.3",
-    "@types/ws": "^8.18.1",
+    "@types/node": "^26.6.4",
+    "@types/ws": "^8.18.2",
     "esbuild": "0.28.2",
     "typescript": "^5.9.3",
-    "vitest": "5.0.2"
+    "vitest": "5.0.3"
   }
 }

packages/protocol/package.json

@@ -18,6 +18,6 @@
   },
   "devDependencies": {
     "typescript": "^5.9.3",
-    "vitest": "5.0.2"
+    "vitest": "5.0.3"
   }
 }

packages/web-playground/package.json

@@ -19,8 +19,8 @@
   "devDependencies": {
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
-    "@vitejs/plugin-react": "^6.1.1",
+    "@vitejs/plugin-react": "^6.1.2",
     "typescript": "^5.9.3",
-    "vite": "8.3.1"
+    "vite": "8.3.2"
   }
 }

packages/web/package.json

@@ -29,10 +29,10 @@
     "@testing-library/react": "^16.3.3",
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
-    "@vitejs/plugin-react": "^6.1.1",
-    "jsdom": "30.1.1",
+    "@vitejs/plugin-react": "^6.1.2",
+    "jsdom": "30.1.2",
     "typescript": "^5.9.3",
-    "vite": "8.3.1",
-    "vitest": "5.0.2"
+    "vite": "8.3.2",
+    "vitest": "5.0.3"
   }
 }