deps: bump the patch group with 3 updates

[dependabot]

Bumps the patch group with 3 updates: @cldmv/fix-headers, @cldmv/vitest-runner and @vitest/coverage-v8.

Updates @cldmv/fix-headers from 2.2.0 to 2.2.1

Release notes

Sourced from @​cldmv/fix-headers's releases.

v2.2.1

@cldmv/fix-headers v2.2.1 Changelog

Release Date: October 2026 Release Type: Patch Branch: release/2.2.1

---

Overview

Version 2.2.1 moves the repository's own development setup to @cldmv/configs 1.2.4. Nothing the package ships changed: dist/, bin/, the generated types and the runtime dependency ignore are exactly as in v2.2.0. The published package differs only in the version field and in the @cldmv/configs range recorded in its devDependencies.

The shared config is what the repository's own npm run fix:headers extends, so the bump changes how fix-headers stamps its own source files. Version 1.2.4 turns off forceAuthorUpdate and forceLastModifiedAuthorUpdate, which were both on in 1.2.0. With v2.2.0 of the tool, that means @Author is never rewritten, and @Last modified by changes only when a file's content was edited. The run that accompanied the bump scanned 109 files and changed none.

---

🔧 Dependencies

• @cldmv/configs ^1.2.0 → ^1.2.4 (#131), dev dependency. The lockfile moves from 1.2.0 to 1.2.4, and that is the only dependency entry that changed. Between those versions the shared fix-headers.json switched forceAuthorUpdate (1.2.3) and forceLastModifiedAuthorUpdate (1.2.4) from true to false. It is used by npm run fix:headers and by nothing that ships.

📚 Documentation

• NEW: docs/changelog/v2/v2.2.1.md: this changelog.
• README What's New promoted to v2.2.1.

---

Upgrade notes

• No breaking changes, and no behaviour change for consumers: drop-in for v2.2.0. The runtime dependency list is unchanged.
• Projects that extend @cldmv/configs' fix-headers.json should use @cldmv/configs 1.2.4 or later together with @cldmv/fix-headers 2.2.0 or later. On older versions of the tool, the forced author settings that 1.2.4 turns off behave differently.

---

Metric	Coverage
Statements	100.0%
Branches	100.0%
Functions	100.0%
Lines	100.0%

Avg: 100.0% · 674426c · Node lts/*

... (truncated)

Commits

• See full diff in compare view

Updates @cldmv/vitest-runner from 1.5.1 to 1.5.4

Release notes

Sourced from @​cldmv/vitest-runner's releases.

v1.5.4

vitest-runner v1.5.4 Changelog

Release Date: October 2026 Release Type: Patch Branch: next → master

---

Overview

A dev-tooling dependency release with no change to the published package. Two development dependencies move forward, @cldmv/fix-headers (the tool that maintains the comment headers at the top of source, test, config and workflow files) and @cldmv/configs (the shared lint, format and header configuration), and the dev-only transitive brace-expansion is patched to 5.0.12.

Nothing under src/, tests/, bin/ or the build configuration changed, so dist/ and the CLI, the run() API and the CommonJS entry are identical to v1.5.3. The runtime dependency and peer ranges are untouched, and the only lockfile entries that moved are the three below. No file headers were restamped: both fix-headers steps and the configs bump re-ran fix:headers and changed no file.

---

🔧 Dependencies

All dev-only; none of them is installed by consumers of the package.

• @cldmv/fix-headers ^2.1.2 → ^2.2.0 (locked 2.1.2 to 2.2.0), in two steps: 2.1.4 (#74) and 2.2.0 (#78). Version 2.1.4 never adds a JS comment header to JSON, Markdown or extension-less files and never walks into dependency folders. From 2.2.0 the @Last modified by tag follows content edits only, so a header-only rewrite keeps the recorded editor.
• @cldmv/configs ^1.2.1 → ^1.2.4 (locked 1.2.1 to 1.2.4) (#78). The older shared fix-headers.json forced forceAuthorUpdate and forceLastModifiedAuthorUpdate on; version 1.2.4 sets both to false, so @Author is never rewritten and @Last modified by changes only on real content edits.
• brace-expansion 5.0.9 → 5.0.12, an indirect dev dependency (pulled in through minimatch), updated by Dependabot's npm_and_yarn group (#76). Lockfile only; package.json does not list it.

📚 Documentation

• NEW: docs/changelog/v1/v1.5.4.md: this changelog.
• README What's New promoted to v1.5.4.

---

Upgrade notes

• No breaking changes and no change to what the package ships: a drop-in replacement for v1.5.3. The Node.js 22.12 floor introduced in v1.5.3 is unchanged.

---

Metric	Coverage
Statements	99.4%
Branches	99.6%
Functions	100.0%
Lines	99.3%

Avg: 99.5% · 37726c2 · Node lts/*

... (truncated)

Commits

• e0d7548 release: v1.5.4 - bump @​cldmv/fix-headers to 2.1.4
• a554cdb release: v1.5.3 - fail clearly on Node without require(esm)
• fed1e56 release: v1.5.2 - bump @​types/node from 25.3.0 to 26.6.3
• See full diff in compare view

Updates @vitest/coverage-v8 from 5.0.2 to 5.0.3

Release notes

Sourced from @​vitest/coverage-v8's releases.

v5.0.3

   🐞 Bug Fixes

• Isolate result.status between repeats runs  -  by @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11218 (5dbeb)
• Don't print an interceptor warning in browser mode  -  by @​sheremet-va in vitest-dev/vitest#11377 (15cc0)
• Don't retry when test.fails expectedly failed  -  by @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11219 (b2458)
• Scope cache key generators to projects  -  by @​ecoyoung in vitest-dev/vitest#11281 and vitest-dev/vitest#11301 (92ba7)
• browser:
  • Delay server listen until tests start running  -  by @​sheremet-va in vitest-dev/vitest#11366 (7d8ed)
  • Check mock path boundaries  -  by @​saryn17, Ryosei Sato and @​sheremet-va in vitest-dev/vitest#11361 and vitest-dev/vitest#11362 (1c388)
  • Keep config of browser-consumed environments  -  by @​kasperpeulen and Claude in vitest-dev/vitest#11378 (aafc0)
  • Ignore page crash while cancelling  -  by @​sheremet-va in vitest-dev/vitest#11386 (7c367)
  • toMatchScreenshot uses wrong reference on retried tests  -  by @​macarie in vitest-dev/vitest#11393 (c22ab)
• cache:
  • Revalidate imports of cached modules  -  by @​sheremet-va in vitest-dev/vitest#11381 (38f98)
• deps:
  • Pin why-is-node-running to 3.2.1 to avoid users running into ERR_PNPM_TRUST_DOWNGRADE  -  by @​AriPerkkio in vitest-dev/vitest#11403 (f6c9a)
• expect:
  • Pass current equality testers to expect.extend asymmetric matchers  -  by @​hi-ogawa, Hiroshi Ogawa and Claude in vitest-dev/vitest#11401 (3e794)
• jsdom:
  • Support Blob on jsdom 30.1  -  by @​sheremet-va in vitest-dev/vitest#11379 (6c49b)
• pool:
  • Preserve unique pool ids when groupOrder is set  -  by @​mtorp in vitest-dev/vitest#11392 (50312)
• ui:
  • Split-pane handle overlapping iframe  -  by @​macarie in vitest-dev/vitest#11221 (f91db)
• vitest:
  • Remove root temp dir on close  -  by @​abhinav-phi in vitest-dev/vitest#11248 (7c711)
• vm:
  • Do not optimize deps from index.html  -  by @​ezefernandezyf, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11329 and vitest-dev/vitest#11360 (caf28)
  • Don't reuse scripts across vite environments  -  by @​MO2k4, Martin Oehlert and Claude in vitest-dev/vitest#11395 (346d3)

    View changes on GitHub

Commits

• 33cadea chore: release v5.0.3 (#11409)
• a029e76 chore: migrate to oxc (#11367)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.