docs: add the v1.5.4 release notes and README What's New

README.md

@@ -14,18 +14,17 @@ Coverage stays out-of-memory-safe too: each file writes a coverage blob, and a s
 
 ## ✨ What's New
 
-### Latest: v1.5.3 (October 2026)
+### Latest: v1.5.4 (October 2026)
 
-- **A bundler-friendly CommonJS entry that fails clearly on old Node.js** — `dist/index.cjs` now loads the ES module build with a plain `require("./index.mjs")` instead of going through `createRequire`, so bundlers such as esbuild and webpack can see the dependency. On a Node.js version without synchronous `require(esm)` it throws an `ERR_REQUIRE_ESM` error that names the package, the versions `require()` needs (^20.19.0 or >=22.12.0) and the running version, and points at `import()` ([#69](https://github.com/CLDMV/vitest-runner/pull/69)). New `node:test` checks run the built CommonJS entry on every test and coverage run.
-- **Node.js 22.12 or later** — `engines.node` moves from `>=20.19.0` to `>=22.12.0` ([#73](https://github.com/CLDMV/vitest-runner/pull/73)). The `chalk` 6 dependency and the `vitest` 5 peer already needed it, so Node.js 20 had stopped installing cleanly in v1.5.2; the declared floor now matches.
-- [View full v1.5.3 Changelog](https://github.com/CLDMV/vitest-runner/blob/master/docs/changelog/v1/v1.5.3.md)
+- **Dev-tooling dependency update, nothing new in the package** — `@cldmv/fix-headers` moves to 2.2.0 ([#74](https://github.com/CLDMV/vitest-runner/pull/74), [#78](https://github.com/CLDMV/vitest-runner/pull/78)), `@cldmv/configs` to 1.2.4 ([#78](https://github.com/CLDMV/vitest-runner/pull/78)) and the dev-only `brace-expansion` to 5.0.12 ([#76](https://github.com/CLDMV/vitest-runner/pull/76)). What the package ships is identical to v1.5.3.
+- [View full v1.5.4 Changelog](https://github.com/CLDMV/vitest-runner/blob/master/docs/changelog/v1/v1.5.4.md)
 
 ### Recent Releases
 
+- **v1.5.3** (October 2026) — A bundler-friendly CommonJS entry that fails clearly on Node.js without `require(esm)`, and `engines.node` raised to `>=22.12.0` ([Changelog](https://github.com/CLDMV/vitest-runner/blob/master/docs/changelog/v1/v1.5.3.md))
 - **v1.5.2** (October 2026) — `chalk` moves to 6.0.1, a skipped PR run can no longer satisfy `✅ Required PR Check`, and the repository adopts the shared CLDMV fix-headers config ([Changelog](https://github.com/CLDMV/vitest-runner/blob/master/docs/changelog/v1/v1.5.2.md))
 - **v1.5.1** (September 2026) — Documentation-only release that backfilled the missing v1.5.0 changelog ([Changelog](https://github.com/CLDMV/vitest-runner/blob/master/docs/changelog/v1/v1.5.1.md))
 - **v1.5.0** (September 2026) — Added an `exclude` option (API + repeatable `--exclude <glob>` CLI flag) so discovery can skip directories/files like `tmp/**` worktrees or `dist/**` build output ([Changelog](https://github.com/CLDMV/vitest-runner/blob/master/docs/changelog/v1/v1.5.0.md))
-- **v1.4.4** (September 2026) — Dropped the `prepack` tsup-availability workaround now that the underlying gap is fixed upstream, and re-armed the release-merge gate for every check-producing workflow ([Changelog](https://github.com/CLDMV/vitest-runner/blob/master/docs/changelog/v1/v1.4.4.md))
 
 📚 For complete release notes, see the [docs/changelog/](https://github.com/CLDMV/vitest-runner/tree/master/docs/changelog/) folder.
 

docs/changelog/v1/v1.5.4.md

@@ -0,0 +1,34 @@
+# vitest-runner v1.5.4 Changelog
+
+**Release Date**: October 2026
+**Release Type**: Patch
+**Branch**: `next` → `master`
+
+---
+
+## Overview
+
+A dev-tooling dependency release with no change to the published package. Two development dependencies move forward, `@cldmv/fix-headers` (the tool that maintains the comment headers at the top of source, test, config and workflow files) and `@cldmv/configs` (the shared lint, format and header configuration), and the dev-only transitive `brace-expansion` is patched to 5.0.12.
+
+Nothing under `src/`, `tests/`, `bin/` or the build configuration changed, so `dist/` and the CLI, the `run()` API and the CommonJS entry are identical to [v1.5.3](./v1.5.3.md). The runtime dependency and peer ranges are untouched, and the only lockfile entries that moved are the three below. No file headers were restamped: both fix-headers steps and the configs bump re-ran `fix:headers` and changed no file.
+
+---
+
+## 🔧 Dependencies
+
+All dev-only; none of them is installed by consumers of the package.
+
+- **`@cldmv/fix-headers` `^2.1.2` → `^2.2.0`** (locked 2.1.2 to 2.2.0), in two steps: 2.1.4 ([#74](https://github.com/CLDMV/vitest-runner/pull/74)) and 2.2.0 ([#78](https://github.com/CLDMV/vitest-runner/pull/78)). Version 2.1.4 never adds a JS comment header to JSON, Markdown or extension-less files and never walks into dependency folders. From 2.2.0 the `@Last modified by` tag follows content edits only, so a header-only rewrite keeps the recorded editor.
+- **`@cldmv/configs` `^1.2.1` → `^1.2.4`** (locked 1.2.1 to 1.2.4) ([#78](https://github.com/CLDMV/vitest-runner/pull/78)). The older shared `fix-headers.json` forced `forceAuthorUpdate` and `forceLastModifiedAuthorUpdate` on; version 1.2.4 sets both to `false`, so `@Author` is never rewritten and `@Last modified by` changes only on real content edits.
+- **`brace-expansion` 5.0.9 → 5.0.12**, an indirect dev dependency (pulled in through `minimatch`), updated by Dependabot's `npm_and_yarn` group ([#76](https://github.com/CLDMV/vitest-runner/pull/76)). Lockfile only; `package.json` does not list it.
+
+## 📚 Documentation
+
+- **NEW:** [docs/changelog/v1/v1.5.4.md](./v1.5.4.md): this changelog.
+- README What's New promoted to v1.5.4.
+
+---
+
+## Upgrade notes
+
+- No breaking changes and no change to what the package ships: a drop-in replacement for [v1.5.3](./v1.5.3.md). The Node.js 22.12 floor introduced in v1.5.3 is unchanged.