[nevridge]

Summary

Upgrades vitest and @vitest/coverage-v8 together to 5.0.5 (exact pins). @vitest/coverage-v8 peers on an exact vitest version, so the two have to move in lockstep. vite stays at 8.3.4: vitest 5's peer range is ^6.4 || ^7 || ^8.

Dependabot now groups the pair, so future updates arrive as one PR that installs cleanly.

Changes

• TaskFlow.Web/package.json: vitest and @vitest/coverage-v8 pinned to 5.0.5, with no caret because the peer is exact.
• TaskFlow.Web/package-lock.json: regenerated. Churn is limited to vitest, @vitest/* and their transitive packages. vite, plugin-react, jsdom, testing-library, typescript and @types/node are unchanged.
• .github/dependabot.yml (npm block):
  • Removed the vitest and @vitest/coverage-v8 ignores.
  • Kept the vite, typescript and @hey-api/* major ignores.
  • Added a vitest group (vitest, @vitest/*) with no update-types, so it covers major, minor and patch.
  • Added exclude-patterns for the same two to npm-minor-patch, so each package is in exactly one group.
  • Updated the comment.
• TaskFlow.Web/src/test/jest-dom.d.ts (new, types only): vitest 5 changed Assertion<T> to Assertion<R, T> and exposes Matchers<R, T> for custom matchers. @testing-library/jest-dom 7.0.1 still targets the old shape, and without this shim npm run type-check fails with about 450 TS2339 errors such as Property 'toBeInTheDocument' does not exist. The file augments vitest's Matchers<R, T> with jest-dom's TestingLibraryMatchers. It can be removed once jest-dom ships vitest 5 typings.

No test file, vite.config.ts, doc, workflow, Dockerfile or backend change. The 80% coverage threshold is unchanged.

Verification (local)

Gate	Result
npm ci	PASS
npm run lint	PASS (0 errors, 1 existing warning at TasksPage.tsx:287)
npm run type-check	PASS
npm run test -- --run --coverage	PASS: 44/44 files, 676/676 tests
Line coverage	91.15% before and after (gate: 80%)
npm run build	PASS
npm audit --omit=dev	0 vulnerabilities
Timer-sensitive tests (JournalPage, useJournal, journal-utils), run twice	PASS

Skip/todo count is unchanged, and no test was edited.

Not verified locally

• Docker web image build and Trivy scan (AC5). Both failed on this machine on TLS certificate errors (UNABLE_TO_GET_ISSUER_CERT_LOCALLY in npm ci, and server certificate not trusted in apk upgrade), which look like a corporate proxy. Neither failure involves this diff. Trivy is not installed locally. security-scan.yml in CI is the gate. The runtime image copies all of node_modules, including dev dependencies, so new transitive packages are scanned.
• Local Node is v25.9.0, outside vitest 5's engines range (^22.12 || ^24 || >=26). CI and Docker use Node 26.

Notes

• Vitest prints an informational notice that vite.config.ts uses __dirname, which configLoader: 'native' does not support. It is not an error, and vite.config.ts is out of scope here.
• After merge, close or rebase any open Dependabot vitest / coverage-v8 PRs.

Closes #285