From c0cfa8ef7e00650aade0c35e9b5bf3b717384e07 Mon Sep 17 00:00:00 2001
From: "pulse-triage[bot]"
 <249995291+pulse-triage[bot]@users.noreply.github.com>
Date: Sun, 27 Sep 2026 10:10:45 +0100
Subject: [PATCH] Keep Vitest major upgrades coordinated

The isolated coverage-v8 5 proposal cannot install beside Vitest 4 because its peer range requires Vitest 5. Ignore only version majors for both packages until a reviewed frontend migration can update and prove the pair together; retain grouped security updates and minor/patch updates.

Change-source: pulse-maintainer
---
 .github/dependabot.yml                  |  9 +++++++++
 scripts/tests/test_dependabot_config.py | 10 +++++++++-
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 4ad2ca6b0d..009c2f00ec 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -130,6 +130,15 @@ updates:
       - dependency-name: "lucide-solid"
         update-types:
           - "version-update:semver-major"
+      # Vitest and its V8 coverage provider require matching major versions.
+      # An isolated coverage-v8 5.x update cannot install beside Vitest 4.x;
+      # migrate the pair with frontend proof as one explicit change instead.
+      - dependency-name: "vitest"
+        update-types:
+          - "version-update:semver-major"
+      - dependency-name: "@vitest/coverage-v8"
+        update-types:
+          - "version-update:semver-major"
 
   - package-ecosystem: "docker"
     directories:
diff --git a/scripts/tests/test_dependabot_config.py b/scripts/tests/test_dependabot_config.py
index 2a07d72344..7c7067bcb7 100644
--- a/scripts/tests/test_dependabot_config.py
+++ b/scripts/tests/test_dependabot_config.py
@@ -157,13 +157,21 @@ class DependabotConfigTest(unittest.TestCase):
                 "typescript",
                 "eslint",
                 "lucide-solid",
+                "vitest",
+                "@vitest/coverage-v8",
             },
         )
         for browser_runtime in ("playwright", "playwright-core", "@playwright/test"):
             self.assertEqual(ignored[browser_runtime], all_semver)
         # These majors require an explicit toolchain or icon-import migration.
         # Minor and patch version updates must remain eligible for Dependabot.
-        for dependency in ("typescript", "eslint", "lucide-solid"):
+        for dependency in (
+            "typescript",
+            "eslint",
+            "lucide-solid",
+            "vitest",
+            "@vitest/coverage-v8",
+        ):
             self.assertEqual(
                 ignored[dependency],
                 {"version-update:semver-major"},