build(deps): Bump the web-deps group across 1 directory with 2 updates

[dependabot]

Bumps the web-deps group with 2 updates in the /web directory: react-arborist and vitest.

Updates react-arborist from 3.16.0 to 4.0.1

Release notes

Sourced from react-arborist's releases.

v4.0.1

Fixes

• Dragging no longer makes the drag preview lag behind the pointer: hovers reach the store at most once per animation frame, and only rows whose drop highlight changes re-render. (The internal tree.state.nodes.drag.destinationParentId / destinationIndex fields moved to tree.state.dnd; use tree.dragDestinationParent / tree.dragDestinationIndex instead.) (#385)

v4.0.0

Breaking Changes

• react-dnd and react-dnd-html5-backend are now peer dependencies instead of bundled dependencies — install them alongside react-arborist (npm install react-arborist react-dnd react-dnd-html5-backend). This fixes a global singleton conflict (#319) where apps that also used react-dnd ended up with two independent copies of the library, causing drag-and-drop to silently break or throw "Cannot have two HTML5 backends at the same time." Both peers must be v16 (^16), and both are required even when you pass your own dndBackend / dndManager, because the drag preview calls into react-dnd-html5-backend on every drag. react-dnd v16 is ESM-only, and react-arborist now ships a single ESM build too (the CommonJS dist/main build is gone), so import and require load the same copy instead of two copies with separate React contexts. require("react-arborist") from CommonJS relies on require(esm), unflagged from Node 22.12 — now the engines.node floor, which package managers check at install time, so installing v4 requires Node ≥ 22.12 even for bundler and browser consumers. CommonJS TypeScript projects on Node module resolution need module: "nodenext" (TypeScript ≥ 5.8) or "node20" (TypeScript ≥ 5.9); "node16" and "node18" report TS1479. Jest users must add react-arborist to the transformIgnorePatterns exception list alongside react-dnd (see the README). The package also declares an exports map: react-arborist and react-arborist/package.json resolve as before, but deep imports such as react-arborist/dist/module/... are no longer resolvable. The react and react-dom peer floor rises from 16.14 to 18: the build now imports react/jsx-runtime and useSyncExternalStore directly from React, which older versions can't provide to ESM consumers. (#371)

Fixes

• @types/react-window is now a regular dependency instead of a dev dependency. react-arborist's public type declarations reference react-window types (onScroll, outerElementType, innerElementType, tree.list, scroll alignment), so without it TypeScript reported TS7016 under skipLibCheck: false and silently typed those as any otherwise. (#371)

Changelog

Sourced from react-arborist's changelog.

Version 4.0.1

Fixes

• Dragging no longer makes the drag preview lag behind the pointer: hovers reach the store at most once per animation frame, and only rows whose drop highlight changes re-render. (The internal tree.state.nodes.drag.destinationParentId / destinationIndex fields moved to tree.state.dnd; use tree.dragDestinationParent / tree.dragDestinationIndex instead.) (#385)

Version 4.0.0

Breaking Changes

• react-dnd and react-dnd-html5-backend are now peer dependencies instead of bundled dependencies — install them alongside react-arborist (npm install react-arborist react-dnd react-dnd-html5-backend). This fixes a global singleton conflict (#319) where apps that also used react-dnd ended up with two independent copies of the library, causing drag-and-drop to silently break or throw "Cannot have two HTML5 backends at the same time." Both peers must be v16 (^16), and both are required even when you pass your own dndBackend / dndManager, because the drag preview calls into react-dnd-html5-backend on every drag. react-dnd v16 is ESM-only, and react-arborist now ships a single ESM build too (the CommonJS dist/main build is gone), so import and require load the same copy instead of two copies with separate React contexts. require("react-arborist") from CommonJS relies on require(esm), unflagged from Node 22.12 — now the engines.node floor, which package managers check at install time, so installing v4 requires Node ≥ 22.12 even for bundler and browser consumers. CommonJS TypeScript projects on Node module resolution need module: "nodenext" (TypeScript ≥ 5.8) or "node20" (TypeScript ≥ 5.9); "node16" and "node18" report TS1479. Jest users must add react-arborist to the transformIgnorePatterns exception list alongside react-dnd (see the README). The package also declares an exports map: react-arborist and react-arborist/package.json resolve as before, but deep imports such as react-arborist/dist/module/... are no longer resolvable. The react and react-dom peer floor rises from 16.14 to 18: the build now imports react/jsx-runtime and useSyncExternalStore directly from React, which older versions can't provide to ESM consumers. (#371)

Fixes

• @types/react-window is now a regular dependency instead of a dev dependency. react-arborist's public type declarations reference react-window types (onScroll, outerElementType, innerElementType, tree.list, scroll alignment), so without it TypeScript reported TS7016 under skipLibCheck: false and silently typed those as any otherwise. (#371)

Commits

• a4c7805 v4.0.1
• 6ca6dfc Improved drag and drop performance (#385)
• 10859eb Write .js extensions in source imports and drop fix-esm-extensions (#388)
• bbb5b38 v4.0.0
• 33acbff feat!: promote react-dnd to peer dependency, require v16 and Node ≥22 (#371)
• See full diff in compare view

Updates vitest from 4.1.12 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

• Keep vite default fs.deny with api token file  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11578 (28dc1)
• Handle quoted file names in --changed  -  by @​sheremet-va in vitest-dev/vitest#11583 (14921)
• Add data to the import.meta.hot stub  -  by @​sheremet-va in vitest-dev/vitest#11590 (3a828)
• Set skip in skipIf, ignore undefined options  -  by @​sheremet-va in vitest-dev/vitest#11591 (d523a)
• Skip builtin loading in async leak detector  -  by @​sheremet-va in vitest-dev/vitest#11598 (fe86a)
• Keep the import frame in native loader errors  -  by @​sheremet-va in vitest-dev/vitest#11599 (9697b)
• Run hook cleanups when a later hook fails  -  by @​sheremet-va in vitest-dev/vitest#11605 (6c5a4)
• Release mocks of finished test files  -  by @​sheremet-va in vitest-dev/vitest#11607 (e9c3d)
• Abort all running tests on cancel  -  by @​sheremet-va in vitest-dev/vitest#11606 (6621a)
• browser:
  • Ignore synthetic pagehide events  -  by @​sheremet-va in vitest-dev/vitest#11582 (ca081)
  • Run plugin buildStart on server creation  -  by @​sheremet-va in vitest-dev/vitest#11593 (ea611)
  • Drop late connections of closed sessions  -  by @​sheremet-va in vitest-dev/vitest#11600 (f161e)
  • Wait 30s for the browser to close  -  by @​sheremet-va in vitest-dev/vitest#11601 (6498b)
  • Run global setup once with instances  -  by @​sheremet-va in vitest-dev/vitest#11596 (8dd67)
• reporter:
  • End reason &[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39);failed&[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39); on worker crash  -  by @​AriPerkkio in vitest-dev/vitest#11568 (6ae8e)

    View changes on GitHub

v5.0.4

   🚀 Features

• experimental:
  • Tag cache directories with CACHEDIR.TAG  -  by @​lifeiscontent in vitest-dev/vitest#11461 (a8ea3)
  • Support test.ui.theme option  -  by @​sheremet-va in vitest-dev/vitest#11499 (1da66)
  • Highlight selector multiple matches in trace view  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11489 (5abba)
  • Print how many tests were affected and a total when running --changed  -  by @​sheremet-va in vitest-dev/vitest#11424 (a2336)
  • Add an option to cache dependencies instead of statically parsing them  -  by @​sheremet-va in vitest-dev/vitest#11515 (c0601)
  • Add fit and zoom controls to trace viewer  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11490 (f5dd9)

   🐞 Bug Fixes

• Fail the run on git and location filter errors  -  by @​sheremet-va in vitest-dev/vitest#11430 (30d03)
• Enable fsModuleCache by default  -  by @​sheremet-va in vitest-dev/vitest#11435 (ad208)
• Track project files and mocks with --changed  -  by @​sheremet-va in vitest-dev/vitest#11432 (b0f2b)
• Refactor caching, fix : in project and change the shape of results cache  -  by @​sheremet-va in vitest-dev/vitest#11453 (9673c)
• Keep full $ string values when taskTitleValueFormatTruncate is 0  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11485 (4f7e1)
• Resolve node builtins in client environments  -  by @​sheremet-va in vitest-dev/vitest#11417 (56b31)
• Fix module graph builtin externals after #11421  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11491 and vitest-dev/vitest#11421 (008e1)
• Wrap module mocks during in-source testing  -  by @​sheremet-va in vitest-dev/vitest#11505 (36d19)
• Handle line endings in snapshot  -  by @​sheremet-va in vitest-dev/vitest#11522 (4c468)
• Respect root in projects  -  by @​sheremet-va in vitest-dev/vitest#11521 (26642)
• Resolve mocks in directories with spaces  -  by @​sheremet-va in vitest-dev/vitest#11539 (caaef)
• api:
  • Publish the api token atomically  -  by @​umairnawaz333 in vitest-dev/vitest#11323 (6f990)
• browser:

... (truncated)

Commits

• 7a825db chore: release v5.0.5 (#11609)
• 6621a72 fix: abort all running tests on cancel (#11606)
• e9c3d72 fix: release mocks of finished test files (#11607)
• 8dd67c2 fix(browser): run global setup once with instances (#11596)
• 6c5a447 fix: run hook cleanups when a later hook fails (#11605)
• 9697b38 fix: keep the import frame in native loader errors (#11599)
• 6498b66 fix(browser): wait 30s for the browser to close (#11601)
• f161e6d fix(browser): drop late connections of closed sessions (#11600)
• fe86a64 fix: skip builtin loading in async leak detector (#11598)
• 6ae8e89 fix(reporter): end reason 'failed' on worker crash (#11568)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions