livewire/livewire: Vitest upgraded to the patched 4.1 line (#10697)

Pull request #10697 is a small, dev-only chore for the Livewire repository: it bumps the JavaScript test runner, Vitest, from 3.2.4 to the patched 4.1.11 release. Nothing in this change ships to your application — it touches package.json and package-lock.json, which affect contributors and CI only. Just as important is what the PR deliberately doesn't do: it skips the breaking Vitest 5.0 upgrade that Dependabot proposed in #10691, because that jump pulls in Vite 8 and fails dependency installation against the repository's pinned esbuild version. The chosen upgrade was verified locally with a clean install, a production build, and a full test run (110 passed, 1 skipped).

Category: Chore (5)

What actually changed

The source change is a single version constraint in the dev dependencies:

"devDependencies": {
    "brotli-size": "^4.0.0",
    "esbuild": "^0.14.49",
    "jsdom": "27.0.0",
    "vitest": "^4.1.11"
}

Everything else is regenerated lockfile. The bulk of the diff is the test toolchain swapping out its native binaries: the @rollup/rollup-* 4.60.1 and @esbuild/* 0.27.4 platform packages that the old Vitest/Vite tree resolved are replaced by @rolldown/binding-* 1.2.8, @oxc-project/types, and @standard-schema/spec. Crucially, the repository's own esbuild: ^0.14.49 pin is untouched and still resolves to 0.14.54 — that pin exists because esbuild is what compiles Livewire's dist/ JavaScript, and the maintainers did not want the test runner upgrade to disturb the build chain. jsdom also stays put at 27.0.0, so this is a surgical, single-package bump rather than a broad tooling refresh.

Why not just take Vitest 5?

Dependabot's original proposal (#10691) suggested jumping straight to Vitest 5.0. That major version requires Vite 8, and that combination fails dependency installation against the repository's esbuild pin — meaning npm ci breaks before anyone can even run the test suite. Rather than untangle a build-tool migration just to pick up a patched release, this PR takes the pragmatic path: Vitest 4.1.11 is on the patched 4.1 line, so the fixes Dependabot flagged are included, while the 5.0/Vite 8 migration is deferred to a deliberate, separate effort. This is the classic "take the patched minor, schedule the major" pattern, and it keeps main installable for every contributor in the meantime.

How the upgrade was verified

The PR author confirmed the new dependency tree end to end before merging:

npm ci --ignore-scripts   # lockfile installs cleanly
npm run build             # dist assets still compile via the esbuild pin
npm run test:run          # 110 passed, 1 skipped

Each step guards a different failure mode: the clean install proves the lockfile is coherent, the build proves the esbuild-based asset pipeline is unaffected by the new test tree, and the test run proves the suite actually passes under Vitest 4 — no silent API breakage in helpers, matchers, or configuration. A final git diff --check confirms no stray whitespace crept into the large lockfile rewrite.

Impact on your upgrade from v3.8.10

For anyone upgrading Livewire to a release containing this PR, the impact is zero. Vitest is a development dependency of the Livewire repository itself; it is never bundled into dist/, never installed by Composer, and never executed in your application. There are no PHP changes, no configuration changes, and no behavioral changes to components, wire: directives, or lifecycle hooks. If you have your own JavaScript test setup in your app, it is completely unaffected — this PR does not change what Livewire publishes or how you consume it.

Notes for contributors

If you contribute to Livewire, the lockfile changed, so re-sync your local environment after pulling — prefer npm ci over npm install so your node_modules matches the committed lockfile exactly:

git pull
npm ci --ignore-scripts
npm run test:run

Also check your Node version: the native @rolldown/binding-* packages pulled in by the 4.1 toolchain declare an engines range of ^20.19.0 || >=22.12.0, so older Node 20 patch releases (or odd-numbered versions) may fail or warn during install. Node 20.19+ or an active 22.x LTS release is the safe choice. The test command itself is unchanged.

Takeaways

• Vitest moves from ^3.2.4 to ^4.1.11 — a dev-only chore with no effect on installed versions of Livewire.
• The breaking Vitest 5.0 bump (Dependabot #10691) was intentionally declined because its Vite 8 requirement breaks installation against the repo's esbuild: ^0.14.49 pin.
• The esbuild pin and jsdom 27.0.0 are untouched, keeping the asset build pipeline stable.
• Verified via npm ci --ignore-scripts, npm run build, and npm run test:run (110 passed, 1 skipped).
• Contributors should run npm ci after pulling and stay on Node ^20.19.0 || >=22.12.0; application developers upgrading from v3.8.10 need to do nothing at all.

Sources

• Pull request #10697
• Release v4.4.7