chore(deps-dev): upgrade vitest and its coverage provider to 5

[maia-andre]

Resolves: #8299

📝 Summary

Moves vitest and @vitest/coverage-v8 to 5.0.0 together and groups them in the Dependabot configuration.

@vitest/coverage-v8 declares an exact peer on the vitest version it supports, so raising one alone cannot install. That is what happened in #8295, where the failure occurred during dependency installation, before the frontend checks could run.

The lock file was regenerated with a plain npm install, without --force and without --legacy-peer-deps. It gets smaller: 66 packages added, 189 removed, 126 changed.

The Dependabot group keeps the pair from drifting apart again:

groups:
  vitest:
    patterns:
      - "vitest"
      - "@vitest/coverage-*"

The one migration change

Vitest 5 surfaces a pending dynamic import as an unhandled rejection when the module runner closes, and npm test exited 1 with:

Error: Vite module runner has been closed.
 ❯ src/utils/fileStatus.js:9:37
 ❯ src/components/validation/EnvelopeValidation.vue:15:32
This error originated in "src/tests/router/router.spec.ts"

The cause is in the test, not in Vitest. dynamic component returns thenable calls the lazy route loader and asserts the returned value has a then, but never awaits it, so the import was still resolving after the test finished and outlived the module runner. Vitest 4 swallowed it.

The fix awaits the promise the test already created. It keeps what the test was checking and additionally proves the component really loads, rather than weakening the assertion:

expect(componentImport).toHaveProperty('then')
await expect(componentImport).resolves.toBeDefined()

No other test or configuration needed changes. In particular, the two behavioral changes most likely to bite were checked and do not apply here: there are no unawaited resolves/rejects assertions anywhere in src/, and no mock behaviour is configured in beforeAll, so clearMocks flipping to true by default changes nothing in this suite.

🧪 How to test

npm ci
npm test
npm run test:coverage
npm run ts:check
npm run lint
npm run stylelint
npm run build

Everything below was run locally on Node 24.18.0 / npm 11.16.0:

command	result
npm ci	exit 0, no ERESOLVE, no peer conflict
npm test	exit 0 — 248 files, 3118 tests, 0 unhandled errors
npm run test:coverage	exit 0, thresholds met
npm run ts:check	exit 0
npm run lint	exit 0 (20 pre-existing warnings, unchanged)
npm run stylelint	exit 0
npm run build	exit 0

Test counts are identical to main: 248 files and 3118 tests before and after.

One thing worth reporting

On the first coverage run, RequestSignatureTab.spec.ts > uses effective policy when file flow is none failed once with expected 'parallel' to be 'ordered_numeric'. It did not reproduce in 16 further coverage runs on this branch, and the file passes in isolation. That test shares a Pinia store across cases and awaits a single $nextTick, so it is order and timing sensitive independently of the Vitest version; five baseline coverage runs on main with Vitest 4 showed no failure but also were not enough to rule it out there.

I left it alone, since the issue asks not to modify tests preemptively and this is not a reproducible incompatibility. Flagging it in case it shows up in CI, and happy to open a separate issue for it if you prefer.

✅ Checklist

• I have read and followed the contribution guide.
• vitest updated to 5.x.
• @vitest/coverage-v8 updated to the matching 5.x version.
• package-lock.json regenerated normally, without --force or --legacy-peer-deps.
• npm ci completes without peer dependency errors.
• Dependabot groups the Vitest packages together.
• Existing test intent preserved — no assertion was weakened to make the suite pass.

🤖 AI (if applicable)

• The content of this PR was partially or fully generated using AI

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.
see 214 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[vitormattos]

/backport to stable35