[viztor]

This PR combines the two Dependabot PRs #165 and #166. Neither passes CI on its own: each one's failure is fixed by the other's changes.

• build: bump vite-plus from 1.4.0 to 1.5.0 in the dependencies group across 1 directory #165 alone moves vite-plus to 1.5.0, which bundles vitest 5.1.0 and refuses @vitest/coverage-v8 5.0.5. It also leaves the catalog's vite core at 1.4.0.
• build: bump the dev-dependencies group across 1 directory with 6 updates #166 alone moves ultracite to a version that needs oxlint 1.90 or later, which only vite-plus 1.5.0 ships.
• Both leave the rc channel's lockfile un-relocked. build: bump vite-plus from 1.4.0 to 1.5.0 in the dependencies group across 1 directory #165's relock also dropped the root's pi to 1.5.0, while the host record pins 1.5.2.

What moves

Package	From	To
vite-plus (catalog)	1.4.0	1.5.0
vite → @voidzero-dev/vite-plus-core (catalog; the vite@* override follows it)	1.4.0	1.5.0
vitest	5.0.5	5.1.0
@vitest/coverage-v8	5.0.5	5.1.0
es-module-lexer	2.3.2	3.0.4
jsdom	^30.1.3 (30.1.3)	^31.0.0 (31.0.1)
semver	^7.8.5	^7.8.6
ultracite	^8.1.0 (8.1.0)	^8.1.1 (8.2.0)

The bump also moves these: oxlint 1.89 → 1.91, oxfmt 0.74 → 0.76, oxlint-tsgolint 7.0.2004 → 7.0.2005 and undici 8.12.2 → 8.12.4.

Kept as recorded

• @earendil-works/pi-ai stays at 1.5.2, with one copy in each lockfile. Host packages are unchanged: dsh 0.2.2-alpha.3 on alpha and 0.2.2-rc.2 on rc.
• channels/rc/pnpm-lock.yaml is relocked with scripts/use-channel.ts rc --relock. It matches the root lockfile on every non-host package, so harness-channel and host-versions pass.

Code changes

• scripts/freshness-scope.ts: es-module-lexer 3 drops initSync, but its parse still runs synchronously in Node. A small loadedSpecifier reader handles 3.x's import records:

  • static imports and re-exports give their specifier;
  • import.meta gives none;
  • a template-literal import(), which 3.x now reports as a glob, is skipped, as 2.x did.

  A review compared the old reader on 2.3.2 with the new one on 3.0.4, over 15 edge forms and all 237 source files in the tree, and found no differences.

• test/freshness-scope.test.ts: one new case covers star re-exports, literal, template and computed import(), and import.meta. It fails if the glob check is removed.

• pnpm-workspace.yaml: the release-age exemption for ultracite@8.1.0 is dropped, because neither lockfile installs that version any more.

oxfmt 0.76 reformatted nothing. oxlint 1.91 reports the same 12 warnings as main, file for file, and no finding from the new no-unsafe-enum-assignment rule. No coverage floor, warning allowance or existing test changed.

Verification (Node 26 unless stated)

Step	Result
pnpm install --frozen-lockfile	passes
vp check	0 errors, 12 warnings (same as main)
unit suite, alpha	127 files; 2033 passed, 1 skipped (also shuffled with seed 42)
mock suite	7 files, 83 passed
rc channel, unit and mock	2033 passed, 1 skipped; 83 passed; no residue after switching back
coverage	every floor met (98.36 / 95.92 / 98.65 / 98.36)
build and scripts/check.ts	check passed
Node 24, shuffled with seed 7	2033 passed, 1 skipped
binary e2e, alpha npm and rc npm cells	15 passed, 2 HOST_LIMITATION skips each

Review: two rounds. Round 1 upheld one low finding (the stale ultracite exemption) and refuted one; it is fixed. Round 2 found nothing.

Once this merges, Dependabot should close #165 and #166 as superseded.

---

Generated by Claude Code