[dependabot]

Bumps the all-dependencies group with 2 updates: @napi-rs/keyring and vitest.

Updates @napi-rs/keyring from 1.3.0 to 2.0.0

Release notes

Sourced from @​napi-rs/keyring's releases.

v2.0.0

⚠️ Breaking Changes

This release changes how credential store errors are reported. Success and "not found" results are unchanged, but provider failures that were previously silenced now throw (sync API) or reject (async API).

1. Reads: getPassword() / getSecret()

Previously, any failure reading the credential store — a locked keychain, denied access, an OS error — was swallowed and returned as null / undefined, indistinguishable from "no credential stored".

Now only a genuinely missing credential (NoEntry) returns the absent result. Every other error throws or rejects:

Scenario	v1.x	v2.0.0
Credential exists	value	value (unchanged)
Credential missing	null / undefined	null / undefined (unchanged)
Store locked / inaccessible / OS error	null / undefined ⚠️	throws / rejects

2. Deletes: deleteCredential() / deletePassword()

Previously, any delete failure returned false, so a failed delete looked identical to "credential was already gone" — leaving callers unable to tell whether the secret was actually removed.

Now false only means the credential did not exist (NoEntry). A failed delete throws or rejects:

Scenario	v1.x	v2.0.0
Credential deleted	true	true (unchanged)
No credential to delete	false	false (unchanged)
Delete failed (locked store, OS error)	false ⚠️	throws / rejects

A false result now guarantees the credential is absent from the store.

3. TypeScript: async deletePassword() return type

The async deletePassword() alias is now correctly declared as Promise<boolean> instead of Promise<unknown>. This is a narrowing and is source-compatible for typical usage, but code that treated the result as unknown may need a small type adjustment.

These changes apply to both Entry (sync) and AsyncEntry (async), including the deletePassword() aliases.

---

🔧 Migration Guide

If you only check for absent credentials — no change needed

// Still works exactly as before: null means "not stored"
const password = await entry.getPassword()
if (password === null) {
  // no credential stored
}

... (truncated)

Commits

• f344941 2.0.0
• 648d7ce chore: bump up cross-platform-actions/action action to v1.5.0 (#140)
• 5df8cf5 fix: propagate credential store errors instead of erasing them into false/abs...
• a8709c1 chore: bump up cross-platform-actions/action action to v1.4.0 (#139)
• 58edf33 fix: preserve non-missing password read errors (#136)
• 8e1e418 chore: bump up Yarn to v4.18.0 (#135)
• df1f9b5 chore: bump up chalk version to v6 (#134)
• 3e7bcc4 chore: bump up typescript version to v7 (#132)
• 9ded330 chore: bump up actions/setup-node action to v7 (#133)
• f330874 chore: bump up Yarn to v4.17.1 (#131)
• Additional commits viewable in compare view

Updates vitest from 4.1.11 to 5.0.0

Release notes

Sourced from vitest's releases.

v5.0.0

Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

   🚨 Breaking Changes

• Replace loupe.inspect with pretty-format  -  by @​hi-ogawa, Claude Opus 5 (1M context) and OpenAI Codex in vitest-dev/vitest#9609 (3f802)
• Remove quotes from string values in test.for/each title $ variable (take 2)  -  by @​hi-ogawa in vitest-dev/vitest#10170 (04d37)
• Default attachmentsDir from .vitest-attachements/ to .vitest/attachments/  -  by @​MdSadiqMd in vitest-dev/vitest#10186 (1ba73)
• Remove sequential test/suite options in favor of concurrent  -  by @​hi-ogawa and OpenAI Codex in vitest-dev/vitest#10198 (9229f)
• Represent locator as an object instead of a string  -  by @​sheremet-va in vitest-dev/vitest#10212 (80f07)
• Inline expect package  -  by @​sheremet-va in vitest-dev/vitest#10221 (ad162)
• Remove deprecated entry points  -  by @​sheremet-va in vitest-dev/vitest#10222 (994c6)
• Require Node.js 22 and Vite 6.4  -  by @​sheremet-va in vitest-dev/vitest#10178 (38762)
• Fail expect.poll when function didn't resolve in time  -  by @​hi-ogawa and OpenAI Codex in vitest-dev/vitest#10233 (4df04)
• Throw an error if hoistable methods are outside the top level scope  -  by @​sheremet-va in vitest-dev/vitest#10460 (d0b4f)
• toHaveTextContent is strict, add toMatchTextContent as alternative  -  by @​sheremet-va in vitest-dev/vitest#10473 (18f30)
• Don't lookup config file from ancestor directories  -  by @​hi-ogawa, OpenAI Codex and Hiroshi Ogawa in vitest-dev/vitest#10428 (945d9)
• Inline @vitest/runner package, do not publish it anymore  -  by @​sheremet-va in vitest-dev/vitest#10511 (6d6e4)
• Allow mutating happy-dom/jsdom window object  -  by @​hi-ogawa, Hiroshi Ogawa and OpenAI Codex in vitest-dev/vitest#10373 (206e8)
• Expose concurrencyId/workerId on TestModule's diagnostics, make id 1-based  -  by @​sheremet-va in vitest-dev/vitest#10516 (bdd98)
• Add screenshotDirectory config to browser.expect.toMatchScreenshot  -  by @​macarie in vitest-dev/vitest#10592 (a60de)
• Update @sinonjs/fake-timers and support mocking Temporal  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#10654 (f8b15)
• Remove webdriverio package  -  by @​sheremet-va in vitest-dev/vitest#10675 (5fed6)
• Clear mocks by default before each test  -  by @​sheremet-va in vitest-dev/vitest#10613 (0f646)
• Don't emit localStorage warnings on Node 26, fail gracefully when worker fails to start  -  by @​sheremet-va in vitest-dev/vitest#10293 (334ed)
• Separate config resolution from the server creation  -  by @​sheremet-va in vitest-dev/vitest#10554 (1c0ec)
• Inline projects extend the root config by default  -  by @​sheremet-va in vitest-dev/vitest#10750 (fec00)
• Enable mocking Temporal without fake timers  -  by @​fabon-f, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#10757 (ac2d4)
• Support nested projects  -  by @​sheremet-va in vitest-dev/vitest#10846 (ec367)
• Use > as separator in -t, calculate only once  -  by @​sheremet-va in vitest-dev/vitest#10686 (a0b20)
• Fail the test when an asynchronous assertion is not awaited  -  by @​sheremet-va in vitest-dev/vitest#10868 (86d4a)
• Share the Vite server between inline projects  -  by @​sheremet-va in vitest-dev/vitest#10848 (d87c9)
• Parse files statically in vitest list by default  -  by @​sheremet-va in vitest-dev/vitest#11088 (51e94)
• benchmark:
  • Rewrite the public API  -  by @​sheremet-va in vitest-dev/vitest#10113 (19f6e)
• browser:
  • Iframe scale  -  by @​macarie in vitest-dev/vitest#9745 (b6398)
  • Enable locators.exact by default  -  by @​sheremet-va in vitest-dev/vitest#10430 (e2032)
  • Require sessionId for orchestrator html request  -  by @​hi-ogawa, Hiroshi Ogawa and OpenAI Codex in vitest-dev/vitest#10522 (79b7d)
  • Save failure screenshots in attachmentsDir  -  by @​macarie in vitest-dev/vitest#10917 (3b5bb)
• coverage:
  • include/exclude globs too eager  -  by @​AriPerkkio in vitest-dev/vitest#9818 (edacb)
  • Allow thresholds.perFile to accept an object  -  by @​vladlenskiy and @​AriPerkkio in vitest-dev/vitest#10190 (13b78)
• expect:
  • Fix toThrow("") behavior by reverting #6710  -  by @​hi-ogawa in vitest-dev/vitest#9643 and vitest-dev/vitest#6710 (6c3e4)
• mocker:
  • Deserialize automock as automock  -  by @​nami8824 in vitest-dev/vitest#10192 (2f892)
• reporters:
  • blob reporter and --merge-reports default to .vitest/blob/  -  by @​AriPerkkio in vitest-dev/vitest#10232 (d22b0)
  • Write json and junit reporter output files to .vitest by default  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and @​AriPerkkio in vitest-dev/vitest#10621 (58577)

... (truncated)

Commits

• f441c6f chore: release v5.0.0 (#11130)
• d46a747 fix: treat test.describe as a suite during static collection (#11128)
• 584cf30 fix: add a warning if inline project has duplicate plugins due to unexpected ...
• f08ce4b fix: apply queued mocks from doMock() in queue order (fixes #10706) (#11127)
• 897f51f chore: release v5.0.0-rc.4 (#11107)
• 1339b06 chore(deps): update all non-major dependencies (#11104)
• 51e9494 feat!: parse files statically in vitest list by default (#11088)
• 2122ffd fix: propagate --maxWorkers to projects (#11102)
• dc10f5f fix(browser): report the action error when a task times out (#11101)
• d4fe198 feat: promote clearCache out of experimental (#11086)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[stephendolan]

Automated triage: this bump only touched package.json (@napi-rs/keyring 1.3.0 -> ^2.0.0, vitest 4.1.11 -> ^5.0.0) without updating bun.lock. CI here is green regardless (no --frozen-lockfile), but merging as-is leaves main's lockfile out of sync with package.json. Opened a completed replacement: #71 (lockfile regenerated, verified with typecheck/lint/test/build).

Leaving this PR open pending Stephen's review via Fortress — recommend merging #71 instead and closing this one once that lands.

[dependabot]

Dependabot could not run Bun to update your dependencies due to a configuration error. Because of this, Dependabot cannot update this pull request.

[stephendolan]

Superseded by #71, which is the same commit plus a regenerated bun.lock. Merged.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml