fix: bump vitest to v5 and override it to fix npm 10 install crash

[Puppo]

Motivation

A fresh npm i on main currently fails on Node 22 (npm 10):

npm error Cannot read properties of null (reading 'edgesOut')

Root cause

• vite@8, a peer of vitest, has an optional peer @vitejs/devtools. That package requires @vitejs/devtools-vitest, which declares a peer of vitest: "*".
• npm 10's arborist resolves that vitest@* on its own. Now that vitest 5 is latest, it picks vitest@5.x, which pulls @vitest/browser-playwright@5.x, which in turn requires vitest@5.x. That clashes with the root vitest@4.1.11.
• Instead of reporting a peer conflict, npm 10 crashes in #loadPeerSet (build-ideal-tree.js). npm 11 (Node 24/26) handles the same tree correctly.

Nothing in this repo changed. It started when vitest 5 became latest on the registry.

Why bumping vitest alone (#531) is not enough

On Node 20, npm prefers engine-compatible versions. vitest 5 requires Node ^22.12.0 || ^24.0.0 || >=26.0.0, so there vitest@* resolves to 4.1.11. With vitest 5 at the root, that is the same conflict in reverse, and npm 10 crashes the same way.

Fix

• Bump vitest to ^5.0.1.
• Add "overrides": { "vitest": "^5.0.1" } so every vitest in the tree, including the one requested through the optional peer chain, resolves to the same major. This removes the conflict on every Node version.
• The range is ^5.0.1 rather than ^5.0.3 because .npmrc sets min-release-age=7. npm 11 honours it and would refuse 5.0.3 (published 2026-09-30) until 2026-10-07. With ^5.0.1, npm 11 installs 5.0.2 for now and moves to 5.0.3 after that date; npm 10 ignores the setting and installs 5.0.3.

Note

The override has to be kept in sync with the vitest devDependency on future bumps; otherwise npm rejects the install with an override conflict. It can be removed once Node 20 is dropped from the CI matrix. vitest 5, borp and tstyche already declare Node >= 22 in their engines.

Verification

Clean npm i --ignore-scripts + npm test on macOS:

Node	npm	vitest installed	Install	Tests
20.20.2	10.8.2	5.0.3	ok (EBADENGINE warnings)	pass
22.23.3	10.9.9	5.0.3	ok	pass
24.21.0	11.19.0	5.0.2	ok	pass
26.5.1	11.17.0	5.0.2	ok	pass

Without the override, Node 20 still crashes with the edgesOut error; 22, 24 and 26 install fine.

Supersedes #531.

Checklist

• run npm run test
• commit message and code follows the Developer's Certification of Origin and the Code of conduct