chore: upgrade vitest, biome and lefthook to latest majors

[ivandotv]

Clears all 22 open Dependabot alerts (2 critical, 7 high). pnpm audit now reports no known vulnerabilities.

Worth stating plainly: every one of those alerts was development scope, and all of them sat transitively under vitest 2 — vite, postcss, esbuild, rollup, minimatch, glob, brace-expansion. pumpit ships no runtime dependencies, so none of them ever reached anyone installing the package. This was housekeeping, not an incident.

vitest 2.1.9 → 4.1.10

Three things needed attention:

Two tests stopped parsing. They declared a required constructor parameter after an optional one, suppressed with @ts-expect-error:

constructor(
  public keyOne: number,
  public optionalProp?: string,
  // @ts-expect-error for testing purposes
  public keyThree: number,
) {}

Vitest 4 ships Vite 8, which transforms TypeScript with oxc instead of esbuild, and oxc rejects this at parse time where esbuild allowed it. A type-level suppression can't help — the file simply doesn't parse. Made keyThree optional instead. ? is erased at runtime, so positional resolution — which is what both tests actually exercise — is unchanged, and the suppression is no longer needed.

coverage.all was removed, so v4 reports only files it loaded. Without an explicit coverage.include, an untested source file would silently vanish from the report rather than show up as 0%. Now set to src/**.

configDefaults.coverage.exclude is now [], which made the config's spread of it dead code — and its comment about tsdown stale. Inlined the exclude list.

On the coverage numbers

Branch coverage reads 92.66% where it used to read 97.26%. No tests were lost (163 pass, up from 143 collected) and statements/lines went up to 100%. v4's V8 provider remaps through the AST instead of v8-to-istanbul, so it detects branches the old provider missed — the denominator changed, not the testing.

You'll also notice pumpit-error.ts no longer appears in the terminal table. It's still fully measured — it's in coverage-final.json and the HTML report at 100% on every metric. v4's text reporter just omits fully-covered files.

biome 1.9.4 → 2.5.8

Config migrated with biome migrate: organizeImports moved under assist.actions.source, and files.ignore became negated patterns in files.includes. v2 also sorts named imports differently, which is the import churn across three files — biome check --write autofixed it.

lefthook 1.8.1 → 2.1.10

No config changes needed; lefthook validate passes and the pre-commit hook ran clean on this commit.

Not upgraded

@types/node stays on ^24 on purpose — it should track the Node version CI actually runs rather than drift ahead to 26.

Verification

pnpm check:ci, pnpm type:check, pnpm test (18 files, 163 tests) and pnpm build all pass locally. Build output is unchanged in size, and no changeset is included since nothing here affects the published package.

🤖 Generated with Claude Code