[tonyalaribe]

• dependabot: vite-ecosystem's vite* pattern also matched vitest and vitest-canvas-mock, and dependabot assigns each package to the first group it matches. So vitest went to the vite group and @vitest/browser to the vitest group, and each major bump failed alone on the peer split (chore(deps): bump vitest from 4.1.11 to 5.0.5 in /web-components #723, chore(deps): bump @vitest/browser from 4.1.11 to 5.0.5 in /web-components #727). Patterns are now exact names.
• root jest: removed the jest devDependency and the test script. The root has no jest tests (it was added for a swagger parser that's long gone). npx jest only picked up web-components' vitest files and failed on all 87. The lockfile change only removes jest's 207 packages; no other versions changed.

Verified: npm ci (npm 10), tailwind build, dependabot.yml parses.

🤖 Generated with Claude Code

[monoscope-bot]

Monoscope production impact · Coverage unknown

Project 87576849-4941-49d3-a15d-680fef88a1a8 · reviewed 7a19ab421decaecfa267052ec8cdaacb7efc2e71 · advisory

Evidence window (UTC): 2026-10-19 13:56:21.144204749 UTC → 2026-10-26 13:56:21.144204749 UTC

Coverage: Evidence is capped at 20 service/environment groups, monitors and dashboard queries. Telemetry describes the mapped service, not a proven changed-path or deployed-revision match. Monitor and dashboard references are project-wide; their relationship to the mapped service is unverified. Diff coverage is incomplete: only the first 30 files and 2000 characters per patch are inspected. The model review did not produce verifiable findings; rerun the review.

Review history and settings

[claude]

Small, focused PR. The grouping fix and the jest removal both look correct. Nothing blocking.

Findings

• package-lock.json:2: "name" changed from m3-deps to m3-chore. package.json has no name, so npm takes it from the checkout directory. This is churn from your local folder name and unrelated to the change. Revert that line, or add an explicit "name" to package.json so it stops flip-flopping between machines.
• .github/dependabot.yml: "vite-plugin-*" and "vitest-*" are still globs. vitest-* is fine because it only matches vitest-canvas-mock and similar, but make sure no vite-plugin-* package is really a vitest plugin. Dependabot also gives each package to the first group that matches, so group order still decides any overlap. If vite-plugin-* only matches what you want, keep it. If you have just one or two such deps, exact names would be tighter.
• The lockfile diff drops dev: true from some packages, for example @jridgewell/*. That is expected, since they are now reached through the non-dev workbox-cli/@opentelemetry chains. It is a reclassification, not a version change, so no action is needed.

Other checks

• Test coverage, security and performance: nothing to flag. Removing about 200 packages shrinks the install and the attack surface.
• Confirm that no CI check or Makefile target calls npm test or jest. I grepped package.json, Makefile and ci/checks.tsv and found no references.