An open-ended security override handed vitest a Vite major it cannot run

An override rewrites the graph after the dependents have declared what they accept, which is why vitest 3.2.7's `^5 || ^6 || ^7.0.0-0` never got the chance to reject the candidate that broke it ^[6]. That published range was the working guard, and `overrides` is the mechanism that tells the resolver to ignore it ^[7]. The dev.to write-up is straight about the tradeoff: opting out was deliberate, for a real batch of dev-only advisories, and the comment left in the file recorded why the floor existed and nothing about a ceiling, because at the time nothing above existed ^[3][12].

The reporting was honest at every step. Vite 8 moved its transform pipeline to rolldown/oxc, and the module-runner contract changed with it ^[8]. Vitest still loaded all 71 files without throwing, evaluated them, and got no registered suites back, which to a collector is indistinguishable from a file containing no `describe` ^[9]. So it printed the only true statement available, once per file, and that statement pointed at the wrong layer ^[1]. The author read it as a bad include glob, a wrong `projects` entry, an environment mismatch ^[11]. The one piece of version identity in the output was a deprecation notice about a different option: `The esbuild option is deprecated, please use oxc instead` ^[10].

Count the headroom the range granted. The floor was 6.4.3 and the resolution was 8.1.4, which is two major boundaries above a constraint written to move one patch level ^[1]. Adding `<8` put vite at 7.3.6, inside the `^7` vitest already declares ^[2]. The resolver landed where the dependent's own range pointed, which is the whole argument for the cap.

That cap was free for a checkable reason rather than a general one. `pnpm why vite` returned vitest, vite-node and @vitest/mocker, and nothing in either workspace consumes vite at build time or ships it to production ^[14]. A ceiling that costs nothing is rare enough to verify rather than assume. If that query returns the bundler or the framework, the cap stops being free and becomes a decision about build behaviour ^[15].

The account never shows a green build. The run exited non-zero the whole time ^[1]. The missing control, then, was a failure signal whose text described a configuration error, and it got triaged as one ^[11]. A floor on collected test count would have named the real condition, and the write-up does not report adding one. The fix on record is the version ceiling, with a note to raise it when vitest supports vite 8 ^[13].

The restored run also priced the outage. Nothing touched during the dead window had regressed ^[17], and the failure the suite did surface was older than the window: `lifecycleColumns()` has no branch for the `deprecated` date, so `events.announced_at` was NULL for every row ever written ^[18]. That column is where the notice period starts, so the amount of warning a vendor actually gave cannot be computed from the stored data ^[19].