Reconcile the lockfile after vitest 5 landed on top of lock file maintenance

[wormeyman]

npm ci in src/vue is currently broken on main:

npm error `npm ci` can only install packages when your package.json and
package-lock.json are in sync.
npm error Missing: tinyexec@1.3.0 from lock file

What happened

The cause is merge order, not either change on its own.

1. Lock file maintenance #109 (lock file maintenance) re-resolved the whole lockfile while vitest was still 4.1.11, and hoisted tinyexec to the top level at 1.3.1, because 4.1.11 accepted that.
2. Update dependency vitest to v5 #107 (vitest 5) was branched before Lock file maintenance #109 and merged after it. Its own lockfile hunks were resolved against the older tree.

Git merged both without a textual conflict, because they touch different regions of the file. The result was still wrong: vitest 5.0.0 wants tinyexec 1.3.0, so package-lock.json named a dependency it no longer contained.

The fix

One npm install. tinyexec moves from a hoisted node_modules/tinyexec at 1.3.1 to a nested node_modules/vitest/node_modules/tinyexec at 1.3.0. Nothing else in the tree changes - vitest is now its only consumer.

Why CI did not catch it

ci.yml's "Build front-end" job runs npm install, not npm ci. npm install quietly repairs an out-of-sync lockfile in the runner and carries on, so every check passed on a tree that no clean install could reproduce. The committed lockfile stayed broken for anyone who uses npm ci - which includes any fresh clone following the documented setup.

Switching that step to npm ci would turn this class of problem into a failing check instead of a silent one. That is a separate change and is not included here.

Verification

On this branch:

• npm ci - exits 0 (it exits 1 on main)
• npm audit - 0 vulnerabilities
• npm run build - passes
• npm run test - 51 of 51 passing, confirmed running on vitest 5.0.0
• npx eslint . - exit 0
• committed src/vue/src/lib/FactorioToolsApi.ts does not drift

🤖 Generated with Claude Code

https://claude.ai/code/session_01DAVZSEbjCkr9sbumdMPKy2

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• src/vue/package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 78feb0fe-c621-44d2-9c14-6ebec38b01fe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}