chore(deps-dev): upgrade vitest, coverage-v8 and jsdom; drop EOL Node versions

.github/dependabot.yml

@@ -51,6 +51,15 @@ updates:
     # and with @testing-library/react's own peer range — so it should be changed
     # on purpose, not carried in on a weekly bump. Minor/patch still flow.
     ignore:
+      # typescript majors are blocked upstream, not by choice. tsup bundles
+      # rollup-plugin-dts pinned against typescript 5.x, and TS 7 removed the
+      # `useCaseSensitiveFileNames` API it calls, so `npm run build` dies before
+      # emitting declarations. Nothing in this repo can fix that. Remove this
+      # entry once tsup ships a TS 7-compatible rollup-plugin-dts, then upgrade
+      # the two together. Minor/patch still flow.
+      - dependency-name: "typescript"
+        update-types:
+          - "version-update:semver-major"
       - dependency-name: "react"
         update-types:
           - "version-update:semver-major"
@@ -61,6 +70,15 @@ updates:
         update-types:
           - "version-update:semver-major"
     groups:
+      # vitest and @vitest/coverage-v8 are lockstep-versioned: coverage-v8@4.x
+      # peer-requires the exact matching vitest. Ungrouped majors raised them as
+      # two separate PRs, and each failed `npm ci` on the peer conflict because
+      # neither could land without the other. This group covers ALL update types
+      # for that family, majors included, so they always move as one.
+      vitest:
+        patterns:
+          - "vitest"
+          - "@vitest/*"
       npm-minor-patch:
         patterns:
           - "*"

.github/workflows/ci.yml

@@ -15,14 +15,6 @@ jobs:
     uses: ./.github/workflows/format.yml
     secrets: inherit
 
-  test-node18:
-    needs: format
-    uses: ./.github/workflows/ci-node18.yml
-
-  test-node20:
-    needs: format
-    uses: ./.github/workflows/ci-node20.yml
-
   test-node22:
     needs: format
     uses: ./.github/workflows/ci-node22.yml

CLAUDE.md

@@ -21,10 +21,12 @@ Releases are done via `npm run release:patch|minor|major` which creates a `relea
 
 ## Dependency Updates
 
-Dependabot runs weekly (`.github/dependabot.yml`). Minor/patch npm bumps arrive as one grouped PR; majors get individual PRs. Two things to know:
+Dependabot runs weekly (`.github/dependabot.yml`). Minor/patch npm bumps arrive as one grouped PR; majors get individual PRs, except where noted below.
 
 - **React majors are ignored on purpose.** Which React line the tests run against is a support-matrix decision tied to the `peerDependencies: react >=16.8.0` claim, so it gets changed deliberately rather than by a weekly bump.
-- **oxlint does not run on Node 18.** Its native bindings require Node `^20.19.0 || >=22.12.0`, so npm skips installing them and oxlint fails with `Cannot find module './oxlint.linux-x64-gnu.node'`. `ci-node18.yml` therefore has no lint step — lint runs on the Node 20 and 22 jobs only. Do not "fix" this by pinning oxlint back; linting the same source once is enough, and the Node 18 job exists to prove the library runs there, not to re-lint it.
+- **TypeScript majors are ignored because they are blocked upstream.** tsup bundles `rollup-plugin-dts` pinned against TypeScript 5.x, and TS 7 removed the `useCaseSensitiveFileNames` API it calls, so `npm run build` fails before emitting declarations. Remove the ignore once tsup ships a TS 7-compatible `rollup-plugin-dts`.
+- **vitest and `@vitest/coverage-v8` are grouped, majors included.** `coverage-v8` peer-requires the exact matching vitest version, so raised separately neither can pass `npm ci`.
+- **The test toolchain sets the Node floor, not the library.** jsdom requires Node 22+ and vitest requires 20+, so CI tests 22/24/26. `engines.node` is `>=20.0.0`: the published bundle has no Node-version-specific code, but nothing below 22 is exercised. Raise the floor rather than pinning the toolchain back if this ever conflicts.
 
 ## Test Setup