Update dependency ava to v8

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
ava (source)	^6.0.0 → ^8.0.0

---

Release Notes

avajs/ava (ava)

v8.0.1

Compare Source

What's Changed

This release officially adds Node.js 26 support, with thanks to @​novemberborn in #​3450.

Per our policy, support for Node.js 25 has been removed.

Full Changelog: avajs/ava@v8.0.0...v8.0.1

v8.0.0

Compare Source

Breaking Changes

AVA now expects Node.js 22.20, 24.12 or newer.

Internally AVA is now fully ESM. This is possible now that Node.js supports loading ES modules using require() calls and simplifies AVA's types and internals.

If you use AVA from a CommonJS project you'll have to update your imports:

-const test = require('ava');
+const {default: test} = require('ava');

We expect an increasing number of projects to be ESM only. As per the above, CommonJS is still supported, but we don't expect cjs extensions to be used. The default file extensions are now js and mjs. Specify extensions: ['cjs', 'js', 'mjs'] for AVA to run test files with the cjs extension.

All test files (and those loaded through AVA's require config) are now loaded via import(). Use customization hooks for transpilation. The object form of the extensions configuration is no longer supported.

If you use AVA with @​ava/typescript you must upgrade that package to v7.

New Features

There's two new test modifiers courtesy of @​sindresorhus: test.skipIf() to skip a test based on a runtime condition. test.runIf() is the inverse: the test only runs when the condition is true.

test.skipIf(process.platform === 'win32')('not on Windows', t => {
	t.pass();
});

test.runIf(process.platform === 'linux')('Linux only', t => {
	t.pass();
});

These work with other modifiers like .serial and .failing:

test.serial.skipIf(process.platform === 'win32')('serial, not on Windows', t => {
	t.pass();
});

test.failing.skipIf(process.platform === 'win32')('expected failure, not on Windows', t => {
	t.fail();
});

Other Changes

• Watch mode now ignores changes to *.tsbuildinfo files
• TAP reporter is more defensive when restoring the original error name, thanks to @​ninper00 in #​3415
• Reported errors when throwsAsync/notThrowsAsync are not awaited have been improved by @​sindresorhus in #​3436

New Contributors

• @​ninper00 made their first contribution in #​3415

Full Changelog: avajs/ava@v7.0.0...v8.0.0

v7.0.0

Compare Source

What's Changed

• Replace strip-ansi with node:util.stripVTControlCharacters by @​fisker in #​3403
• Remove support for Node.js 18 and 23; require 20.19 or newer, 22.20 or newer or 24,12 or newer; update dependencies including transitive glob by @​novemberborn in #​3416

Full Changelog: avajs/ava@v6.4.1...v7.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​ava@​6.4.1 ⏵ 8.0.1	+1

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Potential code anomaly (AI signal): npm cbor2 is 65.0% likely to have a medium risk anomaly Notes: Overall, the codebase appears to be a robust, feature-rich CBOR serialization library with extensive tag support and defensive input handling. There is no concrete evidence of malicious behavior or data exfiltration within the provided fragment. The main operational risk is inherent to any data-serialization component: untrusted inputs can trigger potentially expensive or error-prone constructions (URL/RegExp/Date) if downstream usage is insecure. The code mitigates this with strict validations and explicit error handling. Confidence: 0.65 Severity: 0.52 From: packages/plugin-hardhat/examples/BoxViem/package-lock.json → npm/ava@8.0.1 → npm/cbor2@2.3.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/cbor2@2.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm glob is 68.0% likely to have a medium risk anomaly Notes: The Glob utilities implement a conventional and well-structured filesystem glob-walking mechanism with robust control flow (abort signals, backpressure) and safe output semantics. There is no evidence of malicious behavior, backdoors, or data exfiltration within this fragment. Risks mainly relate to how downstream consumers may handle emitted paths, not to the library itself. Confidence: 0.68 Severity: 0.50 From: packages/plugin-hardhat/examples/BoxViem/package-lock.json → npm/ava@8.0.1 → npm/glob@13.0.6 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/glob@13.0.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 8c3dc100-fc8d-4ba7-8537-79ed3e73bf62

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}