Consolidation: Dependabot PRs #3304 and #3307 conflict on the pkgs/pkarr-worker vitest line — land one coherent set

Filed by the pr-diff-review job (2026-11-03 21:24 CST run, batch PRs #3280–#3309) under the PR-consolidation rule: two open PRs overlap on the same files with incompatible outcomes and should be resolved as a single change.

The overlap

Both PRs touch exactly the same two files — pkgs/pkarr-worker/package.json and pkgs/pkarr-worker/package-lock.json — and both move the vitest devDependency off ^3.2.4, in incompatible directions:

• PR chore(deps): bump @vitest/mocker and vitest in /pkgs/pkarr-worker #3304 — chore(deps): bump @vitest/mocker and vitest in /pkgs/pkarr-worker (commit e54a9a6a5): vitest ^3.2.4 → ^5.0.5, driven by @vitest/mocker 3.2.7 → 5.0.5. Leaves @cloudflare/vitest-pool-workers at ^0.9.13.
• PR build(deps): bump tinypool, @cloudflare/vitest-pool-workers and vitest in /pkgs/pkarr-worker #3307 — build(deps): bump tinypool, @cloudflare/vitest-pool-workers and vitest in /pkgs/pkarr-worker (commit 1234ebdb1): @cloudflare/vitest-pool-workers ^0.9.13 → ^0.23.0 and vitest ^3.2.4 → ^4.1.12. Its own diff shows pool-workers 0.23.0's peerDependencies require vitest ^4.1.0 (and @vitest/runner/@vitest/snapshot ^4.1.0).

So PR #3304's vitest 5 line satisfies neither PR #3307's pool-workers peer range (^4.1.0) nor the pool-workers version currently on main (0.9.x, peer range 2.0.x - 3.2.x per PR #3307's diff). The two PRs cannot both land, and landing either one alone strands the other as a conflicting re-do of the same dependency bump.

Current state (verified fresh, 2026-11-03 ~21:55 CST)

• Current main is a4c2f187905644f72708d237812ec6fcd1173e4a; pkgs/pkarr-worker/package.json on main already carries vitest ^4.0.0 with @cloudflare/vitest-pool-workers ^0.9.13 — main has already moved to the vitest 4 line, which is PR build(deps): bump tinypool, @cloudflare/vitest-pool-workers and vitest in /pkgs/pkarr-worker #3307's direction, not PR chore(deps): bump @vitest/mocker and vitest in /pkgs/pkarr-worker #3304's.
• PR chore(deps): bump @vitest/mocker and vitest in /pkgs/pkarr-worker #3304: OPEN, mergeable=CONFLICTING, mergeStateStatus=DIRTY (via gh pr view), untouched since 2026-11-01T04:22:12Z.
• PR build(deps): bump tinypool, @cloudflare/vitest-pool-workers and vitest in /pkgs/pkarr-worker #3307: OPEN, mergeable=MERGEABLE, mergeStateStatus=CLEAN, last updated 2026-11-02T16:07:35Z.
• Dedupe: searched open issues for pkarr-worker vitest and for 3304 OR 3307 — no existing issue tracks this pair. (The generic Dependency Dashboard, issue Dependency Dashboard #24, lists Dependabot PRs but does not disposition this conflict.)

Why it matters

Two stale, mutually conflicting dependency PRs on the same package invite an accidental merge of the wrong one: PR #3304 merged as-is would put vitest 5 in place while pool-workers stays on a line whose peer range excludes it, breaking the pkarr-worker test setup; PR #3307 left open will keep conflicting with every future lockfile change in this package. One coherent bump (vitest + pool-workers versions whose peer ranges agree, regenerated lockfile) closes both.

Acceptance criteria

• Exactly one PR lands for the pkgs/pkarr-worker vitest/pool-workers bump, with a package.json/package-lock.json pair whose versions are peer-compatible (pool-workers' declared vitest peer range includes the pinned vitest version) and the pkarr-worker test suite passing on it.
• The other PR is closed as superseded (not merged) with a dedupe/salvage note per the agent lifecycle protocol §8: anything unique in the losing diff is named on the surviving PR, or explicitly recorded as "nothing unique".
• This issue is closed once both PRs are dispositioned.