[ernst-dev]

Updates vitest and the vite copy it uses to patched releases (lockfile only) to resolve 7 open security alerts. The other 2 open alerts are covered elsewhere or have no patched release (see "Not resolved").

Merging this PR is expected to resolve 7 of this repository's 9 open security alerts. The other 2 are listed under "Not resolved".

Alerts addressed

• GHSA-xp26-3454-mjgp: @vitest/mocker, medium, 4.1.11 -> 4.1.12
• GHSA-698v-4r3x-3vcv: vite, medium, 8.3.0 -> 8.3.5
• GHSA-587h-7wmj-h5pm: vite, high, 8.3.0 -> 8.3.5
• GHSA-r825-w8mm-5pxw: vite, medium, 8.3.0 -> 8.3.5
• GHSA-vfpm-58rq-9qcg: vite, medium, 8.3.0 -> 8.3.5
• GHSA-9jrq-w75r-8gcw: vite, low, 8.3.0 -> 8.3.5
• GHSA-rq7h-c2jc-7f22: vite, medium, 8.3.0 -> 8.3.5

How it was fixed

In this lockfile vite and @vitest/mocker are installed inside vitest, so neither can be updated on its own. vitest is already a direct dev dependency, so vitest and @vitest/coverage-v8 and the other @vitest/* packages released with it were moved from 4.1.11 to 4.1.12 (within the existing ^4.1.11 ranges), which brings the nested vite (8.3.0 -> 8.3.5) and @vitest/mocker (4.1.11 -> 4.1.12) with them. vite also moves the build packages it requires: rolldown (1.2.8 -> 1.2.16) and its platform bindings, @oxc-project/types, postcss, nanoid and source-map-js. package.json is unchanged, and every changed entry is marked dev.

Not resolved

• GHSA-q2hr-2g5m-vwhr: brace-expansion, medium. Already addressed by the open Dependabot PR chore: Bump brace-expansion #134, which updates brace-expansion 1.1.18 -> 1.1.21. It is left out of this PR so that the alert has a single fix. That PR is currently mergeable with passing checks.
• GHSA-vfj7-8cjw-p6xm: braces, high. No patched release has been published (the latest braces release, 3.0.3, is within the vulnerable range), so there is nothing to update to.

Why one pull request

The open alerts were grouped into a single PR to avoid a large number of separate dependency updates.

Dependabot PRs left open

• chore: Bump brace-expansion #134: Bump brace-expansion (covers alert feat: Add helper to write documentation files #67; mergeable with passing checks)

Verification

Run locally on this commit with Node 20, the version CI uses: npm run build passes and npm test passes (31 test files, 140 tests).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.43%. Comparing base (d1883ec) to head (ce4d410).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #135   +/-   ##
=======================================
  Coverage   94.43%   94.43%           
=======================================
  Files          14       14           
  Lines         683      683           
  Branches      177      177           
=======================================
  Hits          645      645           
  Misses         38       38           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.