Bump vitest to 4.1.11 past the mocker path traversal advisory

Why: GHSA-82fw-gwwq-j7x9 (path traversal / arbitrary file read via @vitest/mocker redirect mock) affects vitest 2.1.0-4.1.10; the locked 3.x toolchain was inside the range. Dev-only dependency, but the fix is a routine bump — follow-up to the 2026-09-30 dependency CVE inventory.
Evidence: vitest and @vitest/mocker now at 4.1.11 (first fixed release); npm audit reports 0 vulnerabilities; npx vitest run 33/33 green on vitest 4.
Impact: package.json/package-lock.json devDependency bump only; no production dependency or source change.
Refs: Dev-side task fix/dep-vuln-bumps (gitlink pin follows after combined verification)

This commit is contained in:

weichen

2026-09-30 16:47:34 +00:00

parent b067b57975

commit a61bd70399

2 changed files with 128 additions and 206 deletions

									
										package.json
									
		+1
		-1
	
												View File
												
				@@ -20,6 +20,6 @@

				    "@vitejs/plugin-react": "^4.3.4",

				    "typescript": "^5.7.3",

				    "vite": "^6.0.11",

				    "vitest": "^3.0.5"

				    "vitest": "^4.1.11"

				  }

				}