chore(deps-dev): bump vitest to patched 4.1.11

[dependabot]

Updates Vitest across the workspace from 4.1.5 to 4.1.11 and regenerates the pnpm lockfile against current main.

The originally proposed 4.1.8 release is affected by GHSA-82fw-gwwq-j7x9 (path traversal in @vitest/mocker). Version 4.1.11 is the first patched stable release, so this PR now upgrades both Vitest and its matching internal packages to that version.

Validation: frozen-lockfile installation, lint, typecheck, full test suite, dependency review, and desktop build/packaging checks are required before merge.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[github-actions]

Findings

No issues found.

Summary
Review mode: initial

Routine Dependabot dev-dependency patch bump: vitest ^4.1.5 → ^4.1.8 in apps/desktop/package.json:65, packages/artifacts/package.json:21, packages/core/package.json:25, packages/exporters/package.json:30, packages/i18n/package.json:31, packages/providers/package.json:22, packages/runtime/package.json:25, packages/shared/package.json:25, packages/templates/package.json:22, and packages/ui/package.json:37, with the matching pnpm-lock.yaml refresh.

Checks against project constraints:

• License: vitest is MIT — compatible with the MIT-only shipped/runtime dependency rule (CLAUDE.md Hard Constraint 4). It is a dev dependency, not bundled or linked into the shipped app, so it does not count against the ≤ 30 prod dependency budget or affect installer contents.
• Prod dependency budget: unaffected (no dependencies blocks changed).
• Lockfile consistency: all workspaces moved together, and the @vitest/* peer versions in the lockfile were bumped consistently to 4.1.8 (@vitest/expect, @vitest/mocker, @vitest/runner, @vitest/snapshot, @vitest/spy, @vitest/utils). The transitive additions (@babel/*@7.29.7, @types/estree@1.0.9, es-module-lexer@2.1.0, obug@2.1.2, tinyexec@1.2.4, tinyglobby@0.2.17) are ordinary resolution drift and are not bundled into the product.
• Node compatibility: vitest@4.1.8 declares engines.node of ^20.0.0 || ^22.0.0 || >=24.0.0, compatible with the repo's pinned Node 22.
• No release/distribution impact: no .github/workflows/**, packaging/**, or release manifests are touched, so there is no checksum/install-channel risk.
• Changeset: not required — a dev-only test-runner bump is not user-visible.

Residual risk: the 4.1.5 → 4.1.8 range includes a deprecation of the sequential test API/options (vitest-dev/vitest#10196). This is a deprecation, not a removal, so it cannot break the build, but any test using test.sequential or sequence.sequential may begin emitting warnings. I could not confirm whether this repo uses that API from the public diff alone; if it does, cleaning it up is optional follow-up, not a blocker.

This PR is ready to merge.

Testing
Not run (automation). CI (pnpm lint && pnpm typecheck && pnpm test) will exercise the bumped runner across all workspaces.

Open-CoDesign Bot

[github-actions]

Findings

No issues found.

Summary
Review mode: follow-up after new commits

This revision retargets the Dependabot bump from ^4.1.8 to ^4.1.11 and touches only the ten workspaces that declare vitest plus the regenerated pnpm-lock.yaml (changedFiles: 11): apps/desktop/package.json:65, packages/artifacts/package.json:21, packages/core/package.json:25, packages/exporters/package.json:30, packages/i18n/package.json:31, packages/providers/package.json:22, packages/runtime/package.json:25, packages/shared/package.json:25, packages/templates/package.json:22, packages/ui/package.json:37.

Verified against the diff and lockfile:

• Every importer moved together: specifier: ^4.1.11 with version: 4.1.11, and @vitest/expect|mocker|pretty-format|runner|snapshot|spy|utils all move to 4.1.11 in step with vitest; no 4.1.5 snapshots are left behind. The vitest@4.1.11 peer block requires @vitest/*: 4.1.11, so the workspace-wide lockstep bump is the correct shape.
• Node compatibility: vitest@4.1.11 declares engines.node ^20.0.0 || ^22.0.0 || >=24.0.0, compatible with the repo's Node 22 pin.
• Constraint checks: vitest is MIT and stays a devDependency in every workspace, so it is not bundled/linked into shipped code and does not count toward the ≤ 30 prod-dependency budget; no dependencies blocks, provider wiring, UI/token values, or packaging/**/.github/workflows/** release paths are touched. No changeset is required — a test-runner bump is not user-visible.

Residual observations (not merge blockers):

• Advisory claim is unverifiable from the public checkout. The PR body states GHSA-82fw-gwwq-j7x9 (path traversal in @vitest/mocker) affects 4.1.8 and that 4.1.11 is the first patched stable release. I could not confirm the advisory or the patched-version boundary from repository files during this run, so that rationale is taken on trust; a frozen-lockfile install plus the full pnpm test run is what actually proves the resolution.
• Lockfile drift is wider than the vitest bump. Most of it is vitest 4.1.11's own dependency set (es-module-lexer@2.3.2, expect-type@1.4.0, obug@2.2.1, picomatch@4.0.7, std-env@4.2.0, tinyexec@1.3.1, tinyglobby@0.2.17, tinyrainbow@3.1.1), but the regeneration also re-resolved in-range packages that reach the desktop renderer build toolchain: lightningcss@1.32.0 → 1.33.0, postcss@8.5.15 → 8.5.28, @babel/runtime|codes-frame|helper-validator-identifier@7.29.7, @napi-rs/wasm-runtime@1.2.4. This is consistent with the earlier "ordinary resolution drift" assessment and none of it is bundled into the product, but it does mean the PR is not a pure test-runner bump — the desktop build/packaging check named in the PR body is the right gate for the lightningcss/postcss movement.
• The comparison against the previous review (4582e85e → d9d8849d) also shows main-side changes that are not part of this PR's diff (Atlas Cloud provider wiring, CodeQL action pin bumps, root tsx ^4.22.3); they were not reviewed here as PR changes.
• The prior review's residual note about the sequential test API/options deprecation was not re-checked against the repo's test files in this run. If any test still uses test.sequential or sequence.sequential, the worst case is a console warning, not a failure.

Ready to merge once CI is green.

Testing
Not run (automation). Suggested gate: pnpm install --frozen-lockfile && pnpm lint && pnpm typecheck && pnpm test, plus the desktop build:dir/packaging job given the lightningcss/postcss drift.

Open-CoDesign Bot

[github-actions]

Findings

• [Minor] PR now bundles unreported production-dependency bumps, contradicting its title/body — the PR is titled chore(deps-dev): bump vitest to patched 4.1.11 and the body only describes Vitest + a lockfile regeneration, but this head also raises shipped dependencies that are not dev-only: undici apps/desktop/package.json:28 (^7.25.0 → ^7.29.0), vite apps/desktop/package.json:64 (^7.3.2 → ^7.3.5), and yaml packages/shared/package.json:20 (exact pin 2.8.4 → 2.9.0). undici and yaml live in dependencies (bundled/runtime), not devDependencies, so this is not a pure test-runner change. Manifest specifier edits cannot come from "regenerates the pnpm lockfile against current main" — a lockfile refresh alone does not change package.json ranges — so these are deliberate upgrades that the body does not account for. yaml also moved from an exact pin to a new exact pin, i.e. a forced minor upgrade of a runtime parser used by packages/shared, with no stated rationale or linked advisory.
  Suggested fix: either scope the PR back to Vitest-only (restore undici, vite, and yaml specifiers) or update the title/body to list each bumped package, note that undici/yaml are shipped runtime dependencies, and give the reason (e.g. a specific advisory) for each. If yaml/undici are security-driven, splitting them into their own PR and linking the advisory keeps the Vitest rationale clean.

Questions

• Are the undici/vite/yaml bumps intentional and tied to a specific advisory, or incidental fallout from resolving the lockfile during the Vitest retarget? That determines whether the fix is "drop the edits" or "document the edits."

Summary
Review mode: follow-up after new commits

Since the last reviewed commit (d9d8849d), the Vitest retarget to ^4.1.11 is unchanged and still consistent — every importer pins specifier: ^4.1.11 with version: 4.1.11, and @vitest/expect|mocker|pretty-format|runner|snapshot|spy|utils all move to 4.1.11 in lockstep, which matches the vitest@4.1.11 peer block. vitest remains MIT and stays a devDependency, so the ≤30 prod-dependency budget and permissive-license constraints are unaffected.

The new commits add three manifest changes outside Vitest: undici → ^7.29.0, vite → ^7.3.5, and yaml → 2.9.0. vite is a build-tooling dep (and now pulls esbuild@0.28.0 instead of 0.27.7), while undici and yaml are shipped runtime dependencies of apps/desktop and packages/shared. Because the PR body does not mention any of them, a reviewer cannot tell whether they are intentional and tested; this is the one item to resolve before merge.

Residual observations (not merge blockers):

• The GHSA-82fw-gwwq-j7x9 claim (4.1.8 affected, 4.1.11 first patched stable) still cannot be confirmed from the public checkout during this run, so it is taken on trust; a frozen-lockfile install plus the full pnpm test run is what actually demonstrates the resolution.
• lightningcss@1.33.0 / postcss@8.5.28 drift was already present at the previously reviewed commit and is unchanged here, so it is not re-raised; the desktop build/packaging gate named in the body remains the right check for it.

Testing
Not run (automation). Suggested gate: pnpm install --frozen-lockfile && pnpm lint && pnpm typecheck && pnpm test, plus the desktop build:dir/packaging job given the vite/esbuild movement and the undici/yaml runtime bumps.

Open-CoDesign Bot

[github-actions]

Findings

• [Minor] The regenerated lockfile is not a Vitest-only delta and moves some transitive pins backwards relative to the diff base — pnpm-lock.yaml resolves rollup 4.62.0 → 4.60.2 and adds nanoid@3.3.12 (used by postcss@8.5.15, previously nanoid@3.3.19), while it pushes vite 7.3.5 → 7.3.6 and esbuild 0.27.7 → 0.28.0 in the other direction. The PR body states the lockfile was "regenerated against current main", but base main carries rollup@4.62.0 and this head would move it down; because the branch changed those lines, merging can put the lower pin on main. These are build-time-only packages (rollup/postcss/nanoid are not shipped runtime deps), so the user-facing risk is low, but the resolution drift is unrelated to the stated scope and a downgrade of a build tool is the kind of thing a maintainer wants to be intentional rather than incidental.
  Suggested fix / next action: rebase on current main and regenerate so only the Vitest subtree changes, e.g. git fetch origin main && git rebase origin/main && pnpm install --lockfile-only, then commit the resulting lockfile. If the rollup/nanoid/esbuild moves are deliberate, list them in the PR body with the reason (a fresh resolution against main's existing lockfile should preserve main's pins for unchanged specifiers).

Questions

• Are the rollup 4.62.0 → 4.60.2, nanoid 3.3.19 → 3.3.12, and esbuild 0.27.7 → 0.28.0 lockfile moves intentional, or a side effect of resolving the lockfile from a different starting state than current main? That determines whether the fix is "regenerate after rebase" or "document in the body".

Summary
Review mode: follow-up after new commits

The prior [Minor] finding is resolved. The earlier head raised shipped-dependency specifiers in apps/desktop/package.json (undici, vite) and packages/shared/package.json (yaml); the current diff only touches vitest in every manifest (apps/desktop/package.json:65, packages/artifacts/package.json:21, packages/core/package.json:25, packages/exporters/package.json:30, packages/i18n/package.json:31, packages/providers/package.json:22, packages/runtime/package.json:25, packages/shared/package.json:25, packages/templates/package.json:22, packages/ui/package.json:37), and undici ^7.29.0 / vite ^7.3.5 / yaml 2.9.0 now come from main rather than this branch.

The Vitest retarget itself is consistent: all ten importers pin specifier: ^4.1.11 with version: 4.1.11, and @vitest/expect|mocker|pretty-format|runner|snapshot|spy|utils all move to 4.1.11 in lockstep, matching the vitest@4.1.11 peer block. vitest stays a devDependency and MIT, and satisfies the repo's engines.node >= 22 (package.json), so the ≤30 prod-dependency budget and permissive-license constraints are unaffected. No release/distribution or .github/** files are touched.

Context note: the compare window also contains main-side content (.changeset/requesty-proxy-preset.md, packages/shared/src/proxy-presets.ts, packages/shared/src/proxy-presets.test.ts). Those files are not in this PR's 11-file diff and should not be attributed to the Vitest bump.

Residual observations (not merge blockers):

• The GHSA-82fw-gwwq-j7x9 claim (4.1.8 affected, 4.1.11 first patched stable) still cannot be confirmed from the public checkout during this run, so it is taken on trust; the frozen-lockfile install plus the full test run is what actually demonstrates the resolution.
• lightningcss@1.33.0 / postcss@8.5.28 drift and the undici 7.29.0 → 7.29.1 / vite 7.3.5 → 7.3.6 patch moves were already present before this head and are unchanged in kind; the desktop build/packaging gate named in the body remains the right check for them.

Testing
Not run (automation). Suggested gate: pnpm install --frozen-lockfile && pnpm lint && pnpm typecheck && pnpm test, plus the desktop build:dir / packaging job given the vite/esbuild movement in the regenerated lockfile.

Open-CoDesign Bot

[github-actions]

Findings

No Blocker / Major / Minor findings in the current head (e288c1682401492f3684b18273980b4b21c5cc8e).

Summary

Review mode: follow-up after new commits

The prior [Minor] lockfile-drift finding is resolved. The new commits re-align the regenerated lockfile with the diff base, so the PR is now a Vitest-scoped delta:

• rollup is back at 4.62.0 (pnpm-lock.yaml, '@rollup/rollup-*' entries), matching the base rather than the earlier 4.60.2 downgrade path.
• The undici and vite importer resolutions in this head are 7.29.0 and 7.3.5 (pnpm-lock.yaml, apps/desktop importer), which is the same state as the pre-bump lockfile excerpt where vitest is still ^4.1.5 — i.e. no shipped-dependency version movement relative to base.
• No nanoid / postcss / esbuild resolution drift appears in the head-vs-base pnpm-lock.yaml diff; the remaining package-block churn is Vitest's own subtree (@vitest/* → 4.1.11, es-module-lexer, expect-type, obug, std-env, tinyexec, tinyglobby, tinyrainbow).

Scope and consistency checks:

• All ten manifests bump only vitest: apps/desktop/package.json:65, packages/artifacts/package.json:21, packages/core/package.json:25, packages/exporters/package.json:30, packages/i18n/package.json:31, packages/providers/package.json:22, packages/runtime/package.json:25, packages/shared/package.json:25, packages/templates/package.json:22, packages/ui/package.json:37.
• Each importer pins specifier: ^4.1.11 with version: 4.1.11, and @vitest/expect|mocker|pretty-format|runner|snapshot|spy|utils all move in lockstep with the vitest@4.1.11 peer block, so the tree is internally consistent.
• vitest remains a devDependency (MIT), so the ≤30 prod-dependency budget, the permissive-license constraint, and the no-direct-provider-SDK rule are unaffected. No .github/**, release, packaging, or distribution files are touched, and no changeset is required for a dev-tooling-only bump.
• The only non-Vitest line inside the diff is the fdir/picomatch peer resolution inside the vite@6.4.2 snapshot (4.0.4 → 4.0.7), which is a direct consequence of deduping tinyglobby and is an upgrade, not a downgrade.

Residual observations (not merge blockers):

• The GHSA-82fw-gwwq-j7x9 claim (4.1.8 affected, 4.1.11 the first patched stable) could not be verified from the public checkout during this run; it is taken on trust. The frozen-lockfile install plus the full suite is what actually demonstrates the resolution.
• As with the previous head, the desktop build:dir / packaging gate is the right check if anything in the regenerated tree shifts Vite/esbuild behavior; nothing in the diff suggests it will.

Testing

Not run (automation). Suggested gate: pnpm install --frozen-lockfile && pnpm lint && pnpm typecheck && pnpm test, plus the desktop build:dir job.

Open-CoDesign Bot