fix(deps): bump vitest browser packages and refresh lockfile

[rqbazan]

Summary

Clears every pnpm audit finding (3 critical, 12 high, 4 moderate). All of them are in dev tooling: the published package has no runtime dependencies.

Package	Severity	Runtime/dev	Path	Fix
@vitest/browser 4.1.9	critical	dev	direct devDependency	4.1.12
tinypool 2.1.0 (2 advisories)	critical	dev	@rrlab/oxc-plugin > oxfmt 0.51.0 (auto-installed peer) > tinypool	oxfmt ^0.73.0 as an explicit devDependency, which brings tinypool 2.2.0
brace-expansion 5.0.6 (6 advisories)	high (5), moderate (1)	dev	@rrlab/cli > glob > minimatch > brace-expansion	lockfile refresh to 5.0.12
js-yaml 4.2.0 (3 advisories)	high	dev	@rrlab/biome-plugin > @variablelab/clibuddy > @pnpm/fs.find-packages > ... > write-yaml-file > js-yaml	lockfile refresh to 4.3.2
nanoid 3.3.15 (2 advisories)	high	dev	@vitest/browser > @vitest/mocker > vite > postcss > nanoid	lockfile refresh to 3.3.20
postcss 8.5.15 (2 advisories)	high (1), moderate (1)	dev	@vitest/browser > @vitest/mocker > vite > postcss	lockfile refresh to 8.5.30
source-map-js 1.2.1	high	dev	@rrlab/cli > magicast > source-map-js	lockfile refresh to 1.2.2
vitest 4.1.9	moderate	dev	direct devDependency (^4.0.0)	4.1.12 in the lockfile, range unchanged
@vitest/mocker 4.1.9	moderate	dev	@vitest/browser > @vitest/mocker	4.1.12

What changed in package.json (exact pins stay exact, ranges stay ranges):

 "devDependencies": {
-  "@vitest/browser": "4.1.9",
-  "@vitest/browser-playwright": "4.1.9",
+  "@vitest/browser": "4.1.12",
+  "@vitest/browser-playwright": "4.1.12",
   "lefthook": "^2.1.9",
+  "oxfmt": "^0.73.0",
   "oxlint": "^1.0.0",
   ...
   "vitest": "^4.0.0",

• oxfmt was only an auto-installed peer of @rrlab/oxc-plugin (>=0.30.0), so pnpm update oxfmt left it at 0.51.0. Declaring it directly is what moves it. This repo formats with Biome and runs the oxc plugin only for typecheck, so oxfmt never touches the sources and there is no format diff.
• The transitive fixes are a targeted pnpm update <pkg> --depth Infinity; the lockfile was not regenerated. As a side effect pnpm also refreshed vite's own lightningcss (1.32.0 -> 1.33.0) and rolldown (1.1.3 -> 1.1.5, used only by vite). tsdown still builds with rolldown 1.1.3.
• Every new version is older than 24 hours (minimumReleaseAge: 1440 was not bypassed). The newest, the 4.1.12 vitest packages, came out on 2026-10-15.
• Overrides: none. Changeset: none. No published dependencies or peerDependencies change, and dist is built by the same tsdown 0.22.3 / rolldown 1.1.3.

Maintenance files (second commit):

.github/
├── dependabot.yml                 # security updates only for npm and github-actions ("/"), grouped, 1-day cooldown
├── workflows/
│   └── dependency-audit.yml       # weekly `pnpm audit` of pnpm-lock.yaml; opens, updates or closes a `dependency-audit` issue
└── zizmor.yml                     # + dependabot-cooldown: days: 1 (matches minimumReleaseAge)

The audit runs on a weekly schedule, not as a pull request check, so a new advisory never blocks unrelated PRs. The README has no CI or security section, so it is unchanged.

Note: an org admin has to enable the dependency graph and Dependabot security updates for this repo separately. Until then dependabot.yml opens no security PRs, and the weekly audit is the only signal.

Evidence

• Before: pnpm audit on main: 19 vulnerabilities found, Severity: 4 moderate | 12 high | 3 critical, exit 1.
  After: pnpm audit: No known vulnerabilities found, exit 0.
• The CI steps pass locally: pnpm install --frozen-lockfile, pnpm rr check (Biome made no fixes, oxlint typecheck is clean), pnpm exec playwright install chromium, pnpm test (Vitest 4.1.12 browser mode: 2 files, 25 tests passed), pnpm rr pack (tsdown 0.22.3, rolldown 1.1.3).
• pipx run --spec zizmor==1.30.1 zizmor --offline .: No findings to report.
• Dry run of the audit step (RUNNER_TEMP=$(mktemp -d) GITHUB_OUTPUT=/dev/stdout bash -e -o pipefail -c '<step>') prints found=false; the same pnpm audit exits 1 on main's lockfile.
• pnpm why oxfmt tinypool: oxfmt@0.73.0, tinypool@2.2.0, one version each.

Merge Danger

Door: two-way

Only dev tooling, the lockfile and CI config change. A revert restores the previous state.

Blast Radius: dev-tooling

Tests, type checks and the build tooling move to patched versions. Consumers of @variablelab/theme-toggle see no change. The new workflow only runs on its weekly schedule or when dispatched by hand.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TkHa1BVnm277qEiEuipG6n

[changeset-bot]

⚠️ No Changeset found

Latest commit: b5c23ba

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vland-bot]

Preview release

Latest commit: b5c23ba

Some packages have been released:

Package	Version	Install
@variablelab/theme-toggle	2.0.2-git-b5c23ba.0	@variablelab/theme-toggle@2.0.2-git-b5c23ba.0

Note

Use the PR number as tag to install any package. For instance:

pnpm add @variablelab/theme-toggle@pr-19