[ernst-dev]

Updates 7 development dependencies to patched releases (lockfile only) to resolve 16 open security alerts.

Merging this PR is expected to resolve 16 of this repository's 17 open security alerts. The other 1 are listed under "Not resolved".

Alerts addressed

• GHSA-xp26-3454-mjgp: @vitest/mocker, medium, 4.1.11 -> 4.1.12
• GHSA-qxg6-89mg-rqv8: @vitest/mocker, medium, 4.1.11 -> 4.1.12
• GHSA-qr28-fpjm-wq7f: decode-uri-component, high, 0.5.0 -> 0.5.1
• GHSA-wjr9-j795-jxcr: fast-uri, medium, 3.1.7 -> 3.1.9
• GHSA-333x-w4r6-6crp: fast-uri, low, 3.1.7 -> 3.1.9
• GHSA-w74x-v6f9-j3xg: fast-uri, medium, 3.1.7 -> 3.1.9
• GHSA-xhq7-xmqj-769h: fast-uri, low, 3.1.7 -> 3.1.9
• GHSA-8r9p-f939-6h3c: follow-redirects, high, 1.16.0 -> 1.16.2
• GHSA-q3jh-wrc6-jgq8: follow-redirects, high, 1.16.0 -> 1.16.2
• GHSA-mrwp-f3q8-3g9p: follow-redirects, high, 1.16.0 -> 1.16.2
• GHSA-68fv-2mgg-jv7q: source-map-js, high, 1.2.1 -> 1.2.2
• GHSA-698v-4r3x-3vcv: vite, medium, 6.4.3 -> 6.4.5
• GHSA-587h-7wmj-h5pm: vite, high, 6.4.3 -> 6.4.5
• GHSA-r825-w8mm-5pxw: vite, medium, 6.4.3 -> 6.4.5
• GHSA-rq7h-c2jc-7f22: vite, medium, 6.4.3 -> 6.4.5
• GHSA-9jrq-w75r-8gcw: vite, low, 6.4.3 -> 6.4.5

How it was fixed

follow-redirects, decode-uri-component, fast-uri and source-map-js are transitive dependencies that npm can update within their existing parent ranges, so each was updated with npm update <package> --package-lock-only. vite is a direct dev dependency and was updated the same way (6.4.3 -> 6.4.5, within the existing ^6.4.1 range). @vitest/mocker is pulled in by vitest, which is already a direct dev dependency, so vitest, @vitest/coverage-v8 and the other @vitest/* packages released with it were moved from 4.1.11 to 4.1.12 (within the existing ^4.1.11 and ^4.1.8 ranges). package.json is unchanged. The diff is limited to 14 entries in package-lock.json, all marked dev.

Not resolved

• GHSA-g3hv-75wg-m249: minimatch, medium. The only patched release is 11.0.1 (a new major version). The vulnerable copies sit on older major lines (3.x, 5.x, 9.x and 10.x) pulled in by different parents (eslint, typescript-eslint, wdio and others), so no parent update reaches the fix. Resolving it would need a package.json overrides entry across multiple major versions, which needs a maintainer decision.

Why one pull request

The open alerts were grouped into a single PR to avoid a large number of separate dependency updates.

Dependabot PRs closed by this change

These PRs update packages that this PR also updates, so they are closed in its favor. Each can be restored by commenting @dependabot reopen on it if this PR fails CI or is abandoned (Dependabot will not recreate it by itself for that version).

• chore: bump vite from 6.4.3 to 6.4.5 #484: bump vite from 6.4.3 to 6.4.5
• chore: bump fast-uri from 3.1.7 to 3.1.9 #481: bump fast-uri from 3.1.7 to 3.1.9
• chore: bump source-map-js from 1.2.1 to 1.2.2 #477: bump source-map-js from 1.2.1 to 1.2.2

Verification

Run locally on this commit: npm run build passes (Node 24) and npm run test:unit passes on Node 20, the version CI uses (36 test files, 358 tests). The functional tests need a browser and were not run locally; please rely on CI for those.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.68%. Comparing base (de5958d) to head (8e6250b).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #485      +/-   ##
==========================================
- Coverage   94.17%   93.68%   -0.50%     
==========================================
  Files          59       59              
  Lines        1821     1821              
  Branches      490      490              
==========================================
- Hits         1715     1706       -9     
- Misses        106      115       +9     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.