[ernst-dev]

Updates 8 dependencies to patched releases (lockfile only) to resolve 13 open security alerts. Two of the updated packages (joi and follow-redirects) are runtime dependencies; the rest are development dependencies.

Merging this PR is expected to resolve 13 of this repository's 15 open security alerts. The other 2 are listed under "Not resolved".

Alerts addressed

• GHSA-xp26-3454-mjgp: @vitest/mocker, medium, 4.1.11 -> 4.1.12
• GHSA-qxg6-89mg-rqv8: @vitest/mocker, medium, 4.1.11 -> 4.1.12
• GHSA-8r9p-f939-6h3c: follow-redirects, high, 1.16.0 -> 1.16.2
• GHSA-q3jh-wrc6-jgq8: follow-redirects, high, 1.16.0 -> 1.16.2
• GHSA-mrwp-f3q8-3g9p: follow-redirects, high, 1.16.0 -> 1.16.2
• GHSA-4528-x5fx-h6hg: joi, high, 18.2.9 -> 18.3.1
• GHSA-6pq8-jhm2-2vcw: qs, medium, 6.15.2 -> 6.17.1
• GHSA-698v-4r3x-3vcv: vite, medium, 8.2.2 -> 8.3.5
• GHSA-587h-7wmj-h5pm: vite, high, 8.2.2 -> 8.3.5
• GHSA-r825-w8mm-5pxw: vite, medium, 8.2.2 -> 8.3.5
• GHSA-vfpm-58rq-9qcg: vite, medium, 8.2.2 -> 8.3.5
• GHSA-rq7h-c2jc-7f22: vite, medium, 8.2.2 -> 8.3.5
• GHSA-9jrq-w75r-8gcw: vite, low, 8.2.2 -> 8.3.5

How it was fixed

joi, follow-redirects, qs and vite were updated within their existing parent ranges with npm update <package> --package-lock-only. vite also moves rolldown, postcss, nanoid and the platform bindings it requires. @vitest/mocker is pulled in by vitest, which is already a direct dev dependency, so vitest, @vitest/coverage-istanbul and the other @vitest/* packages released with it were moved from 4.1.11 to 4.1.12 (within the existing ^4.1.11 and ^4.1.8 ranges). package.json is unchanged. Three of the @vitest/* packages are reached through webdriverio, so they are runtime dependencies here too. All upgraded runtime dependencies (joi, follow-redirects, @vitest/pretty-format, @vitest/snapshot, @vitest/utils) are available internally.

Not resolved

• GHSA-3g3m-2fjr-6pw4: glob, medium. glob is a direct dev dependency at ^10.5.0 and the only patched release is 14.0.2, four major versions ahead. That upgrade changes the API and needs a maintainer decision.
• GHSA-g3hv-75wg-m249: minimatch, medium. The only patched release is 11.0.1 (a new major version). The vulnerable copies sit on older major lines (5.x and 9.x) pulled in by different parents, so no parent update reaches the fix. Resolving it would need a package.json overrides entry, which needs a maintainer decision.

Why one pull request

The open alerts were grouped into a single PR to avoid a large number of separate dependency updates.

Dependabot PRs left open

• chore: Bump joi from 18.2.9 to 18.3.1 #270: Bump joi from 18.2.9 to 18.3.1 (updates a package this PR also updates; can be closed once this PR's CI passes)
• chore: Bump qs from 6.15.2 to 6.17.1 #269: Bump qs from 6.15.2 to 6.17.1
• chore: Bump follow-redirects from 1.16.0 to 1.16.2 #268: Bump follow-redirects from 1.16.0 to 1.16.2
• chore: Bump vite from 8.2.2 to 8.3.4 #266: Bump vite from 8.2.2 to 8.3.4

Verification

Run locally on this commit: npm run build passes (Node 20). The test suite drives a real browser and could not run in the environment used to prepare this PR (the local browser driver does not match the installed Chrome version), so please rely on CI. The four Dependabot PRs above were intentionally left open until CI has confirmed this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.23%. Comparing base (1c42c43) to head (0fdd0ad).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #271   +/-   ##
=======================================
  Coverage   93.23%   93.23%           
=======================================
  Files          20       20           
  Lines         488      488           
  Branches       84       84           
=======================================
  Hits          455      455           
  Misses         29       29           
  Partials        4        4           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

The merge-base changed after approval.