[ernst-dev]

Updates 5 development dependencies to patched releases (lockfile only) to resolve 7 open security alerts. The other 4 open alerts (fast-uri) are already patched on main and are not part of this PR.

Merging this PR is expected to resolve 7 of this repository's 11 open security alerts. The other 4 are listed under "Not resolved".

Alerts addressed

• GHSA-xp26-3454-mjgp: @vitest/mocker, medium, 4.1.11 -> 4.1.12
• GHSA-qxg6-89mg-rqv8: @vitest/mocker, medium, 4.1.11 -> 4.1.12
• GHSA-8r9p-f939-6h3c: follow-redirects, high, 1.16.0 -> 1.16.2
• GHSA-q3jh-wrc6-jgq8: follow-redirects, high, 1.16.0 -> 1.16.2
• GHSA-68fv-2mgg-jv7q: source-map-js, high, 1.2.1 -> 1.2.2
• GHSA-xjj6-f33q-929c: undici, high, 6.29.0 -> 6.29.1
• GHSA-xjj6-f33q-929c: undici, high, 7.30.0 -> 7.30.1

How it was fixed

undici, follow-redirects and source-map-js are transitive dependencies that npm can update within their existing parent ranges, so each was updated with npm update <package> --package-lock-only. undici appears twice in the lockfile, on two major lines, and each was updated within its own line (7.30.0 -> 7.30.1 and 6.29.0 -> 6.29.1). @vitest/mocker is pulled in by vitest, which is already a direct dev dependency, so vitest, @vitest/coverage-v8 and the other @vitest/* packages released with it were moved from 4.1.11 to 4.1.12 (within the existing ^4.1.11 and ^4.1.8 ranges). package.json is unchanged. The diff is limited to 13 entries in package-lock.json, all marked dev.

Not resolved

• GHSA-wjr9-j795-jxcr: fast-uri, medium. Already patched on main: fast-uri is at 3.1.9 since chore: Bump fast-uri from 3.1.7 to 3.1.9 x #186. GitHub still lists the alert as open and it should close on its own; no further change is needed.
• GHSA-333x-w4r6-6crp: fast-uri, low. Already patched on main: fast-uri is at 3.1.9 since chore: Bump fast-uri from 3.1.7 to 3.1.9 x #186. GitHub still lists the alert as open and it should close on its own; no further change is needed.
• GHSA-w74x-v6f9-j3xg: fast-uri, medium. Already patched on main: fast-uri is at 3.1.9 since chore: Bump fast-uri from 3.1.7 to 3.1.9 x #186. GitHub still lists the alert as open and it should close on its own; no further change is needed.
• GHSA-xhq7-xmqj-769h: fast-uri, low. Already patched on main: fast-uri is at 3.1.9 since chore: Bump fast-uri from 3.1.7 to 3.1.9 x #186. GitHub still lists the alert as open and it should close on its own; no further change is needed.

Why one pull request

The open alerts were grouped into a single PR to avoid a large number of separate dependency updates.

Dependabot PRs closed by this change

These PRs update packages that this PR also updates, so they are closed in its favor. Each can be restored by commenting @dependabot reopen on it if this PR fails CI or is abandoned (Dependabot will not recreate it by itself for that version).

• chore: Bump source-map-js from 1.2.1 to 1.2.2 #184: Bump source-map-js from 1.2.1 to 1.2.2

Verification

Run locally on this commit with Node 20, the version CI uses: npm run build passes and npm run test:unit passes (14 test files, 133 tests passed, 1 skipped).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.16%. Comparing base (6d8f9d3) to head (59cd130).

❌ Your project check has failed because the head coverage (88.16%) is below the target coverage (90.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #187   +/-   ##
=======================================
  Coverage   88.16%   88.16%           
=======================================
  Files          25       25           
  Lines         355      355           
  Branches      101       98    -3     
=======================================
  Hits          313      313           
  Misses         42       42           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.