[ernst-dev]

Updates vitest, the vite copy it uses, and one copy of brace-expansion to patched releases (lockfile only) to resolve all 9 open security alerts.

Merging this PR is expected to resolve all 9 of this repository's open security alerts.

Alerts addressed

• GHSA-xp26-3454-mjgp: @vitest/mocker, medium, 4.1.11 -> 4.1.12
• GHSA-qxg6-89mg-rqv8: @vitest/mocker, medium, 4.1.11 -> 4.1.12
• GHSA-q2hr-2g5m-vwhr: brace-expansion, medium, 1.1.18 -> 1.1.21
• GHSA-698v-4r3x-3vcv: vite, medium, 8.2.2 -> 8.3.5
• GHSA-587h-7wmj-h5pm: vite, high, 8.2.2 -> 8.3.5
• GHSA-r825-w8mm-5pxw: vite, medium, 8.2.2 -> 8.3.5
• GHSA-vfpm-58rq-9qcg: vite, medium, 8.2.2 -> 8.3.5
• GHSA-rq7h-c2jc-7f22: vite, medium, 8.2.2 -> 8.3.5
• GHSA-9jrq-w75r-8gcw: vite, low, 8.2.2 -> 8.3.5

How it was fixed

vite and @vitest/mocker are pulled in by vitest, which is already a direct dev dependency, so vitest, @vitest/coverage-istanbul and the other @vitest/* packages released with it were moved from 4.1.11 to 4.1.12 (within the existing ^4.1.11 and ^4.1.8 ranges). That brings vite 8.2.2 -> 8.3.5 and the packages it requires: rolldown (1.2.8 -> 1.2.16) and its platform bindings, @oxc-project/types, postcss, nanoid and source-map-js. The alert for brace-expansion is on the 1.x line, which is installed under minimatch; that copy was updated within its own line (1.1.18 -> 1.1.21). package.json is unchanged, and every changed entry is marked dev.

Why one pull request

The open alerts were grouped into a single PR to avoid a large number of separate dependency updates.

Dependabot PRs closed by this change

These PRs update packages that this PR also updates, so they are closed in its favor. Each can be restored by commenting @dependabot reopen on it if this PR fails CI or is abandoned (Dependabot will not recreate it by itself for that version).

• chore: Bump vite from 8.2.2 to 8.3.4 #170: Bump vite from 8.2.2 to 8.3.4

Dependabot PRs left open

• chore: Bump brace-expansion #169: Bump brace-expansion (updates the separate 5.x copy of brace-expansion, which has no open alert; not affected by this PR)

Verification

Run locally on this commit with Node 20, the version CI uses: npm run build passes and npm test passes in all three configured time zones (237 tests in the main run, 36 in each of the two date-utils runs).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (e327e6a) to head (848a943).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #171   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           13        13           
  Lines          470       470           
  Branches       169       169           
=========================================
  Hits           470       470           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.