[ernst-dev]

Updates 6 dependencies to patched releases (lockfile only) to resolve all 12 open security alerts. package.json lists these packages under dependencies, so they are runtime dependencies for this repository's purposes.

Merging this PR is expected to resolve all 12 of this repository's open security alerts.

Alerts addressed

• GHSA-xp26-3454-mjgp: @vitest/mocker, medium, 4.1.11 -> 4.1.12
• GHSA-qxg6-89mg-rqv8: @vitest/mocker, medium, 4.1.11 -> 4.1.12
• GHSA-8r9p-f939-6h3c: follow-redirects, high, 1.16.0 -> 1.16.2
• GHSA-q3jh-wrc6-jgq8: follow-redirects, high, 1.16.0 -> 1.16.2
• GHSA-xjj6-f33q-929c: undici, high, 6.28.1 -> 6.29.1
• GHSA-4qv8-2p9j-2685: undici, medium, 6.28.1 -> 6.29.1
• GHSA-698v-4r3x-3vcv: vite, medium, 8.2.2 -> 8.3.5
• GHSA-587h-7wmj-h5pm: vite, high, 8.2.2 -> 8.3.5
• GHSA-r825-w8mm-5pxw: vite, medium, 8.2.2 -> 8.3.5
• GHSA-vfpm-58rq-9qcg: vite, medium, 8.2.2 -> 8.3.5
• GHSA-rq7h-c2jc-7f22: vite, medium, 8.2.2 -> 8.3.5
• GHSA-9jrq-w75r-8gcw: vite, low, 8.2.2 -> 8.3.5

How it was fixed

vite, undici and follow-redirects were updated within their existing parent ranges with npm update <package> --package-lock-only. Updating vite also moves the packages it requires: rolldown and its 16 platform bindings, @oxc-project/types, postcss and nanoid. @vitest/mocker is pulled in by vitest, which is already a direct dependency, so vitest, @vitest/coverage-v8 and the other @vitest/* packages released with it were moved from 4.1.11 to 4.1.12 (within the existing ^4.1.11 and ^4.1.8 ranges), plus one picomatch patch release they require. package.json is unchanged and the diff is limited to 17 entries in package-lock.json. All upgraded packages (32 entries, including the platform bindings) are available internally.

Why one pull request

The open alerts were grouped into a single PR to avoid a large number of separate dependency updates.

Dependabot PRs closed by this change

These PRs update packages that this PR also updates, so they are closed in its favor. Each can be restored by commenting @dependabot reopen on it if this PR fails CI or is abandoned (Dependabot will not recreate it by itself for that version).

• chore: Bump vite from 8.2.2 to 8.3.4 #222: Bump vite from 8.2.2 to 8.3.4

Dependabot PRs left open

• chore: Remediate 1 Dependabot security alert (lockfile only) #217: Remediate 1 Dependabot security alert (lockfile only) (a separate PR for alert chore: Bump ws from 8.20.1 to 8.21.0 x #185, which is already marked fixed; it only moves undici to 6.29.0, which this PR supersedes, so it can be closed by its author)

Verification

Run locally on this commit with Node 20, the version CI uses: npm run build passes, npm run test:build passes (36 test files, 373 tests) and npm run test:browser passes (19 test files, 255 tests). npm run test:integ could not run in the environment used to prepare this PR (the local browser driver does not match the installed Chrome version), so please rely on CI for it.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.69%. Comparing base (f8c641f) to head (5790fae).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #223   +/-   ##
=======================================
  Coverage   97.69%   97.69%           
=======================================
  Files          54       54           
  Lines        1478     1478           
  Branches      273      273           
=======================================
  Hits         1444     1444           
  Misses         29       29           
  Partials        5        5           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.