[decofe]

Upgrade Vitest from 4.1.11 to 4.1.12 so its transitive @vitest/mocker dependency includes both security fixes. A client with access to a Vite development server using the public mocker plugins could otherwise read files outside the allowed directory on Windows or inject JavaScript into modules served to a developer's browser.

Addresses Dependabot #11 (GHSA-xp26-3454-mjgp) and Dependabot #12 (GHSA-qxg6-89mg-rqv8). Both advisories identify 4.1.12 as patched. The installed package contains normalized redirect paths and JSON serialization of generated module URLs.

Only the Vitest pin and its matching @vitest/* lockfile entries change. Vitest is development tooling here; the checked-in configurations use Node test runs and do not configure the public mocker plugins. Live developer-server exposure was not verified.

Validation:

• Clean npm ci --ignore-scripts succeeds; npm ls resolves vitest and @vitest/mocker to 4.1.12, with Vite retained at 8.2.4.
• npm test passes: type checking, JSON formatting, generated manifests, Gemini build, and all 48 tests.
• claude plugin validate --strict . and gh skill publish --dry-run pass.
• Live MCP checks with the sandbox HTTP proxy enabled: Tempo Docs passes; Mercator returns HTTP 200 where the existing test expects 401. This is the same failure observed before this upgrade; live MCP validation remains incomplete.

Prompted by: @sds

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vitest@​4.1.11 ⏵ 4.1.12

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Recently published: npm @vitest/expect published 6 days ago Location: Package overview From: package-lock.json → npm/vitest@4.1.12 → npm/@vitest/expect@4.1.12 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/expect@4.1.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm @vitest/mocker published 6 days ago Location: Package overview From: package-lock.json → npm/vitest@4.1.12 → npm/@vitest/mocker@4.1.12 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/mocker@4.1.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm @vitest/pretty-format published 6 days ago Location: Package overview From: package-lock.json → npm/vitest@4.1.12 → npm/@vitest/pretty-format@4.1.12 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/pretty-format@4.1.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm @vitest/runner published 6 days ago Location: Package overview From: package-lock.json → npm/vitest@4.1.12 → npm/@vitest/runner@4.1.12 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/runner@4.1.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm @vitest/snapshot published 6 days ago Location: Package overview From: package-lock.json → npm/vitest@4.1.12 → npm/@vitest/snapshot@4.1.12 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/snapshot@4.1.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm @vitest/spy published 6 days ago Location: Package overview From: package-lock.json → npm/vitest@4.1.12 → npm/@vitest/spy@4.1.12 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/spy@4.1.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm @vitest/utils published 6 days ago Location: Package overview From: package-lock.json → npm/vitest@4.1.12 → npm/@vitest/utils@4.1.12 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/utils@4.1.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block

View full report

[claude]

LGTM. This is a clean patch bump of the vitest dev dependency to pick up the two @ vitest/mocker security fixes.

What was reviewed:

• package.json: vitest moves from 4.1.11 to 4.1.12 with the exact pin kept. The overrides block, engines and the other devDependencies are unchanged.
• package-lock.json: vitest and its seven @ vitest/* entries (expect, mocker, pretty-format, runner, snapshot, spy, utils) all move to 4.1.12. Each resolves to registry.npmjs.org and the internal pins between them agree.
• The optional @ vitest/browser-webdriverio peer pin now reads ^4.1.11. This reflects the upstream package metadata, and that package is not installed, so it has no effect here.

Extended reasoning...

The change bumps one dev dependency in package.json, and package-lock.json is regenerated to match. It touches no source code and no configuration. The upgrade fixes advisories in dev-only tooling, and it adds no new packages or registries to the lockfile. I could not check the integrity hashes against the registry from this environment, but the lockfile entries are consistent with each other. The change is small and mechanical, no CODEOWNERS file covers these paths, and the PR has no open reviewer objections.