fix(deps): bump vitest to 4.1.11 for @vitest/mocker path traversal

[pacnpal]

Closes Dependabot alerts #19 and #20 — Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock (moderate, development scope).

What changed

• frontend/package.json: vitest dev dependency ^4.1.10 → ^4.1.11.
• frontend/package-lock.json: the whole @vitest/* set (mocker, runner, snapshot, spy, utils, expect, pretty-format) and vitest move 4.1.10 → 4.1.11, plus a transitive tinyrainbow 3.1.0 → 3.1.1. No other dependencies move.

The alerts fire on @vitest/mocker, which is not a direct dependency here — it comes in through vitest, so bumping the direct dev dependency is what pulls the patched 4.1.11 into the lockfile.

Verification

• npm run test — 19 test files, 141 tests passing on vitest 4.1.11.
• npm run check — svelte-check: 647 files, 0 errors, 0 warnings.

Notes

npm audit still reports two unrelated advisories on this tree that are outside this change's scope: @sveltejs/kit ReDoS in content negotiation (moderate) and nanoid zero-size generator loop (high). Neither is covered by the alerts this PR addresses; happy to take them in a follow-up.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PwGJ1dnwAeD8gRWs7TPPXv

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T23:38:44.512784Z	faf8ace	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 2401c643-c32c-45fe-b909-8de4e3103411

📥 Commits

Reviewing files that changed from the base of the PR and between 12b857a and faf8ace.

⛔ Files ignored due to path filters (1)

• frontend/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• frontend/package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the development testing tool to version 4.1.11.

Walkthrough

The frontend package configuration updates the vitest development dependency from ^4.1.10 to ^4.1.11.

Changes

Vitest dependency update

Layer / File(s)	Summary
Update Vitest version frontend/package.json	The vitest development dependency changes from ^4.1.10 to ^4.1.11.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to faf8a

This updates the frontend test dependency to Vitest 4.1.11 to address reported mocker vulnerabilities. The lockfile is aligned and frontend tests and checks pass, with no remaining merge-blocking risk identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the Vitest dependency update and the security issue it addresses.
Description check	✅ Passed	The description directly explains the dependency update, affected vulnerability, lockfile changes, and verification results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/fix-wt7h10

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Vitest gets a tasty new bite
One small version, crisp and bright
The package file serves the treat
A neat update, quick and sweet
Tests may feast on fresher code}

_{Comment @coderabbitai help to get the list of available commands.}