chore(deps-dev): bump vitest from 4.1.10 to 4.1.11

[dependabot]

Bumps vitest from 4.1.10 to 4.1.11.

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

Commits

• 9bd8d46 chore: release v4.1.11 (#10995)
• 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
• See full diff in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
frontends-starter-template-extended	Error		Sep 10, 2026 1:40pm UTC
frontends-vue-starter-template	Error		Sep 10, 2026 1:40pm UTC

[cursor]

Stale comment

Security review

No medium, high, or critical findings.

This Dependabot PR only bumps the devDependency vitest from 4.1.10 to 5.0.0 in six packages (api-client, api-gen, cms-base-layer, composables, helpers, nuxt-module) and updates pnpm-lock.yaml. Lockfile integrity for vitest@5.0.0 and @vitest/mocker@5.0.0 matches the npm registry. No application or runtime code changed.

Advisory check: GHSA-82fw-gwwq-j7x9 (CVE-2026-84373, path traversal via @vitest/mocker redirect mocks) is fixed in 5.0.0. It is not reachable here: this repo does not use Vitest browser mode, @vitest/ui, or the public mockerPlugin / interceptorPlugin exports. Other 5.0.0-beta browser-mode issues (CDP RCE, otelCarrier XSS, provider-command file-gate bypass) were patched before the 5.0.0 stable release.

No prior automation security threads to re-validate. Slack summary was not posted (post tool is not configured).

  

_{Sent by Cursor Automation: Review pull requests for exploitable security issues and flag only validated findings before merge}

[cursor]

Security review

No medium, high, or critical findings.

This Dependabot synchronize only bumps the devDependency vitest from 4.1.10 to 4.1.11 in six packages (api-client, api-gen, cms-base-layer, composables, helpers, nuxt-module) and refreshes pnpm-lock.yaml. No application or runtime code changed. Lockfile integrity for vitest@4.1.11 and @vitest/mocker@4.1.11 matches the npm registry.

Advisory check: GHSA-82fw-gwwq-j7x9 (CVE-2026-84373, path traversal via @vitest/mocker redirect mocks) is fixed in 4.1.11. The repo already overrides vitest / @vitest/mocker <4.1.11 to 4.1.11; this PR aligns the declared versions. The advisory is also not reachable here: Vitest configs use Node or happy-dom, not browser mode, and there is no use of the public mockerPlugin / interceptorPlugin exports.

Prior automation review (opened, then targeting a 5.0.0 bump) had no finding threads to re-validate. Slack summary was not posted (post tool is not configured).

  

_{Sent by Cursor Automation: Review pull requests for exploitable security issues and flag only validated findings before merge}