From 68ee9120b32b624c657512a7ea5f53f8f05d8670 Mon Sep 17 00:00:00 2001
From: gabriel <admin@g4bri3l.de>
Date: Wed, 7 Oct 2026 13:53:27 +0200
Subject: [PATCH] chore(js): bump vitest to 3.2.7 for security advisory

vitest ^2.0.0 is flagged critical: while the Vitest UI server is
listening, arbitrary files can be read and executed (fixed in 3.2.6).
Dev-only and only reachable via `vitest --ui`, which this repo does not
use, but the bump is free: no config changes needed.
---
 packages/javascript/package.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/javascript/package.json b/packages/javascript/package.json
index f531a53..b0080d5 100644
--- a/packages/javascript/package.json
+++ b/packages/javascript/package.json
@@ -43,11 +43,11 @@
     "@types/node": "^22.0.0",
     "@typescript-eslint/eslint-plugin": "^8.0.0",
     "@typescript-eslint/parser": "^8.0.0",
-    "@vitest/coverage-v8": "^2.0.0",
+    "@vitest/coverage-v8": "^3.2.7",
     "eslint": "^9.0.0",
     "tsup": "^8.0.0",
     "typescript": "^5.6.0",
-    "vitest": "^2.0.0"
+    "vitest": "^3.2.7"
   },
   "engines": {
     "node": ">=18.0.0"