chore: upgrade vitest to 4.1.10

[mbret]

The update

Package	From	To	Type	Scope
vitest	4.1.7	4.1.10	patch	devDependency

Routine patch bump of the test runner. Picked as the most-behind, gate-verified patch: no security fix was resolvable by a single in-range direct-dependency bump this run (see below), so per priority order this is the oldest patch on the core toolchain. Changes across 4.1.8–4.1.10 are bug fixes to the runner/reporters; no config or API changes required. The manifest caret range (^4.0.17 → ^4.1.10) was bumped to match the installed floor.

Gates

Baseline captured on a clean main checkout, then re-run with the update applied — no new failures:

Gate	Baseline	With update
npm run check (biome)	✅ 89 files	✅ 89 files
npm run build (tsc + vite)	✅ built	✅ built
npm run test:ci (vitest run)	✅ 128 passed	✅ 128 passed (RUN v4.1.10)

Only package.json + package-lock.json changed; no second lockfile introduced.

---

Pending queue (status report)

Security advisories — need a maintainer decision

npm audit reports 8 vulnerabilities (2 high, 5 moderate, 1 low). All are transitive, dev-only, and not fixable by a single in-range direct-dependency bump — the parents (jsdom, semantic-release) are already at their latest versions, and most live inside the npm@11.15.0 bundle that @semantic-release/npm ships. Resolving them would require overrides (which widens transitive constraints) or accepting they don't affect the published dist, so they're left for a human:

Severity	Package	Advisory	Path
HIGH	undici (<7.28.0)	GHSA-vmh5-mc38-953g + several more (TLS bypass, header injection, cache poisoning)	jsdom@29.1.1 (latest, pins undici 7.25.0) & semantic-release
HIGH	sigstore (<=4.1.0)	GHSA-52v5-jr5w-gjxr	bundled in npm@11.15.0 ← semantic-release
MOD	@sigstore/core, @sigstore/verify	GHSA-jfc7-64v2-mr8c, GHSA-xgjw-pm74-86q4	bundled in npm@11.15.0 ← semantic-release
MOD	tar (<=7.5.15)	GHSA-vmf3-w455-68vh	bundled in npm@11.15.0 ← semantic-release
MOD	npm	(via tar)	bundled in semantic-release
MOD	js-yaml (4.0.0–4.1.1)	GHSA-h67p-54hq-rp68	semantic-release → cosmiconfig
LOW	@babel/core (<=7.29.0)	GHSA-4x5r-pxfx-6jf8	build tooling (transitive)

Outdated direct dependencies (not yet applied)

Patches (within range):

• @vitejs/plugin-react 6.0.2 → 6.0.3
• vite 8.1.4 → 8.1.5
• vite-plugin-dts 5.0.1 → 5.0.3
• @types/react 19.2.15 → 19.2.17
• react 19.2.6 → 19.2.7 (dev + peer)
• react-dom 19.2.6 → 19.2.7 (dev + peer)
• lint-staged 17.0.5 → 17.0.8
• semantic-release 25.0.3 → 25.0.7
• @types/node 25.9.1 → 25.9.5 (within current major 25)

Minors:

• @biomejs/biome 2.4.15 → 2.5.4
• @tanstack/react-query 5.100.14 → 5.101.2 (peer + dev; should move in lockstep with the persist-client below)
• @tanstack/react-query-persist-client 5.100.14 → 5.101.2 (same @TanStack family, released together — bundle these two in one PR)
• terser 5.48.0 → 5.49.0

Deferred majors (not auto-applied — schedule manually)

• @types/node 25.9.1 → 26.1.1 — tracks a newer Node runtime major line; bump only alongside the project's Node target (CI pins Node 25).
• typescript 6.0.3 → 7.0.2 — TypeScript 7.x is a major compiler change; expect new type diagnostics and requires TS-tooling (biome, vite-plugin-dts, react-compiler) compatibility. Needs a dedicated PR.

Needs manual attention

None from this run — the chosen update passed all gates cleanly. The security advisories above are the only items requiring a human call.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VcMagL4VqF65241Hvv7JKb

---

Generated by Claude Code