Fix all Dependabot vulnerabilities (vitest 4, qs pin)

Two open advisories on the default branch:

- GHSA-5xrq-8626-4rwp (critical): vitest UI server arbitrary file
  read/execute, fixed in 4.1.0. Bump `vitest`, `@vitest/coverage-v8`,
  and `@vitest/ui` from ^3.2.4 to ^4.1.0 across all four manifests
  (resolves to 4.1.8).
- GHSA-q8mj-m7cp-5q26 (moderate): `qs.stringify` DoS, fixed in 6.15.2.
  Pin the transitive `qs` (via express/body-parser in the mcp-server)
  through a yarn `resolutions` entry, matching the existing
  `ip-address` pin.

vitest 4 now declares `vite` as a direct dependency (^6 || ^7 || ^8),
which led yarn 1 to resolve a second vite major and fail linking with
"could not find a copy of vite to link". Pin `vite` to ^6.0.1 in
`resolutions` so the whole tree shares the single hoisted vite 6.4.2
(in range for vitest and what the build already used).

vitest 4's `vitest/globals` no longer transitively pulls in @types/node,
so the core package's `types: ["vitest/globals"]` broke type-checking of
test files (`import assert from 'assert'`). Add "node", matching the
datetime and mcp-server tsconfigs which already list it.

Lint, type-check, and the full test suite (2215 + 104 + 12) pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Sander Toonen

package.json

@@ -33,9 +33,11 @@
     "typescript-eslint": "^8.15.0",
     "vite": "^6.0.1",
     "vite-plugin-dts": "^4.3.0",
-    "vitest": "^3.2.4"
+    "vitest": "^4.1.0"
   },
   "resolutions": {
-    "ip-address": "^10.1.1"
+    "ip-address": "^10.1.1",
+    "qs": "^6.15.2",
+    "vite": "^6.0.1"
   }
 }

packages/expreszo-datetime/package.json

@@ -47,14 +47,14 @@
   },
   "devDependencies": {
     "@types/luxon": "^3.4.0",
-    "@vitest/coverage-v8": "^3.2.4",
+    "@vitest/coverage-v8": "^4.1.0",
     "@types/node": "^24.5.2",
     "cross-env": "^7.0.3",
     "rimraf": "^5.0.10",
     "terser": "^5.44.1",
     "typescript": "^5.9.2",
     "vite": "^6.0.1",
     "vite-plugin-dts": "^4.3.0",
-    "vitest": "^3.2.4"
+    "vitest": "^4.1.0"
   }
 }

packages/expreszo-mcp-server/package.json

@@ -48,13 +48,13 @@
   },
   "devDependencies": {
     "@types/node": "^24.5.2",
-    "@vitest/coverage-v8": "^3.2.4",
+    "@vitest/coverage-v8": "^4.1.0",
     "cross-env": "^7.0.3",
     "rimraf": "^5.0.10",
     "tsx": "^4.20.5",
     "typescript": "^5.9.2",
     "vite": "^6.0.1",
     "vite-plugin-dts": "^4.3.0",
-    "vitest": "^3.2.4"
+    "vitest": "^4.1.0"
   }
 }

packages/expreszo/package.json

@@ -120,8 +120,8 @@
     "@rollup/plugin-typescript": "^12.1.4",
     "@types/node": "^24.5.2",
     "@typescript/native-preview": "^7.0.0-dev.20250920.1",
-    "@vitest/coverage-v8": "^3.2.4",
-    "@vitest/ui": "^3.2.4",
+    "@vitest/coverage-v8": "^4.1.0",
+    "@vitest/ui": "^4.1.0",
     "cross-env": "^7.0.3",
     "eslint": "^9.15.0",
     "eslint-plugin-import": "^2.32.0",
@@ -137,7 +137,7 @@
     "typescript-eslint": "^8.15.0",
     "vite": "^6.0.1",
     "vite-plugin-dts": "^4.3.0",
-    "vitest": "^3.2.4",
+    "vitest": "^4.1.0",
     "vscode-languageserver-types": "^3.17.5"
   },
   "_bundlesize_note": "bundlesize measures gzipped sizes by default. The UMD bundle currently sits at ~45 KB gzipped; the 60 KB cap leaves ~33% headroom for incremental growth. The ESM entry is a thin re-export barrel, so we don't gate it (the real weight lives in dist/chunks/*.mjs). bundlesize is NOT wired into CI today; this field documents the intended budget.",

packages/expreszo/tsconfig.json

@@ -4,7 +4,7 @@
     "outDir": "./dist",
     "rootDir": "./",
     "tsBuildInfoFile": "./dist/.tsbuildinfo",
-    "types": ["vitest/globals"]
+    "types": ["vitest/globals", "node"]
   },
   "include": [
     "src/**/*",