chore(deps-dev): bump vitest from 1.6.1 to 4.1.10

[dependabot]

Bumps vitest from 1.6.1 to 4.1.10.

Release notes

Sourced from vitest's releases.

v4.1.10

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

• Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)
• browser:
  • Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)
  • Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)
• mocker:
  • Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)
• pool:
  • Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

• browser:
  • Disable client cdp API when allowWrite/allowExec: false [backport to v4]  -  by @​hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)
  • Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4]  -  by @​toxik and @​Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

• runner: Limit concurrency per task branch in addition to per leaf callbacks (backport)  -  by @​hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

• browser: Provide project reference in ToMatchScreenshotResolvePath  -  by @​macarie and @​sheremet-va in vitest-dev/vitest#10138 (31882)
• Global sequence.concurrent: true with top-level test(..., { concurrent: false }) + depreacte sequential test API and options  -  by @​hi-ogawa, Codex and @​sheremet-va in vitest-dev/vitest#10196 (2847d)
• browser: Simplify orchestrator otel carrier  -  by @​hi-ogawa in vitest-dev/vitest#10285 (18af9)

   🏎 Performance

• Stringify diff objects only once  -  by @​sheremet-va in vitest-dev/vitest#10276 (9f7b1)

    View changes on GitHub

... (truncated)

Commits

• db616d2 chore: release v4.1.10 (#10718)
• bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
• a7a61e7 chore: release v4.1.9 (#10598)
• 934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
• 7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
• a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
• e61f2dd chore: release v4.1.8
• e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
• a09d472 chore: release v4.1.7
• a8fd24c chore: release v4.1.6
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.

[kw-security]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[dj4oC]

Bumps vitest — a major jump from ^1.5.0→^4.1.10 in five packages (web-app-ai-doc-summary, web-app-ai-folder-brief-sidebar, web-app-ai-image-alt-text-sidebar, web-app-ai-sensitive-data-scanner, web-app-file-comments), and a patch bump 4.1.7→4.1.10 elsewhere.

Findings

Stability (blocking, verified by actually running the tests). I checked out this PR branch, ran pnpm install --frozen-lockfile (succeeds, lockfile is consistent), then pnpm --filter <pkg> test:unit for each of the five packages that jumped vitest ^1.5.0→^4.1.10. All five fail identically before running a single test:

Error [ERR_PACKAGE_PATH_NOT_EXPORTED]: Package subpath './module-runner' is not defined by "exports" in .../vite/package.json

These five packages still pin "vite": "^5.2.0" (resolves to vite@5.4.21), which predates the ./module-runner export subpath that vitest@4 requires at startup — so test:unit cannot even boot. By contrast, packages that were already on vitest@4.x and only took the 4.1.7→4.1.10 patch bump (e.g. web-app-ai-quick-draft-creator, pinned to vite: ^7.2.2) run fine (verified: 11/11 tests pass). This is a real, reproducible break in CI for those five packages, not a theoretical concern.

Security / Performance. No issues — pure dev-dependency version bump, nothing shipped to the production bundle.

Test coverage. N/A (dependency bump); the breakage above is exactly what pnpm test:unit in CI should catch.

Deployment topology check

N/A — dev tooling only, no runtime/deployment impact.

Verdict

Changes requested — either pin vite to a version that exports ./module-runner (vite ≥ 6, matching what the other already-v4 packages use) in the same five package.jsons, or hold vitest back to a version compatible with vite@5.2 for those packages, before merging.

🤖 Automated review by Claude Code (security · stability · performance · coverage)

---

Generated by Claude Code

[dj4oC]

Investigated the red check:types job (failing since 2026-07-07, not yet reviewed by this bot).

Findings

• Stability (blocking, pre-existing latent bug unmasked by this bump, not introduced by it): vitest 1.6.1→4.1.10 pulls in an updated type-checking chain that now surfaces a pre-existing gap in packages/web-app-ai-folder-brief-sidebar/tests/unit/useFolderBrief.spec.ts:68 and :178 — the mock Resource objects are missing the required spaceId field:

  error TS2741: Property 'spaceId' is missing in type '{...}' but required in type 'Resource'.
  

  This is exactly the Resource.spaceId required rule from this repo's CLAUDE.md — the test fixtures never satisfied it and only failed to type-check once the dependency graph re-resolved. Fix: add spaceId: '<test-space-id>' to both mock Resource/Resource[] literals in that spec file.
• No other packages affected; this is an isolated, mechanical one-line-per-mock fix, not a vitest 4.x API break.

Test coverage

n/a — dependency bump; the fix is to an existing test's fixture data, not new coverage.

Verdict

Changes requested (blocked on CI) — add spaceId to the two mock Resource fixtures in useFolderBrief.spec.ts before merge.

🤖 Automated review by Claude Code (security · stability · performance · coverage)

---

Generated by Claude Code