chore(deps): update vitest to v4.1.10

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@vitest/coverage-v8 (source)	4.1.9 → 4.1.10
vitest (source)	4.1.9 → 4.1.10

---

Release Notes

vitest-dev/vitest (@​vitest/coverage-v8)

v4.1.10

Compare Source

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #​10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in #​10661 (bae52)

    View changes on GitHub

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • Between 09:00 AM and 06:59 PM, Monday through Friday (* 9-18 * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 896c4d3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

pnpm add https://pkg.pr.new/@tailor-platform/create-sdk@896c4d3

pnpm add https://pkg.pr.new/@tailor-platform/sdk@896c4d3

commit: 896c4d3

[github-actions]

Code Metrics Report (packages/sdk)

	main (3c61b24)	#1708 (faae127)	+/-
Coverage	73.1%	73.1%	0.0%
Code to Test Ratio	1:0.4	1:0.4	0.0

Details

  |                    | main (3c61b24) | #1708 (faae127) | +/-  |
  |--------------------|----------------|-----------------|------|
  | Coverage           |          73.1% |           73.1% | 0.0% |
  |   Files            |            447 |             447 |    0 |
  |   Lines            |          16405 |           16405 |    0 |
  |   Covered          |          12001 |           12001 |    0 |
  | Code to Test Ratio |          1:0.4 |           1:0.4 |  0.0 |
  |   Code             |         110269 |          110269 |    0 |
  |   Test             |          48738 |           48738 |    0 |

SDK Configure Bundle Size

	main (3c61b24)	#1708 (faae127)	+/-
configure-index-size	25.14KB	25.14KB	0KB
dependency-chunks-size	47.22KB	47.22KB	0KB
total-bundle-size	72.36KB	72.36KB	0KB

Runtime Performance

	main (3c61b24)	#1708 (faae127)	+/-
Generate Median	3,076ms	3,006ms	-70ms
Generate Max	3,099ms	3,098ms	-1ms
Apply Build Median	3,074ms	3,054ms	-20ms
Apply Build Max	3,113ms	3,106ms	-7ms

Type Performance (instantiations)

	main (3c61b24)	#1708 (faae127)	+/-
tailordb-basic	43,227	43,227	0
tailordb-optional	4,532	4,532	0
tailordb-relation	6,698	6,698	0
tailordb-validate	753	753	0
tailordb-hooks	5,415	5,415	0
tailordb-object	12,578	12,578	0
tailordb-enum	1,518	1,518	0
resolver-basic	9,272	9,272	0
resolver-nested	26,139	26,139	0
resolver-array	18,078	18,078	0
executor-schedule	4,310	4,310	0
executor-webhook	949	949	0
executor-record	7,231	7,231	0
executor-resolver	4,108	4,108	0
executor-operation-function	937	937	0
executor-operation-gql	945	945	0
executor-operation-webhook	956	956	0
executor-operation-workflow	1,798	1,798	0

---

Reported by octocov

[github-actions]

🤖 Claude Dependency Review

📦 Update Summary

• Libraries: vitest and @​vitest/coverage-v8
• Version: 4.1.9 → 4.1.10 (both packages)
• Change Type: Patch

📝 Release Notes

https://github.com/vitest-dev/vitest/releases/tag/v4.1.10

🔐 Security Assessment

• Risk: 🟢 Low
• Known vulnerabilities: This update fixes a security vulnerability in browser mode (CVE not yet assigned). The old version (4.1.9) had a vulnerability where browser test commands could bypass permission checks and access arbitrary filesystem paths. Version 4.1.10 addresses this by introducing proper access controls.
• Supply-chain notes: Publisher unchanged (vitest-dev team), no suspicious lifecycle scripts detected, normal patch release cadence. This is a backport release to the v4 stable branch.

🚨 Breaking Changes

None. This is a patch release with backward-compatible bug fixes.

✨ Main Changes

🐛 Bug Fixes

1. Security Fix - Browser Mode File Access (#10680)

   • Problem: Browser test commands (takeScreenshot, file uploads, trace operations, etc.) were bypassing allowWrite permission checks and Vite's server.fs path validation
   • Impact: Could potentially access arbitrary filesystem paths including sensitive files
   • Fix: Introduced shared security helper functions (assertBrowserApiWrite and assertBrowserFileAccess) that properly gate file operations behind permission checks and validate paths against Vite's filesystem access rules
   • Severity: This is a security vulnerability fix. Projects using Vitest browser mode should update promptly.

2. VM Module Resolution for Encoded URIs (#10661)

   • Problem: External module resolution was failing when dependency optimizer encountered URLs with percent-encoded (special) characters
   • Fix: Corrected how cachedResolver handles URI encoding, allowing modules with special characters in their paths to resolve correctly
   • Impact: Resolves edge-case module resolution errors during dependency optimization

🔍 Impact Analysis

📁 Usage Locations

vitest and @​vitest/coverage-v8 are extensively used throughout the project as development dependencies for testing infrastructure. They are found in 9 package.json files across the repository:

1. packages/sdk/package.json - Main SDK package

   • Uses both vitest and @​vitest/coverage-v8 as devDependencies
   • Complex test setup with multiple test projects (unit, unit-core, integration, e2e, scripts)
   • Custom vitest plugins for Tailor Platform runtime emulation

2. example/package.json - Example project

   • Uses vitest as devDependency for testing example code

3. llm-challenge/package.json - LLM challenge package

   • Uses vitest for test execution

4. packages/sdk-codemod/package.json - Codemod utilities

   • Uses vitest for testing codemods

5. packages/create-sdk/templates/executor/package.json - Template

   • Template includes vitest for new projects

6. packages/create-sdk/templates/generators/package.json - Template

   • Template includes vitest for new projects

7. packages/create-sdk/templates/resolver/package.json - Template

   • Template includes vitest for new projects

8. packages/create-sdk/templates/tailordb/package.json - Template

   • Template includes vitest for new projects

9. packages/create-sdk/templates/workflow/package.json - Template

   • Template includes vitest for new projects

Key Usage Patterns

Test Infrastructure: The project has 250+ test files importing from vitest throughout:

• Unit tests across all packages (packages/sdk/src/**/*.test.ts)
• Integration tests (packages/sdk/src/cli/commands/deploy/__test_fixtures__/**/*.test.ts)
• E2E tests (packages/sdk/e2e/**/*.test.ts)
• Configuration files: 10 vitest.config.ts files

Custom Vitest Integration (packages/sdk/src/vitest/):

• Custom plugins that emulate the Tailor Platform runtime environment
• Platform API mocks (TailorDB, Workflow, Secrets, etc.)
• Node.js module blocking for testing platform constraints
• Custom test environment (tailor-runtime)

Features Used:

• Test projects (workspace-style configuration)
• Coverage reporting with @​vitest/coverage-v8
• Custom environments and plugins
• TypeScript type checking during tests
• Globals mode
• Test isolation controls

Impact: None of the bugs fixed in 4.1.10 affect the main usage patterns in this codebase:

• The browser mode security fix does not impact this project because the codebase does not use Vitest browser mode (no @​vitest/browser dependency, tests run in Node environment)
• The VM module resolution fix only affects edge cases with encoded URIs, which are unlikely in this project's test setup

✅ Recommended Actions

Merge this PR. This is a low-risk patch update that:

• Fixes a security vulnerability (though not affecting this project's usage)
• Resolves a module resolution edge case
• Maintains backward compatibility
• Aligns with the project's testing infrastructure requirements

No code changes are required after merging, as this update only affects the testing framework behavior and does not introduce breaking changes.

---