[benfrank241]

Security bundle for tests/ts/package-lock.json (npm). Recreated on a human-authored branch because the Dependabot equivalents (#49 vite, #48 source-map-js) are red on every check.

Closes

Alert	Package	Advisory	Fix
#60	vite (dev)	GHSA-698v-4r3x-3vcv / CVE-2026-112943	8.3.0 → 8.3.5
#61	vite (dev)	GHSA-587h-7wmj-h5pm / CVE-2026-112942	same
#62	vite (dev)	GHSA-r825-w8mm-5pxw / CVE-2026-112944	same
#59	source-map-js (dev)	GHSA-68fv-2mgg-jv7q / CVE-2026-93749	1.2.1 → 1.2.2

Lockfile-only in-range update (vitest declares vite ^6 || ^7 || ^8, postcss declares source-map-js ^1.2.1). Parsed lock diff: vite, source-map-js, plus vite's own subtree moving with it — rolldown + 15 @rolldown/binding-* 1.2.8 → 1.2.15, @oxc-project/types 0.149.0 → 0.155.0, postcss 8.5.28 → 8.5.31, nanoid 3.3.19 → 3.3.20. No additions/removals; libc keys unchanged (10 → 10).

Note: relocked with npm 11.19.1 — npm 10.9.8 crashes on this lock (npm error Cannot read properties of null (reading 'edgesOut'), likely the file:../../src/ts link).

Verification (mirrors ci.yml "Tests (TS)", differential vs pristine origin/main)

• src/ts: npm install && npm run build — exit 0 both.
• tests/ts: npm ci exit 0 both; installed vite 8.3.5 vs 8.3.0.
• npm run test (vitest) — exit 1 on both, identical: all 4 test files load and transform under the new vite, and all 6 tests fail only with Error: VECTORIZE_API_KEY must be set (live-API suite, no credentials locally). CI for this job has been red on main-targeting PRs for a long time (Vectorize API 402 / secrets; backlog Daily security sweep — backlog #41).

🤖 Generated with Claude Code

[cdbartholomew]

Superseded by #66, which bumps the tests/ts lockfile (vite 8.3.7, source-map-js 1.2.2, @vitest/mocker 4.1.12 via vitest 4.1.12) as a human-authored PR with full CI and the security label. Closing in favor of #66.