chore(deps): bump vitest to ^4.1.0 (CVE fix)

[cliffhall]

Summary

Bumps vitest from ^4.0.17 to ^4.1.0 in the cli workspace to remediate a CRITICAL security advisory. package-lock.json now resolves vitest@4.1.10, and npm ls vitest shows no version below 4.1.0.

vitest is a direct dev dependency (the cli test runner), so this only affects the test/build toolchain — no runtime/published code changes.

Resolves Dependabot alert #119

Part of #1706

Verification

• npx prettier --check . — pass
• npm run check-version — pass
• cd client && npm run lint — pass
• cd client && npm test — pass (535 tests)
• cd cli && npm test — pass (85 tests, running on vitest 4.1.10)
• npm run build — pass

E2e tests (e2e_tests.yml) not run locally (require Playwright browser downloads); CI will cover them.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HiccCEh9mwCfVzE8qYcop1

[cliffhall]

@claude review — security dependency fix bumping vitest to ^4.1.0 (part of #1706). Verify it resolves the advisory, the bump is correct/minimal, and nothing is broken. Flag anything actionable.

[claude]

Claude finished @cliffhall's task in 1m 31s —— View job

---

Review: vitest ^4.0.17 → ^4.1.0 (security bump)

• Read PR diff (cli/package.json, package-lock.json)
• Verify the advisory (Dependabot feat: use monospace font for all input fields in sidebar #119) is resolved by ^4.1.0
• Confirm the bump is correct & minimal
• Check nothing else is broken (build/tests)
• Post review feedback

Verdict: LGTM ✅ — clean, minimal, dev-only bump. No actionable issues found.

Advisory resolution

• Manifest constraint changed to "vitest": "^4.1.0", which requires ≥ 4.1.0 — i.e. it can no longer resolve to any vulnerable 4.0.x release. This is the correct way to floor out the affected range.
• package-lock.json resolves vitest@4.1.10 and all @vitest/* subpackages at 4.1.10 (expect, mocker, pretty-format, runner, snapshot, spy, utils). I grepped the lockfile: zero occurrences of 4.0.17 remain — no stale/duplicate copy left behind.
• Note: I couldn't independently open Dependabot alert feat: use monospace font for all input fields in sidebar #119 or run a web lookup for the exact GHSA (alert is private / WebSearch not permitted in this run), so I'm verifying the mechanics rather than re-confirming the CVE text. The resolved version sits at/above the stated fixed line, and the resolved vite version did not change in this diff — meaning the fix lives in the vitest package itself, not a transitive vite/esbuild re-exposure, so bumping vitest is the right lever.

Correct & minimal

• Only two files touched; the sole manifest change is the single vitest line in cli/package.json. ✔
• vitest is a devDependency and only in the cli workspace (client/ uses jest, server/ has no test runner dep here). So this touches only the CLI test toolchain — no runtime / published-code impact. ✔
• Remaining lockfile churn is expected transitive fallout of vitest 4.1.x and all dev-only: es-module-lexer 1.7.0→2.3.1, std-env 3.10.0→4.2.0, tinyrainbow 3.0.3→3.1.0, plus widened peer ranges (vite ^8 now allowed, new optional @vitest/coverage-* peers). Nothing here is a dependency the project actually pulls at runtime.

Nothing broken

• CI is fully green on the latest commit — all 5 runs passed, including the relevant CLI Tests job (which is what actually exercises vitest) and Playwright Tests.
• PR-reported local runs (cli 85 tests on 4.1.10, build) align with CI. The client's 535 jest tests are unaffected by this change but confirm no collateral breakage.

Minor / non-blocking

• Nothing to fix. One optional nit: the PR description says "no version below 4.1.0" — confirmed accurate. If you later want to reduce lockfile drift noise on such security bumps, a targeted npm update vitest (vs. a broader install) keeps diffs tight, but this diff is already appropriately scoped.

I can't formally approve PRs, but from a correctness/security standpoint this is a solid, low-risk merge.
· deps/security-vitest