[ernst-dev]

Updates 8 development dependencies to patched releases (lockfile only) to resolve 12 of the 13 open security alerts. The remaining alert is already addressed by #269.

Merging this PR is expected to resolve 12 of this repository's 13 open security alerts. The other 1 are listed under "Not resolved".

Alerts addressed

• GHSA-xp26-3454-mjgp: @vitest/mocker, medium, 4.1.11 -> 4.1.12
• GHSA-qxg6-89mg-rqv8: @vitest/mocker, medium, 4.1.11 -> 4.1.12
• GHSA-wjr9-j795-jxcr: fast-uri, medium, 3.1.7 -> 3.1.9
• GHSA-333x-w4r6-6crp: fast-uri, low, 3.1.7 -> 3.1.9
• GHSA-w74x-v6f9-j3xg: fast-uri, medium, 3.1.7 -> 3.1.9
• GHSA-xhq7-xmqj-769h: fast-uri, low, 3.1.7 -> 3.1.9
• GHSA-8r9p-f939-6h3c: follow-redirects, high, 1.16.0 -> 1.16.2
• GHSA-q3jh-wrc6-jgq8: follow-redirects, high, 1.16.0 -> 1.16.2
• GHSA-wr44-6hxh-3jwq: joi, medium, 18.2.8 -> 18.3.1
• GHSA-rj75-hqrm-r3gf: postcss-selector-parser, medium, 7.1.5 -> 7.1.7
• GHSA-xjj6-f33q-929c: undici, high, 6.29.0 -> 6.29.1
• GHSA-xjj6-f33q-929c: undici, high, 7.30.0 -> 7.30.1

How it was fixed

postcss-selector-parser, fast-uri, follow-redirects and joi are transitive dependencies that npm can update within their existing parent ranges, so each was updated with npm update <package> --package-lock-only. undici appears twice in the lockfile, on two major lines, and each was updated within its own line (7.30.0 -> 7.30.1 and 6.29.0 -> 6.29.1), so neither crosses a major version. @vitest/mocker is pulled in by vitest, which is already a direct dev dependency, so vitest, @vitest/coverage-v8 and the other @vitest/* packages released with it were moved from 4.1.11 to 4.1.12 (within the existing ^4.1.11 ranges); npm also removed a duplicate nested @vitest/mocker copy as a result. package.json is unchanged. The diff is limited to the entries listed in this section, all marked dev.

Not resolved

• GHSA-q2hr-2g5m-vwhr: brace-expansion, medium. Already addressed by the open PR chore: Remediate 1 Dependabot security alert (lockfile only) #269, which updates brace-expansion 2.1.4 -> 2.1.7. It is left out of this PR so that the alert has a single fix. Merging both PRs is expected to resolve all 13 open alerts; the two touch different lockfile entries, but whichever is merged second may need a rebase.

Why one pull request

The open alerts were grouped into a single PR to avoid a large number of separate dependency updates.

Dependabot PRs closed by this change

These PRs update packages that this PR also updates, so they are closed in its favor. Each can be restored by commenting @dependabot reopen on it if this PR fails CI or is abandoned (Dependabot will not recreate it by itself for that version).

• chore: Bump undici from 7.30.0 to 7.30.1 #280: Bump undici from 7.30.0 to 7.30.1
• chore: Bump fast-uri from 3.1.7 to 3.1.9 #279: Bump fast-uri from 3.1.7 to 3.1.9
• chore: Bump postcss-selector-parser from 7.1.5 to 7.1.6 #272: Bump postcss-selector-parser from 7.1.5 to 7.1.6

Dependabot PRs left open

• chore: Bump source-map-js from 1.2.1 to 1.2.2 #271: Bump source-map-js from 1.2.1 to 1.2.2 (not tied to a security alert in this repository)

Verification

Run locally on this commit with Node 20, the version CI uses: npm run build passes and npm run test:unit passes (38 test files, 444 tests). The functional tests need a browser and were not run locally; please rely on CI for those.