chore(deps-dev): bump vitest from 4.1.0 to 4.1.11 in /mcp-server

[maxigimenez]

What and why

Package	From	To	Severity	Via
vitest	4.1.0	4.1.11	moderate (CVSS 5.9)	direct devDependencies
@vitest/mocker	4.1.0	4.1.11	moderate (CVSS 5.9)	vitest > @vitest/mocker

Both are the same advisory, GHSA-82fw-gwwq-j7x9 — "Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock", CWE-22, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. Affected range >=2.1.0 <4.1.11.

No Vanta finding and therefore no SLA deadline. This is in the lockfile but not in Vanta — npm audit raises it, Vanta files nothing for this repository. It is reported as a gap in today's triage digest rather than left to surface on its own.

Exposure

development. npm ls vitest --omit=dev is empty: vitest is reachable only through devDependencies, and nothing it pulls in reaches the published @currents/mcp artifact. The advisory needs a test run that loads an attacker-supplied redirect mock, so in this repository the practical exposure is a contributor running the suite on a hostile branch.

The fix

lockfile-upgrade. The declared range is already vitest: ^4.0.18, which admits the patched 4.1.11, so no manifest edit and no override — only mcp-server/package-lock.json changes.

Breaking-change check

Same major and same minor; 4.1.0 to 4.1.11 is a patch series. No breaking-change or removal section applies. The upgrade does re-resolve vitest's whole subtree, which is the part worth a reviewer's attention:

Package	From	To
vite	8.0.16	8.3.4
rolldown (+ 13 platform binaries)	1.0.3	1.2.13
lightningcss (+ 11 platform binaries)	1.32.0	1.33.0
chai	6.2.2	6.3.0
postcss	8.5.25	8.5.30
picomatch	4.0.4	4.0.7
nanoid	3.3.18	3.3.20

42 stanzas change in total, one added (@rolldown/binding-android-arm-eabi) and one removed (vite/node_modules/@rolldown/binding-wasm32-wasi). Every one of those moves within its existing declared range — none is a major, and none was pinned.

npm version note

npm 10.9.4 cannot resolve vitest 4.1.11: arborist crashes with Cannot read properties of null (reading 'edgesOut') in #loadPeerSet while walking the optional peers that 4.1.11 adds (@vitest/coverage-v8, @vitest/coverage-istanbul). The lockfile here was regenerated with npm 11, which resolves it cleanly.

This does not affect CI: npm ci installs exactly what the lockfile names and works on any npm 7+. It does mean a contributor on npm 10 who runs a bare npm install may hit that crash — a pre-existing npm bug this upgrade makes reachable.

To confirm the churn is the upgrade and not the npm switch: npx npm@11 install --package-lock-only on the unmodified tree produces a zero-line diff.

Verification

Everything below was run in this sandbox against this commit.

Command	Result
npm ci	clean, 0 warnings — identical to the baseline install off main (0 warnings)
git diff --name-only	mcp-server/package-lock.json alone
npm run format	all matched files use Prettier style
npm run sync-readme:check	README tools and skills tables up to date
npx tsc --noEmit	clean
npm run build	9 files, 276.69 kB, complete
npm run test:run	35/35 files, 1195/1195 tests passed (on vitest 4.1.11)
npm audit	moderate count 2 → 0; vitest and @vitest/mocker both gone

The 6 remaining high advisories are the basic-ftp chain under release-it, untouched by this PR and not fixable without a basic-ftp major — get-uri pins basic-ftp@^5.3.1 and release-it pins the chain above it exactly.

CI coverage

A mcp-server/package-lock.json diff triggers Unit Tests (test.yml), which runs on every pull_request to main with no paths filter, across Node 20.x / 22.x / 24.x — npm ci, npm run build, npm run test:run.

It does not trigger publish.yaml, promote.yaml, release.yaml (all workflow_dispatch), linear-release.yaml or post-release.yaml (push/merge to main), or sync-from-monorepo.yaml.

What a human should still check

This is Tier B on the triage rubric, for one reason: the lockfile diff is 42 stanzas, well over the 3-stanza Tier A ceiling, because the upgrade carries vite, rolldown and lightningcss with it. Everything else about it is Tier A — same minor, dev-only, no manifest edit, no patch file, no majors collapsed, no new peer warnings, full suite green.

So the decision is whether moving the build toolchain (vite 8.0.16 → 8.3.4, rolldown 1.0.3 → 1.2.13) is acceptable for a moderate, dev-only path traversal. tsdown builds on rolldown, so that is the piece to look at — the build and the full 1195-test suite both pass here on the new versions.

It is not eligible for automatic merge, and was not merged.

Needs release

None. vitest is a devDependency; the published @currents/mcp package is unchanged. The commit is typed chore(deps-dev) so it does not trigger a release-it version bump.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GVCFkRWb2LY9DCPdeFkofo

---

Generated by Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[baz-reviewer]

Baz Summary

Upgrade the vitest test runner and @vitest/mocker to 4.1.11 to address the moderate path-traversal/arbitrary-file-read advisory. Re-resolve the associated Vite, Rolldown, Lightning CSS, and related development-toolchain dependencies in the lockfile while leaving the published package unchanged.

Topics

Topic	Details
Build toolchain refresh	Refresh the transitive Vite build stack, including rolldown, platform bindings, lightningcss, and related packages required by the updated test tooling. Modified files (1) mcp-server/package-lock.json Latest Contributors(2) User Commit Date noreply@anthropic.com chore(deps-dev): bump ... October 14, 2026 dj@currents.dev Merge pull request #22... October 08, 2026
Test security update	Upgrade vitest and its supporting packages to patched versions, removing the development-only @vitest/mocker vulnerability and preserving the existing test workflow. Modified files (1) mcp-server/package-lock.json Latest Contributors(2) User Commit Date noreply@anthropic.com chore(deps-dev): bump ... October 14, 2026 dj@currents.dev Merge pull request #22... October 08, 2026

  _{Activate to get a short verdict whether this PR is good to go or not}

  _{Activate Skill Maintainer to keep your skills up to date}

  _{This PR would have been improved with Baz Planner - Try it now}

[maxigimenez]

Triage verdict: Tier B — needs a decision

CI has now run for head b37280a. Every workflow this diff triggers concluded success:

Check	Conclusion
Test (Node 20.x)	success
Test (Node 22.x)	success
Test (Node 24.x)	success
Baz Reviewer	success

test.yml is the only workflow a mcp-server/package-lock.json diff triggers, and it ran on all three Node versions. The publish, promote, release, linear-release, post-release and sync workflows are workflow_dispatch or push/merge triggered and are correctly absent.

This is not auto-merged, and the reason is a single line of the rubric: the lockfile diff is 42 stanzas against a Tier A ceiling of 3. Everything else qualifies — same minor, devDependencies only (npm ls vitest --omit=dev is empty), no manifest edit, no patch file, no majors collapsed, no new peer warnings, local suite 1195/1195 green, CI green on the current head.

The 42 stanzas are not incidental: moving vitest to 4.1.11 re-resolves its whole subtree, carrying vite 8.0.16 → 8.3.4, rolldown 1.0.3 → 1.2.13 and lightningcss 1.32.0 → 1.33.0. tsdown builds on rolldown, so that toolchain move is the thing to weigh against a moderate, dev-only path traversal (GHSA-82fw-gwwq-j7x9, CVSS 5.9). The build and the full suite pass on the new versions here and in CI on all three Node majors.

No SLA pressure: Vanta files no finding for this advisory, so nothing is counting down. It is safe to sit on this if the toolchain move wants more thought than a dependency bump deserves.

---

Generated by Claude Code