chore: upgrade vitest to 4.1.11 to address CVE-2026-84373

[claude]

Fixes SOU-2193

Summary

Refreshes the yarn.lock entries for vitest and @vitest/mocker from 4.1.4 to 4.1.11 to address CVE-2026-84373 (GHSA-82fw-gwwq-j7x9), an arbitrary file read via path traversal in the vitest:interceptor:register handler registered on Vite's unauthenticated HMR WebSocket.

This is a lockfile-only change. Every workspace already declares vitest: ^4.1.4, which admits the patched 4.1.11 release, so no package.json change and no resolutions override are needed.

Verification

yarn why vitest — all four workspaces resolve to the patched version:

├─ @sourcebot/backend@workspace:packages/backend
│  └─ vitest@npm:4.1.11 (via npm:^4.1.4)
├─ @sourcebot/query-language@workspace:packages/queryLanguage
│  └─ vitest@npm:4.1.11 (via npm:^4.1.4)
├─ @sourcebot/shared@workspace:packages/shared
│  └─ vitest@npm:4.1.11 (via npm:^4.1.4)
└─ @sourcebot/web@workspace:packages/web
   └─ vitest@npm:4.1.11 (via npm:^4.1.4)

yarn why @vitest/mocker shows every instance at 4.1.11 as well.

• yarn install clean
• yarn test — 2153 tests passed across all 4 workspaces on vitest 4.1.11

🤖 Generated with Claude Code

---

Note

Low Risk
Dependency-only security patch for the test runner; no application runtime or auth code changes.

Overview
Patches CVE-2026-84373 by moving the resolved vitest stack from 4.1.4 to 4.1.11 in yarn.lock, including all @vitest/* packages (expect, mocker, runner, snapshot, etc.).

This is lockfile-only: workspaces already declare vitest: ^4.1.4, which allows the patched release without editing package.json. The unreleased CHANGELOG entry documents the upgrade.

^{Reviewed by Cursor Bugbot for commit 10fb199. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Upgrades vitest and its @vitest/* packages from 4.1.4 to 4.1.11 in yarn.lock to patch CVE-2026-84373, an arbitrary file read via path traversal in Vitest's interceptor handler on Vite's unauthenticated HMR WebSocket.

• Lockfile-only change; existing ^4.1.4 devDependency ranges already admit the patched version, so no package.json edits are needed.
• Adds a CHANGELOG.md entry under [Unreleased] → Fixed.
• All workspaces now resolve to 4.1.11 and the full test suite (2,153 tests) passes.

^{Written for commit 10fb199. Summary will update on new commits.}

[github-actions]

License Audit

⚠️ Status: PASS

Metric	Count
Total packages	2174
Resolved (non-standard)	26
Unresolved	0
Strong copyleft	0
Weak copyleft	28

Weak Copyleft Packages (informational)

Package	Version	License
@img/sharp-libvips-darwin-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-darwin-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-wasm32	0.35.3	Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm64	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia32	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x64	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
axe-core	4.10.3	MPL-2.0
dompurify	3.4.13	(MPL-2.0 OR Apache-2.0)
lightningcss	1.32.0	MPL-2.0
lightningcss-android-arm64	1.32.0	MPL-2.0
lightningcss-darwin-arm64	1.32.0	MPL-2.0
lightningcss-darwin-x64	1.32.0	MPL-2.0
lightningcss-freebsd-x64	1.32.0	MPL-2.0
lightningcss-linux-arm-gnueabihf	1.32.0	MPL-2.0
lightningcss-linux-arm64-gnu	1.32.0	MPL-2.0
lightningcss-linux-arm64-musl	1.32.0	MPL-2.0
lightningcss-linux-x64-gnu	1.32.0	MPL-2.0
lightningcss-linux-x64-musl	1.32.0	MPL-2.0
lightningcss-win32-arm64-msvc	1.32.0	MPL-2.0
lightningcss-win32-x64-msvc	1.32.0	MPL-2.0

Resolved Packages (26)

Package	Version	Original	Resolved	Source
@sentry/cli	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry API (license: "FSL-1.1-MIT") + upstream getsentry/sentry-cli LICENSE (Functional Source License 1.1, MIT Future License)
@sentry/cli	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	npm registry API (license: "FSL-1.1-MIT") + upstream getsentry/sentry-cli LICENSE (Functional Source License 1.1, MIT Future License)
@sentry/cli-darwin	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry API (license: "FSL-1.1-MIT") + upstream getsentry/sentry-cli LICENSE (Functional Source License 1.1, MIT Future License)
@sentry/cli-darwin	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	npm registry API (license: "FSL-1.1-MIT") + upstream getsentry/sentry-cli LICENSE (Functional Source License 1.1, MIT Future License)
@sentry/cli-linux-arm	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry API (license: "FSL-1.1-MIT") + upstream getsentry/sentry-cli LICENSE (Functional Source License 1.1, MIT Future License)
@sentry/cli-linux-arm	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	npm registry API (license: "FSL-1.1-MIT") + upstream getsentry/sentry-cli LICENSE (Functional Source License 1.1, MIT Future License)
@sentry/cli-linux-arm64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry API (license: "FSL-1.1-MIT") + upstream getsentry/sentry-cli LICENSE (Functional Source License 1.1, MIT Future License)
@sentry/cli-linux-arm64	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	npm registry API (license: "FSL-1.1-MIT") + upstream getsentry/sentry-cli LICENSE (Functional Source License 1.1, MIT Future License)
@sentry/cli-linux-i686	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry API (license: "FSL-1.1-MIT") + upstream getsentry/sentry-cli LICENSE (Functional Source License 1.1, MIT Future License)
@sentry/cli-linux-i686	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	npm registry API (license: "FSL-1.1-MIT") + upstream getsentry/sentry-cli LICENSE (Functional Source License 1.1, MIT Future License)
@sentry/cli-linux-x64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry API (license: "FSL-1.1-MIT") + upstream getsentry/sentry-cli LICENSE (Functional Source License 1.1, MIT Future License)
@sentry/cli-linux-x64	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	npm registry API (license: "FSL-1.1-MIT") + upstream getsentry/sentry-cli LICENSE (Functional Source License 1.1, MIT Future License)
@sentry/cli-win32-arm64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry API (license: "FSL-1.1-MIT") + upstream getsentry/sentry-cli LICENSE (Functional Source License 1.1, MIT Future License)
@sentry/cli-win32-arm64	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	npm registry API (license: "FSL-1.1-MIT") + upstream getsentry/sentry-cli LICENSE (Functional Source License 1.1, MIT Future License)
@sentry/cli-win32-i686	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry API (license: "FSL-1.1-MIT") + upstream getsentry/sentry-cli LICENSE (Functional Source License 1.1, MIT Future License)
@sentry/cli-win32-i686	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	npm registry API (license: "FSL-1.1-MIT") + upstream getsentry/sentry-cli LICENSE (Functional Source License 1.1, MIT Future License)
@sentry/cli-win32-x64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry API (license: "FSL-1.1-MIT") + upstream getsentry/sentry-cli LICENSE (Functional Source License 1.1, MIT Future License)
@sentry/cli-win32-x64	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	npm registry API (license: "FSL-1.1-MIT") + upstream getsentry/sentry-cli LICENSE (Functional Source License 1.1, MIT Future License)
codemirror-lang-elixir	4.0.0	UNKNOWN	Apache-2.0	GitHub repo (livebook-dev/codemirror-lang-elixir LICENSE) + published package LICENSE file
khroma	2.1.0	UNKNOWN	MIT	GitHub repo (fabiospampinato/khroma license) + published package license file
lezer-elixir	1.1.2	UNKNOWN	Apache-2.0	GitHub repo (livebook-dev/lezer-elixir LICENSE) + published package LICENSE file
map-stream	0.1.0	UNKNOWN	MIT	published package LICENCE file (MIT text, Copyright 2011 Dominic Tarr)
memorystream	0.3.1	UNKNOWN	MIT	extracted from legacy "licenses" object in package.json (type: MIT); confirmed by package LICENSE file
pause-stream	0.0.11	MIT,Apache2	MIT OR Apache-2.0	extracted from license array ["MIT","Apache2"]; confirmed by package LICENSE file ("Dual Licensed MIT and Apache 2")
posthog-js	1.369.0	SEE LICENSE IN LICENSE	Apache-2.0	published package LICENSE file: Apache-2.0 grant for the package, followed by MIT notices for bundled third-party code
valid-url	1.0.9	UNKNOWN	MIT	published package LICENSE file (MIT text, Copyright 2013 Odysseas Tsatalos and oDesk Corporation)