[Snyk] Security upgrade vitest from 4.1.10 to 4.1.11

[snyk-io]

Snyk has created this PR to fix 1 vulnerabilities in the pnpm dependencies of this project.

Snyk changed the following file(s):

• packages/vite/package.json

⚠️ Warning

Failed to update the pnpm-lock.yaml, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Directory Traversal SNYK-JS-VITESTMOCKER-19497933	111

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Directory Traversal

[snyk-io]

This is a patch upgrade from vitest 4.1.10 to 4.1.11. While typically safe, this version introduces a behavioral change that could impact CI/CD pipelines.

Key Change:

• The default output directory for json and junit reporters has been changed to the .vitest/ directory. Previously, these files were often written to the project's root directory. [6]

Impact:

• This change can cause CI/CD jobs or other automated scripts to fail if they are configured to look for reporter output files in a specific location that is no longer the default. [6]

Recommendation:

• After upgrading, verify any CI/CD configurations or scripts that consume test reports and update the file paths to point to the new .vitest/ directory if necessary.

Source: GitHub Release Notes

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

📊 Workflow Benchmarks

❌ The benchmark run for 29f39de failed. See the run logs for details.

No benchmark results were produced.

ℹ️ Metric definitions & methodology

_{Metrics —}

_{All timestamps are deployment-side; runs are triggered in-deployment, so the CI runner and api.vercel.com sit outside every measured window. TTFS = start() → first step body (includes dispatch + any cold start); Fan-out TTFS/TTLS = first/last step completion of one Promise.all from the same anchor (the gap is the runtime’s fan-out spread); STSO/WO between step bodies; CRTT inside the workflow (excludes the api.vercel.com read path).}

_{Cold starts stay in the numbers (real bursty-workload latency, inflates P75+); Best is the warm floor.}

[github-actions]

Sim World

Simulated world deterministic testing for races. Traces

🟠 The run produced no summary — see the job log.

[github-actions]

🧪 E2E Test Results

No test result files found.

[github-actions]

No measurements were produced. See the run log.