chore: bump vitest from 4.1.10 to 4.1.11

[dependabot]

Bumps vitest from 4.1.10 to 4.1.11.

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

Commits

• 9bd8d46 chore: release v4.1.11 (#10995)
• 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

Claude finished @dependabot[bot]'s task in 2m 14s —— View job

---

Dependency review: vitest 4.1.10 → 4.1.11

• Identify what changed / semver scope
• Review release notes for behaviour changes
• Check how vitest is used in this repo
• Verify Node floor / @types/node compatibility
• Install deps & run the suite — blocked, see note below
• Post findings

Verdict: safe to merge. Patch bump, devDependencies only, nothing reaches published output.

---

What actually changed

Only package-lock.json moved — package.json still declares vitest: "^4.1.10", and 4.1.11 satisfies it, so Dependabot correctly left it alone.

Package	Change	Notes
vitest + all @vitest/*	4.1.10 → 4.1.11	patch
vite	8.2.1 → 8.2.2	transitive
rolldown	1.2.4 → 1.2.5	transitive (via vite, range ~1.2.1 → ~1.2.4)
@oxc-project/types	0.144.0 → 0.146.0	transitive
@rolldown/binding-android-arm-eabi	added	new optional platform binding; os/cpu-gated, no-op here

The 131/113 line count is almost entirely the ~14 @rolldown/binding-* platform packages, not meaningful churn.

Release-note impact on this repo

All three fixes in 4.1.11 land in code paths this repo doesn't touch:

1. fix(mocker): restrict redirect mocks to the fs allowlist (#10974) — the only one with real breakage potential, since it tightens what paths a mock may redirect to. Irrelevant here: grep across test/ finds zero vi.mock / vi.doMock calls. The only vi API in use is vi.fn (13 call sites), consistent with the CLAUDE.md convention of injecting fetchFn into KosliClient rather than mocking modules.
2. fix(browser): iframeId encoding + chromium GC — browser mode is not used. There is no vitest.config.* in the repo at all; tests run on the default Node pool via vitest run.
3. Revive global concurrency limit for test lifecycle (#10992) — affects scheduling of concurrent lifecycle hooks. No .concurrent anywhere in test/, and the only hooks are synchronous env-var save/restore (test/config.test.ts:7-13) and a beforeEach in test/client/kosli-client.test.ts:87. No exposure.

Node floor / types

Per CLAUDE.md, @types/node must track the floor rather than the newest release — that holds and is unaffected here:

• package.json engines.node: >=22
• vitest@4.1.11 engines.node: ^20.0.0 || ^22.0.0 || >=24.0.0 — satisfied by the CI matrix (ci.yml:20 → ['22', '24'])
• vitest peer on @types/node: ^20.0.0 || ^22.0.0 || >=24.0.0 — repo pins ^22.0.0 ✅

No @types/node change in this PR, so the Dependabot majors-ignore rule is intact.

Risks

None identified. Worth noting only that the transitive vite 8.2.1 → 8.2.2 / rolldown 1.2.5 bump rides along with this patch — that's the ESM transform layer the tests execute through, so the CI green tick on both Node 22 and 24 is the real signal here, more so than the vitest changelog itself.

Note on verification

I could not run npm ci / npm test locally — dependency installation is not permitted in this review sandbox (node_modules/ is absent on this fresh checkout), so all of the above is static analysis of the lockfile, package.json, and test/. Please rely on the ci.yml matrix run for the actual pass/fail; if you'd like me to execute the suite on future dependency PRs, npm ci and npm test would need adding to --allowedTools.
· Branch dependabot/npm_and_yarn/vitest-4.1.11