Bump vite/vitest to a patched major version (fixes high-severity Dependabot alert) — requires @types/node bump too #960

Summary

Dependabot PR #957 attempts to bump vite (5.4.19 → 8.2.2), vitest (1.6.1 → 5.0.0), and @vitest/coverage-istanbul (1.4.0 → 5.0.0) together to resolve a high-severity security alert on vite. The PR is currently broken and should not be merged as-is — this issue tracks doing the upgrade correctly.

Why we can't just merge #957

vitest@5.0.0 has a peer dependency on @types/node@"^22.0.0 || >=24.0.0", but this repo pins @types/node@^20 in package.json. This causes npm ci to fail with an ERESOLVE conflict. Confirmed locally and in CI — both the quality and test GitHub Actions jobs fail at the "Install dependencies" step, before lint/typecheck/build/tests even run.

Verified locally with npm ci --legacy-peer-deps as a workaround: once the peer conflict is bypassed, everything else works fine — typecheck passes, next build succeeds, and all 102 vitest tests pass. So the vite/vitest 5 upgrade itself is not functionally broken, it's just missing a companion @types/node bump.

About the underlying alert

The high-severity alert covers CVE-2026-39363 / -39364 / -39365 (arbitrary file read / path traversal via the Vite dev server's WebSocket — GHSA-p9ff-h696-f583). These have no fix within the vite 5.x line — the first patched releases are 6.4.2 / 7.3.2 / 8.0.5+, which is why Dependabot is proposing a multi-major-version jump instead of a patch bump.

Exploitability note: the vulnerability requires the Vite dev server to be exposed to the network (--host / server.host) with server.ws not disabled. In this repo, vite is only pulled in transitively via vitest for running tests — the app's actual dev server is Next.js/webpack (next dev -p 1234 --webpack), and we never run a network-exposed vite dev server. So real-world exploitability here is low, but we should still clear the alert properly rather than leave it open.

What needs to happen

• Bump @types/node from ^20 to ^22 (or >=24) in package.json
• Bump vite to 8.2.2 (or latest patched major)
• Bump vitest to 5.0.0 (or latest)
• Bump @vitest/coverage-istanbul to 5.0.0 (or latest, must match vitest major)
• Run npm ci clean (no --legacy-peer-deps) to confirm the peer dependency conflict is resolved
• Run full test suite, typecheck, and next build to confirm no regressions
• Close/supersede Dependabot PR chore(deps): bump vite, @vitest/coverage-istanbul and vitest #957 once this lands