chore: vitest ツールチェーン更新で audit 脆弱性を解消

[kyosuke]

概要

npm audit が報告した 6 件の脆弱性（vite パストラバーサル / ws メモリ開示 / postcss XSS）を解消する。いずれも vitest と @cloudflare/vitest-pool-workers 経由の推移的依存だったため、直接依存を更新して対応した。

変更内容

パッケージ	旧	新
vitest	^4.1.2	^4.1.8
@cloudflare/vitest-pool-workers	^0.14.1	^0.16.13
wrangler	^4.80.0	^4.98.0

@cloudflare/vitest-pool-workers の 0.14→0.16 は破壊的変更扱いだが、peer の vitest ^4.1.0 要件を満たしている。

確認

• npm audit: 0 vulnerabilities
• npm run test:node: 11 passed
• npm run test:workers: 4 passed

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request updates several development dependencies, including @cloudflare/vitest-pool-workers, vitest, and wrangler. Feedback on the changes highlights that these dependency updates raise the required Node.js version to >=22.0.0 in the lockfile, which conflicts with the "engines": { "node": ">=18" } configuration currently specified in package.json. It is recommended to update the Node.js engine requirement in package.json to >=22 to maintain consistency and prevent installation or runtime issues in older Node.js environments.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[Copilot]

Pull request overview

This PR updates the Vitest + Cloudflare Workers testing toolchain dependencies to eliminate transitive npm audit vulnerabilities reported via vitest / @cloudflare/vitest-pool-workers (and related packages like wrangler, miniflare, vite, ws, postcss).

Changes:

• Bump vitest from ^4.1.2 to ^4.1.8.
• Bump @cloudflare/vitest-pool-workers from ^0.14.1 to ^0.16.13.
• Bump wrangler from ^4.80.0 to ^4.98.0 and refresh the lockfile accordingly.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Updates direct devDependencies for Vitest + Workers test tooling.
package-lock.json	Updates the resolved dependency graph to match the new toolchain versions and remove audited vulnerabilities.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.