[ThomasK33]

Why

Four Dependabot PRs each changed only package-lock.json, and they conflict with each other. This PR applies all of them in one lockfile so they land together.

The same packages carry all 13 open Dependabot alerts on main (5 high). Every alert's patched version is at or below the version in this lockfile.

What changed

• vitest and @vitest/mocker 4.1.11 → 4.1.12 (from Bump @vitest/mocker and vitest #22).
• vite 8.3.0 → 8.3.5. Bump @vitest/mocker and vitest #22 already moves vite past the 8.3.4 in Bump vite from 8.3.0 to 8.3.4 #20.
• undici 6.28.1 → 6.29.1 (from chore(deps-dev): bump undici from 6.28.1 to 6.29.1 #34) and source-map-js 1.2.1 → 1.2.2 (from Bump source-map-js from 1.2.1 to 1.2.2 #19).

Scope

• The lockfile is Bump @vitest/mocker and vitest #22's lockfile plus npm update --package-lock-only undici source-map-js. Every package version that changed matches a version one of the four PRs proposed. No package is added or removed.
• package.json is unchanged. All bumps are dev dependencies.
• This PR replaces Dependabot PRs Bump source-map-js from 1.2.1 to 1.2.2 #19, Bump vite from 8.3.0 to 8.3.4 #20, Bump @vitest/mocker and vitest #22 and chore(deps-dev): bump undici from 6.28.1 to 6.29.1 #34.

Tradeoffs

• npm update vite alone would also move rolldown to 1.2.16 and bump postcss and @types/estree. No Dependabot PR proposed those versions, so I left them out.

Blast Radius

Dev and test tooling only. The published package does not ship these dependencies.

Verification

• Local mise run ci steps on Node 26.12.1: npm ci, build:libghostty, build:native, build, 40/40 tests, smoke all pass.
• A script compared every lockfile entry with the four PR lockfiles and found no extra or missing changes.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

[ThomasK33]

@codex review

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T22:32:05.353696Z	27795f0	Manual request
🔒 Security Review	✅ Completed 2026-10-29T22:32:50.977156Z	27795f0	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: 27795f0a7d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 27795f0a7d

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.