Bump some dependencies to suppress security warnings

.yarnrc.yml

@@ -20,8 +20,7 @@ yarnPath: .yarn/releases/yarn-4.13.0.cjs
 #   yarn npm audit -R --environment production  =>  No audit suggestions
 #
 # Every block below carries a REMOVE WHEN line naming the version floor that
-# retires it. Blocks are deleted wholesale, not audited entry by entry -- 26 of
-# these 31 entries go away with just the vitest<3 and Next<15 drops.
+# retires it. Blocks are deleted wholesale, not audited entry by entry.
 npmAuditIgnoreAdvisories:
   # vitest 0.34.6 / 1.6.1 / 2.1.9 (test/vitest, test/vitest1, test/vitest2)
   # GHSA-5xrq-8626-4rwp, critical. No fix exists on these lines - upstream
@@ -30,9 +29,8 @@ npmAuditIgnoreAdvisories:
   # REMOVE WHEN: support for vitest < 3 is dropped.
   - "1139528"
 
-  # next 14.2.35 (test/next). 14.2.35 is the last stable 14.x, so there is no
-  # headroom within the major; every fix landed in 15.5.x or later.
-  # REMOVE WHEN: test/next moves off the Next 14 line.
+  # various next 14.x advisories
+  # REMOVE WHEN: support for next 14 is dropped.
   - "1112593"
   - "1112653"
   - "1114897"
@@ -54,6 +52,8 @@ npmAuditIgnoreAdvisories:
   - "1124191"
   - "1124193"
   - "1124197"
+  - "1193677"
+  - "1193733"
 
   # vite 5.4.21, pinned by vitest 0.34.6 (`^3.1.0 || ^4.0.0 || ^5.0.0-0`) and
   # 1.6.1 (`^5.0.0`). 5.4.21 is the last 5.x; fixes land in 6.4.3+.
@@ -66,6 +66,14 @@ npmAuditIgnoreAdvisories:
   # REMOVE WHEN: support for vitest < 3 is dropped.
   - "1102341"
 
+  # @vitest/mocker < 4
+  # REMOVE WHEN: support for vitest < 4 is dropped.
+  - "1193684"
+
+  # vitest < 4 advisories
+  # REMOVE WHEN: support for vitest < 4 is dropped.
+  - "1193683"
+
   # serialize-javascript 6.0.2 via mocha. No released mocha allows the fix:
   # 10.8.2 and 11.8.0 both pin `^6.0.2`, only mocha 12.0.0-rc.6 moves to
   # `^7.0.2`. A resolution override is blocked too - serialize-javascript 7.x

test/pnpm-compat.test.ts

@@ -1,13 +1,17 @@
 import { spawnSync } from "node:child_process";
 import { resolve } from "node:path";
+import util from "node:util";
 
 import { integrationTest, readAppmaps, runAppmapNode } from "./helpers";
 
 // This test runs vitest in a separate project installed with yarn pnpm linker,
 // verifying that matchesPackageFile() correctly identifies hook targets in the
 // .store/pkg-npm-version-hash/package/ path format used by yarn 4 pnpm linker.
 
-integrationTest("pnpm linker: vitest hooks instrument code in .store paths", () => {
+// vitest 4 needs styleText (node > 18)
+const test = integrationTest.if("styleText" in util);
+
+test("pnpm linker: vitest hooks instrument code in .store paths", () => {
   const dir = resolve(__dirname, "pnpm-compat");
   const install = spawnSync("yarn", ["install", "--immutable"], {
     cwd: dir,

test/pnpm-compat/package.json

@@ -3,6 +3,6 @@
   "packageManager": "yarn@4.13.0",
   "private": true,
   "dependencies": {
-    "vitest": "^3.2.6"
+    "vitest": "^4.1.0"
   }
 }