chore(deps): untangle the vitest/Storybook exact-pin knot to clear GHSA-p63j-vcc4-9vmv

[cliffhall]

Deferred from the pre-2.0.0 dependency sweep (#1837). Dev-scope only — does not ship.

The alert

GHSA-p63j-vcc4-9vmv — critical — @vitest/browser: Browser Mode provider commands bypass the file-access permission gate.

Browser Mode exposes built-in "commands" that run on the Node.js side of the test runner and can touch the local filesystem (screenshots, Playwright traces, file uploads, screenshot comparison). Several accept a file path from the browser and act on it without checking the allowWrite permission gate.

Patched in 4.1.10; clients/web is pinned at 4.1.0. It appears 3 times (@vitest/browser, @vitest/browser-playwright, @vitest/coverage-v8, plus vitest itself).

Why a one-line bump does not work

The declared range is already ^4.1.0, so 4.1.10 is in range — but the family is welded together by exact peer pins:

@vitest/browser-playwright@4.1.0  →  peer @vitest/browser  "4.1.0"   (exact)
vitest@4.1.0                      →  peer @vitest/browser-playwright "4.1.0" (exact)
@storybook/addon-vitest@10.2.19   →  peerOptional @vitest/browser "^3.0.0 || ^4.0.0"
                                     peerOptional @vitest/browser-playwright "^4.0.0"

So nothing can move alone. npm update reports "up to date" and leaves 4.1.0; an explicit npm i -D vitest@^4.1.10 @vitest/browser@^4.1.10 … fails ERESOLVE. Untangling means moving @storybook/addon-vitest (and likely @storybook/react-vite) in the same step.

There is a related pre-existing peer conflict in the same tree: @joshwooding/vite-plugin-react-docgen-typescript@0.6.4 declares peer vite@"^3 || ^4 || ^5 || ^6 || ^7" while the project is on vite 8, currently resolved by npm overriding the peer.

Why it was deferred rather than fixed

1. It does not ship — @vitest/* is dev-only and absent from the published files allowlist.
2. The advisory needs untrusted content in the test browser. Browser Mode here runs Storybook play functions against this project's own components; no third-party page is ever loaded.
3. The fix is a coordinated multi-package upgrade touching the Storybook toolchain — the thing that runs the 462-test play-function suite in npm run ci. Not work to attempt immediately before an irreversible npm publish.

The alerts were dismissed as tolerable_risk with that reasoning recorded. This issue exists so the dismissal is not the only record that real work remains.

Scope

• Move vitest, @vitest/browser, @vitest/browser-playwright, @vitest/coverage-v8 to ≥ 4.1.10 together.
• Bump @storybook/addon-vitest / @storybook/react-vite as needed to satisfy the peer set.
• Resolve, or consciously document, the vite 8 peer override on @joshwooding/vite-plugin-react-docgen-typescript.
• Verify npm run ci — especially test:storybook (browser-mode play functions) and the coverage gate, both of which run through this stack.
• Confirm the 3 alerts clear, and un-dismiss rather than leave them dismissed-but-fixed.

Related

• chore: clear all runtime dependency vulnerabilities; 2.0.0-rc.2 #1837 — the sweep that cleared all prod-scope alerts and deferred this
• chore(deps): migrate to eslint 10 to clear the brace-expansion DoS advisory #1838 — the eslint 10 migration, deferred for the same reason