deps: bump vitest 4.1.7 -> 4.1.11 and tailwindcss 4.3.0 -> 4.3.3 (3/5)

[martyy-code]

Summary

Third of a 5-PR stacked series to clear the 101 open Dependabot alerts. This PR bumps the test runner vitest and the Tailwind toolchain to clear the remaining clusters:

• 2 alerts on vitest (transitive @vitest/mocker re-export, GHSA-82fw-gwwq-j7x9)
• 10 alerts on postcss (transitively lifted to a patched range by the tailwindcss bumps)

Changes

Package	File	From	To
vitest	packages/errors/package.json	^4.1.7	^4.1.11
tailwindcss	apps/web/package.json	^4.3.0	^4.3.3
@tailwindcss/postcss	apps/web/package.json	^4.3.0	^4.3.3

Plus pnpm-lock.yaml regenerated. Note that packages/errors/package-lock.json is not in this repo's source tree, but pnpm-lock.yaml at the root covers it.

Validation

pnpm install --no-frozen-lockfile   # postinstall passes
pnpm build                          # turbo: 2 successful, ~22s
pnpm --filter errors test           # 146/146 tests (vitest reports v4.1.11)

Snapshot risk note

vitest@4.1.11 updated the snapshot hashing format between minors; the existing packages/errors/tests/snapshots suite passes without diff against the committed snapshots, but if you spot snapshot drift on unrelated suites after merge, refresh them via vitest -u and bundle into a follow-up PR.

Order in the series

1. deps(apps/web): bump fumadocs-{core,mdx,ui} to clear transitive vulns (1/5) #101 deps(apps/web): bump fumadocs-{core,mdx,ui}
2. deps(apps/web): bump next 16.2.6 -> 16.4.0 to clear 17 Next.js advisories (2/5) #102 deps(apps/web): bump next 16.2.6 -> 16.4.0
3. This PR deps: bump vitest + tailwindcss
4. PR (open) deps(pnpm): override sprintf-js
5. PR (open) chore(ci): re-enable dependabot_security_updates

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
deessejs-errors-documentation	Error		Oct 9, 2026 2:51pm UTC

[martyy-code]

Scope clarification: this PR only updates pnpm-lock.yaml, packages/errors/package.json, and apps/web/package.json. apps/web/package-lock.json is not regenerated. The vitest bump clears the GHSA-82fw-gwwq-j7x9 cluster (vitest + @vitest/mocker). The tailwindcss bumps are partial: the direct postcss ^8.5.15 floor in apps/web/package.json is the binding constraint — see #107 which raises it to ^8.5.23. Both PRs land before Dependabot's re-scan will close the postcss alerts.

Validated locally: 146/146 vitest tests pass, turbo build 2 successful.

This PR is independent of #101/#102 in terms of package.json; it can be merged in any order relative to them.

[martyy-code]

CI note: the failing Vercel check is unrelated to this PR. Root cause is a vercel.json drift between main and staging (PR #100 fixed the outputDirectory on main but it never propagated to staging). The changeset-check GitHub Actions job (the only CI gate defined in ci.yml for PRs to staging) passes. No code change needed in this PR to address Vercel — the issue resolves itself once staging catches up with main's vercel.json.