[johnxie]

Summary

This PR keeps vitest on 4.x and updates it to 4.1.12. It also applies the four small security bumps from #108. All 5 packages are development or transitive dependencies. The published bin/cli.mjs is byte-identical to main.

Supersedes #108.

Why

#108 moved vitest from 4.1.8 to 5.0.5. That major version failed in two ways:

1. vitest 5.0.5 requires Node ^22.12.0 || ^24.0.0 || >=26.0.0. CI installs Node 20, so yarn install --frozen-lockfile stopped with The engine "node" is incompatible with this module (Verify run 39870854149). CONTRIBUTING.md also states node >= 20.0.0.
2. vitest 5 declares vite as a required peer dependency, and the chore(deps): bump the npm_and_yarn group across 1 directory with 5 updates #108 lockfile removed vite. Yarn 1 does not install peer dependencies, so yarn test failed on Node 22 too with ERR_MODULE_NOT_FOUND: Cannot find package 'vite'.

vitest 4.1.12 fixes the same vitest and @vitest/mocker advisories and keeps Node 20 support.

What changes

Package	Old	New	Where
vitest (and the 7 @vitest/* packages)	4.1.8	4.1.12	package.json devDependency and yarn.lock
follow-redirects	1.16.0	1.16.1	yarn.lock
hono	4.13.7	4.13.13	yarn.lock
http-cache-semantics	4.2.0	4.3.0	yarn.lock
shell-quote	1.10.0	1.12.0	yarn.lock

No source file changes. The diff is +60/-60 lines.

Zero-regression evidence

Both trees were checked on Node 20.20.2, the CI version. Main is c95a7ac (includes #109).

Check	main	this PR
yarn install --frozen-lockfile	ok	ok
yarn build, then git status	ok, 0 files changed	ok, 0 files changed
yarn lint	ok	ok
yarn test	24 passed	24 passed
tsc --noEmit -p packages/server	0.91 s	0.66 s
yarn why zod	one copy, 3.25.28	one copy, 3.25.28
stdio initialize + tools/list	62 tools	62 tools, same names (same md5 of the name list)
packages/server/bin/cli.mjs	1,066,166 bytes	1,066,166 bytes, same md5

Alerts closed

8 open Dependabot alerts: #129, #130, #141, #168, #170 (critical), #171, #172, #173.

Rollback

Revert this PR. No data or published package changes.

QA

Step	Action	Expected
1	Use Node 20. Run yarn install --frozen-lockfile.	The install completes with no engine error.
2	Run yarn build, then git status --porcelain.	The build passes. The tree stays clean.
3	Run yarn lint and yarn test.	Lint passes. 24 tests pass.
4	Run yarn why vitest and yarn why zod.	vitest is 4.1.12. zod has one copy.
5	Run the stdio server and send initialize and tools/list.	The server lists 62 tools.

[changeset-bot]

⚠️ No Changeset found

Latest commit: ff2d7ba

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[johnxie]

@deanzaka This PR closes 8 open Dependabot alerts, one of them critical (shell-quote), and keeps CI green on Node 20. It replaces #108, which moved vitest to 5.0.5 and broke the install on Node 20 and the tests on Node 22. Only development and transitive dependencies change. The published stdio bundle is byte-identical, so users of @taskade/mcp-server see no change.

Before (#108 on CI, Node 20):

yarn install --frozen-lockfile
  -> vitest@5.0.5 needs Node ^22.12.0          <-- engine error, Verify fails
yarn test (on Node 22 only)
  -> Cannot find package 'vite'                <-- vite removed, tests fail

After (this PR on CI, Node 20):

yarn install --frozen-lockfile
  -> vitest@4.1.12 supports Node 20            <-- install ok
yarn test
  -> 24 passed                                 <-- vite 8.3.5 from #109 stays

Step	Action	Expected	Where
1	Open the Verify check on this PR.	Install, build, clean tree, lint, test and the codegen smoke all pass on Node 20.	GitHub Actions, CI / Verify
2	Locally, use Node 20 and run yarn install --frozen-lockfile.	No engine error.	A clone of this branch
3	Run yarn build, then git status --porcelain.	The build passes. No file changes.	Repo root
4	Run yarn lint and yarn test.	Lint passes. 24 tests pass.	Repo root
5	Run yarn why vitest and yarn why zod.	vitest 4.1.12. One zod copy.	Repo root
6	After merge, open the Dependabot alerts page.	#129, #130, #141, #168, #170, #171, #172 and #173 are closed.	Security, Dependabot

[Copilot]

🟢 Approval recommended

The scoped dependency updates are consistent, retain Vite resolution, and have reported passing Node 20 validation with no identified blocking issues.

No open issues 🎉

What changed in this PR

Updates development and transitive dependencies to address security advisories, replacing #108’s Vitest major upgrade with a 4.x update that retains Node 20 compatibility.

Changes:

• Updates Vitest and its seven companion packages to 4.1.12.
• Updates follow-redirects, hono, http-cache-semantics, and shell-quote.
• Leaves source code and the published CLI bundle unchanged.

File	Description
yarn.lock	Records updated dependency versions, integrity hashes, and aligned Vitest packages.
package.json	Raises the Vitest development dependency to ^4.1.12.

_{Review effort: Balanced}