chore(deps): update dependency vitest to v4 [security]

package.json

@@ -73,7 +73,7 @@
     "oxlint": "^1.56.0",
     "tsx": "^4.21.0",
     "typescript": "^5.0.0",
-    "vitest": "^3.2.4",
+    "vitest": "^4.1.11",
     "yaml": "^2.9.0"
   },
   "resolutions": {

packages/cli/package.json

@@ -70,7 +70,7 @@
     "tsup": "^8.0.0",
     "tsx": "^4.0.0",
     "typescript": "^5.0.0",
-    "vitest": "^3.2.4"
+    "vitest": "^4.1.11"
   },
   "optionalDependencies": {
     "@google/genai": "^1.50.1"

packages/cli/src/registry/remote.test.ts

@@ -56,7 +56,10 @@ async function staleAfterPriming(
 
   vi.useFakeTimers({ shouldAdvanceTime: true });
   vi.setSystemTime(new Date(Date.now() + ONE_DAY_MS + 60_000));
-  return vi.spyOn(globalThis, "fetch").mockRejectedValue(new Error("The operation was aborted"));
+  return vi
+    .spyOn(globalThis, "fetch")
+    .mockClear()
+    .mockRejectedValue(new Error("The operation was aborted"));
 }
 
 beforeEach(() => {
@@ -119,7 +122,7 @@ describe("fetchRegistryManifest", () => {
     vi.spyOn(globalThis, "fetch").mockResolvedValueOnce(ok(null));
     await fetchRegistryManifest(DEFAULT_REGISTRY_URL);
 
-    const fetchSpy = vi.spyOn(globalThis, "fetch").mockResolvedValue(ok(MANIFEST));
+    const fetchSpy = vi.spyOn(globalThis, "fetch").mockClear().mockResolvedValue(ok(MANIFEST));
 
     await expect(fetchRegistryManifest(DEFAULT_REGISTRY_URL)).resolves.toEqual(MANIFEST);
     expect(fetchSpy).toHaveBeenCalledTimes(1);

packages/core/package.json

@@ -696,11 +696,11 @@
   "devDependencies": {
     "@types/jsdom": "^28.0.0",
     "@types/node": "^25.0.10",
-    "@vitest/coverage-v8": "^3.2.4",
+    "@vitest/coverage-v8": "^4.1.11",
     "jsdom": "^29.0.0",
     "tsx": "^4.21.0",
     "typescript": "^5.0.0",
-    "vitest": "^3.2.4"
+    "vitest": "^4.1.11"
   },
   "optionalDependencies": {
     "esbuild": "^0.25.12"

packages/core/src/runtime/captionOverrides.test.ts

@@ -54,6 +54,8 @@ async function flushCaptionOverrides() {
 }
 
 afterEach(() => {
+  vi.clearAllMocks();
+  vi.restoreAllMocks();
   vi.unstubAllGlobals();
   document.body.innerHTML = "";
   Reflect.deleteProperty(window, "gsap");

packages/core/src/runtime/mediaProxy.test.ts

@@ -58,11 +58,12 @@ function isProxied(el: HTMLMediaElement): boolean {
 }
 
 afterEach(() => {
+  vi.clearAllMocks();
+  vi.restoreAllMocks();
   document.body.innerHTML = "";
   document.head.innerHTML = "";
   delete (window as { __HF_MEDIA_CODEC_MAP__?: unknown }).__HF_MEDIA_CODEC_MAP__;
   delete (window as { __HF_EXPORT_RENDER_SEEK_CONFIG?: unknown }).__HF_EXPORT_RENDER_SEEK_CONFIG;
-  vi.restoreAllMocks();
 });
 
 describe("maybeProxyProactively", () => {

packages/engine/package.json

@@ -70,7 +70,7 @@
     "@types/node": "^25.0.10",
     "@webgpu/types": "^0.1.69",
     "typescript": "^5.7.2",
-    "vitest": "^3.2.4"
+    "vitest": "^4.1.11"
   },
   "engines": {
     "node": ">=22"

packages/lint/package.json

@@ -64,6 +64,6 @@
     "tsup": "^8.0.0",
     "tsx": "^4.21.0",
     "typescript": "^5.0.0",
-    "vitest": "^3.2.4"
+    "vitest": "^4.1.11"
   }
 }

packages/parsers/package.json

@@ -206,6 +206,6 @@
     "tsup": "^8.0.0",
     "tsx": "^4.21.0",
     "typescript": "^5.0.0",
-    "vitest": "^3.2.4"
+    "vitest": "^4.1.11"
   }
 }

packages/player/package.json

@@ -43,6 +43,6 @@
     "puppeteer-core": "^25.2.1",
     "tsup": "^8.0.0",
     "typescript": "^5.0.0",
-    "vitest": "^3.2.4"
+    "vitest": "^4.1.11"
   }
 }

packages/player/src/hyperframes-player.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { describe, it, expect, vi, beforeEach, afterEach, type MockInstance } from "vitest";
 import { formatTime, formatSpeed, SPEED_PRESETS } from "./controls.js";
 
 // Install a stubbed contentDocument getter on the given iframe element. The
@@ -152,9 +152,9 @@ describe("HyperframesPlayer parent-frame media", () => {
       load: vi.fn(),
     };
 
-    vi.spyOn(globalThis, "Audio").mockImplementation(
-      () => mockAudio as unknown as HTMLAudioElement,
-    );
+    vi.spyOn(globalThis, "Audio").mockImplementation(function () {
+      return mockAudio as unknown as HTMLAudioElement;
+    });
 
     player = document.createElement("hyperframes-player") as PlayerElement;
   });
@@ -828,9 +828,9 @@ describe("HyperframesPlayer parent-proxy time-mirror coalescing", () => {
       pause: vi.fn(),
       load: vi.fn(),
     };
-    vi.spyOn(globalThis, "Audio").mockImplementation(
-      () => mockAudio as unknown as HTMLAudioElement,
-    );
+    vi.spyOn(globalThis, "Audio").mockImplementation(function () {
+      return mockAudio as unknown as HTMLAudioElement;
+    });
 
     const fresh = document.createElement("hyperframes-player") as PlayerInternal;
     fresh.setAttribute("audio-src", "https://cdn.example.com/narration.mp3");
@@ -1702,9 +1702,9 @@ describe("HyperframesPlayer volume and mute", () => {
       play: vi.fn().mockResolvedValue(undefined),
       pause: vi.fn(),
     };
-    vi.spyOn(globalThis, "Audio").mockImplementation(
-      () => mockAudio as unknown as HTMLAudioElement,
-    );
+    vi.spyOn(globalThis, "Audio").mockImplementation(function () {
+      return mockAudio as unknown as HTMLAudioElement;
+    });
 
     player = document.createElement("hyperframes-player") as typeof player;
   });
@@ -2012,7 +2012,7 @@ describe("HyperframesPlayer runtime ready handshake", () => {
 
   let player: PlayerInternal;
   let frameWindow: Window;
-  let postSpy: ReturnType<typeof vi.spyOn>;
+  let postSpy: MockInstance<typeof window.postMessage>;
 
   function readyMessage() {
     return new MessageEvent("message", {
@@ -2372,9 +2372,9 @@ describe("HyperframesPlayer playback rate", () => {
       play: vi.fn().mockResolvedValue(undefined),
       pause: vi.fn(),
     };
-    vi.spyOn(globalThis, "Audio").mockImplementation(
-      () => mockAudio as unknown as HTMLAudioElement,
-    );
+    vi.spyOn(globalThis, "Audio").mockImplementation(function () {
+      return mockAudio as unknown as HTMLAudioElement;
+    });
 
     player = document.createElement("hyperframes-player") as typeof player;
   });
@@ -2526,7 +2526,7 @@ describe("HyperframesPlayer retained runtime data", () => {
   }
 
   let player: RuntimeDataPlayer;
-  let postSpy: ReturnType<typeof vi.spyOn>;
+  let postSpy: MockInstance<typeof window.postMessage>;
 
   const readyMessage = () =>
     new MessageEvent("message", {

packages/producer/package.json

@@ -114,7 +114,7 @@
     "esbuild": "^0.25.12",
     "tsx": "^4.21.0",
     "typescript": "^5.7.2",
-    "vitest": "^3.2.4"
+    "vitest": "^4.1.11"
   },
   "engines": {
     "node": ">=22"

packages/sdk-playground/package.json

@@ -18,6 +18,6 @@
     "@types/node": "^25.0.10",
     "typescript": "^5.0.0",
     "vite": "^6.4.2",
-    "vitest": "^3.2.4"
+    "vitest": "^4.1.11"
   }
 }

packages/sdk/package.json

@@ -92,6 +92,6 @@
     "@types/node": "^25.0.10",
     "happy-dom": "^20.9.0",
     "typescript": "^5.0.0",
-    "vitest": "^3.2.4"
+    "vitest": "^4.1.11"
   }
 }

packages/shader-transitions/package.json

@@ -46,6 +46,6 @@
   "devDependencies": {
     "tsup": "^8.0.0",
     "typescript": "^5.0.0",
-    "vitest": "^3.2.4"
+    "vitest": "^4.1.11"
   }
 }

packages/studio-server/package.json

@@ -146,6 +146,6 @@
     "tsup": "^8.0.0",
     "tsx": "^4.21.0",
     "typescript": "^5.0.0",
-    "vitest": "^3.2.4"
+    "vitest": "^4.1.11"
   }
 }

packages/studio/package.json

@@ -95,7 +95,7 @@
     "tsup": "^8.0.0",
     "typescript": "^5.0.0",
     "vite": "^6.4.2",
-    "vitest": "^3.2.4",
+    "vitest": "^4.1.11",
     "zustand": "^5.0.0"
   },
   "peerDependencies": {

packages/studio/src/components/editor/AnimationCard.test.tsx

@@ -3,7 +3,7 @@
 import React, { act } from "react";
 import { createRoot } from "react-dom/client";
 import type { GsapAnimation } from "@hyperframes/core/gsap-parser";
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { afterEach, describe, expect, it, vi, type Mock } from "vitest";
 import { AnimationCard } from "./AnimationCard";
 import { EASE_PRESETS } from "./easePresetLibrary";
 import type { AnimationKeyframeTarget } from "../../hooks/gsapTweenSynth";
@@ -118,8 +118,8 @@ function renderCard({
   animation?: GsapAnimation;
   defaultExpanded?: boolean;
   flat?: boolean;
-  onUpdateMeta?: ReturnType<typeof vi.fn>;
-  onUpdateKeyframeEase?: ReturnType<typeof vi.fn>;
+  onUpdateMeta?: Mock;
+  onUpdateKeyframeEase?: Mock;
   onDeleteAnimation?: (id: string) => void;
 } = {}) {
   const host = document.createElement("div");

packages/studio/src/components/editor/propertyPanelFlatEffectsSection.test.tsx

@@ -2,7 +2,7 @@
 
 import React, { act } from "react";
 import { createRoot } from "react-dom/client";
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { afterEach, describe, expect, it, vi, type Mock } from "vitest";
 import {
   HF_COLOR_GRADING_ACTIVE_EFFECT_KEYS,
   HF_COLOR_GRADING_EFFECT_APPLY_DEFAULTS,
@@ -38,7 +38,7 @@ function renderInto(node: React.ReactElement) {
 
 function sectionProps(
   grading: ReturnType<typeof neutralGrading>,
-  onCommitColorGrading: ReturnType<typeof vi.fn> = vi.fn(),
+  onCommitColorGrading: Mock = vi.fn(),
 ) {
   return {
     grading,

packages/studio/src/components/renders/RenderQueue.test.tsx

@@ -2,7 +2,7 @@
 
 import { act } from "react";
 import { createRoot, type Root } from "react-dom/client";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from "vitest";
 import { RenderQueue } from "./RenderQueue";
 import type { FfmpegStatus } from "./useFfmpegStatus";
 
@@ -26,7 +26,7 @@ afterEach(() => {
   document.body.innerHTML = "";
 });
 
-function mountRenderQueue(onStartRender: ReturnType<typeof vi.fn>) {
+function mountRenderQueue(onStartRender: Mock) {
   const host = document.createElement("div");
   document.body.append(host);
   root = createRoot(host);

packages/studio/src/hooks/useGsapInteractionFailureTelemetry.test.tsx

@@ -1,7 +1,7 @@
 // @vitest-environment happy-dom
 
 import React, { act } from "react";
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { beforeEach, describe, expect, it, vi, type Mock } from "vitest";
 import type { DomEditSelection } from "../components/editor/domEditingTypes";
 import { mountReactHarness } from "./domSelectionTestHarness";
 import { GsapEditBlockedError } from "./gsapEditOutcome";
@@ -25,7 +25,7 @@ const selection = {
   element: document.createElement("div"),
 } as unknown as DomEditSelection;
 
-function mountFailureTelemetry(showToast: ReturnType<typeof vi.fn>) {
+function mountFailureTelemetry(showToast: Mock) {
   let report!: ReturnType<typeof useGsapInteractionFailureTelemetry>;
   function Harness() {
     report = useGsapInteractionFailureTelemetry("index.html", showToast);

packages/studio/src/player/components/TimelineAutomationLane.test.tsx

@@ -1,6 +1,6 @@
 // @vitest-environment happy-dom
 import { act } from "react";
-import { describe, expect, it, vi } from "vitest";
+import { describe, expect, it, vi, type Mock } from "vitest";
 import { createRoot } from "react-dom/client";
 import { TimelineAutomationLane } from "./TimelineAutomationLane";
 import { PAD_X } from "./automationLaneGeometry";
@@ -602,8 +602,8 @@ const mount = (automation: HfAutomation, over: Record<string, unknown> = {}) =>
   // assertion below reads the calls the lane made.
   const props = {
     ...base,
-    onPreview: base.onPreview as ReturnType<typeof vi.fn>,
-    onCommit: base.onCommit as ReturnType<typeof vi.fn>,
+    onPreview: base.onPreview as Mock,
+    onCommit: base.onCommit as Mock,
   };
   const { container } = render(<TimelineAutomationLane {...props} />);
   const svg = container.querySelector("svg")!;
@@ -685,7 +685,7 @@ describe("TimelineAutomationLane segment drag", () => {
     ],
   };
 
-  const previewedPoints = (props: { onPreview: ReturnType<typeof vi.fn> }) =>
+  const previewedPoints = (props: { onPreview: Mock }) =>
     props.onPreview.mock.calls.at(-1)?.[0].lanes[0].points as {
       t: number;
       v: number;
@@ -787,8 +787,8 @@ const mountRerenderable = (automation: HfAutomation, over: Record<string, unknow
   const base = laneProps({ automation, ...over });
   const props = {
     ...base,
-    onPreview: base.onPreview as ReturnType<typeof vi.fn>,
-    onCommit: base.onCommit as ReturnType<typeof vi.fn>,
+    onPreview: base.onPreview as Mock,
+    onCommit: base.onCommit as Mock,
   };
   const { container, rerender } = renderRerenderable(<TimelineAutomationLane {...props} />);
   const svg = container.querySelector("svg")!;
@@ -944,7 +944,7 @@ describe("TimelineAutomationLane modifiers", () => {
       },
     ],
   };
-  const draggedTimes = (props: { onPreview: ReturnType<typeof vi.fn> }) => {
+  const draggedTimes = (props: { onPreview: Mock }) => {
     const points = props.onPreview.mock.calls.at(-1)?.[0].lanes[0].points as
       | { t: number }[]
       | undefined;
@@ -1204,7 +1204,7 @@ describe("TimelineAutomationLane group drag", () => {
       },
     ],
   };
-  const pointsOf = (props: { onPreview: ReturnType<typeof vi.fn> }) =>
+  const pointsOf = (props: { onPreview: Mock }) =>
     props.onPreview.mock.calls.at(-1)?.[0].lanes[0].points as { t: number; v: number }[];
 
   it("moves every selected point by the same distance", () => {
@@ -1346,7 +1346,7 @@ describe("TimelineAutomationLane shift axis lock", () => {
       },
     ],
   };
-  const lastPoints = (props: { onPreview: ReturnType<typeof vi.fn> }) =>
+  const lastPoints = (props: { onPreview: Mock }) =>
     props.onPreview.mock.calls.at(-1)?.[0].lanes[0].points as { t: number; v: number }[];
 
   it("holds the value when the pointer travels mostly sideways", () => {

packages/studio/src/player/components/timelineDragDrop.test.tsx

@@ -2,7 +2,7 @@
 
 import React, { act } from "react";
 import { createRoot } from "react-dom/client";
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { afterEach, describe, expect, it, vi, type Mock } from "vitest";
 import { TIMELINE_ASSET_MIME, TIMELINE_BLOCK_MIME } from "../../utils/timelineAssetDrop";
 import { usePlayerStore } from "../store/playerStore";
 import { createTimelineRowGeometry } from "./timelineLayout";
@@ -37,9 +37,9 @@ function assetTransfer(payload: string): DropTransfer {
 }
 
 function renderHarness(
-  onAssetDrop: ReturnType<typeof vi.fn>,
+  onAssetDrop: Mock,
   sessionEpoch = 1,
-  options: { onBlockDrop?: ReturnType<typeof vi.fn>; strict?: boolean } = {},
+  options: { onBlockDrop?: Mock; strict?: boolean } = {},
 ) {
   const tracks = Array.from({ length: 100 }, (_, index) => index);
   const geometry = createTimelineRowGeometry(