build: bump vitest past GHSA-5xrq-8626-4rwp; coverage-v8 everywhere

pnpm audit --prod --audit-level=critical (the new CI gate) failed on
vitest <3.2.6 (critical, arbitrary file read/execute via the UI
server). Bump vitest + @vitest/coverage-v8 in-range across the
workspace and add @vitest/coverage-v8 to every package that runs
vitest but lacked it (core-audit, core-cms, core-eslint, core-testing,
core-trpc, apps/cms, web-next, web-tanstack, turbo/generators) so
'pnpm test -- --coverage' works in every package. No compound test
scripts exist, so the vitest-last pass-through concern does not apply.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/cms/package.json

@@ -32,6 +32,7 @@
     "@types/node": "^22.0.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
-    "vitest": "^3.0.0"
+    "@vitest/coverage-v8": "^3.2.7",
+    "vitest": "^3.2.7"
   }
 }

apps/web-next/package.json

@@ -47,8 +47,9 @@
     "@types/node": "^22.0.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
+    "@vitest/coverage-v8": "^3.2.7",
     "jsdom": "^25.0.0",
     "tsx": "^4.0.0",
-    "vitest": "^3.0.0"
+    "vitest": "^3.2.7"
   }
 }

apps/web-tanstack/package.json

@@ -38,7 +38,8 @@
     "@types/node": "^22.0.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
+    "@vitest/coverage-v8": "^3.2.7",
     "jsdom": "^25.0.0",
-    "vitest": "^3.0.0"
+    "vitest": "^3.2.7"
   }
 }

packages/auth/package.json

@@ -32,7 +32,7 @@
     "@repo/core-testing": "workspace:*",
     "@repo/core-typescript": "workspace:*",
     "@types/node": "^22.0.0",
-    "@vitest/coverage-v8": "^3.2.4",
+    "@vitest/coverage-v8": "^3.2.7",
-    "vitest": "^3.1.0"
+    "vitest": "^3.2.7"
   }
 }

packages/blog/package.json

@@ -35,7 +35,7 @@
     "@repo/core-typescript": "workspace:*",
     "@types/node": "^22.0.0",
     "@types/react": "^19.0.0",
-    "@vitest/coverage-v8": "^3.2.4",
+    "@vitest/coverage-v8": "^3.2.7",
-    "vitest": "^3.1.0"
+    "vitest": "^3.2.7"
   }
 }

packages/core-analytics/package.json

@@ -30,10 +30,10 @@
     "@repo/core-typescript": "workspace:*",
     "@testing-library/react": "^16.0.0",
     "@types/react": "^19.0.0",
-    "@vitest/coverage-v8": "^3.0.0",
+    "@vitest/coverage-v8": "^3.2.7",
     "jsdom": "^25.0.0",
     "react": "^19.0.0",
     "typescript": "^5.8.0",
-    "vitest": "^3.0.0"
+    "vitest": "^3.2.7"
   }
 }

packages/core-api/package.json

@@ -28,7 +28,7 @@
     "@repo/core-testing": "workspace:*",
     "@repo/core-typescript": "workspace:*",
     "@types/node": "^22.0.0",
-    "@vitest/coverage-v8": "^3.0.0",
+    "@vitest/coverage-v8": "^3.2.7",
-    "vitest": "^3.0.0"
+    "vitest": "^3.2.7"
   }
 }

packages/core-audit/package.json

@@ -37,10 +37,11 @@
     "@repo/core-eslint": "workspace:*",
     "@repo/core-testing": "workspace:*",
     "@repo/core-typescript": "workspace:*",
+    "@vitest/coverage-v8": "^3.2.7",
     "inversify": "^6.2.0",
     "payload": "^3.14.0",
     "reflect-metadata": "^0.2.2",
     "typescript": "^5.8.0",
-    "vitest": "^3.0.0"
+    "vitest": "^3.2.7"
   }
 }

packages/core-cms/package.json

@@ -14,20 +14,21 @@
     "test": "vitest run --passWithNoTests"
   },
   "dependencies": {
+    "@payloadcms/db-postgres": "^3.14.0",
+    "@payloadcms/richtext-lexical": "^3.14.0",
     "@repo/auth": "workspace:*",
     "@repo/blog": "workspace:*",
-    "@repo/media": "workspace:*",
     "@repo/marketing-pages": "workspace:*",
+    "@repo/media": "workspace:*",
     "@repo/navigation": "workspace:*",
-    "payload": "^3.14.0",
+    "payload": "^3.14.0"
-    "@payloadcms/db-postgres": "^3.14.0",
-    "@payloadcms/richtext-lexical": "^3.14.0"
   },
   "devDependencies": {
     "@repo/core-eslint": "workspace:*",
     "@repo/core-testing": "workspace:*",
     "@repo/core-typescript": "workspace:*",
     "@types/node": "^22.0.0",
-    "vitest": "^3.0.0"
+    "@vitest/coverage-v8": "^3.2.7",
+    "vitest": "^3.2.7"
   }
 }

packages/core-consent/package.json

@@ -37,11 +37,11 @@
     "@repo/core-typescript": "workspace:*",
     "@testing-library/react": "^16.0.0",
     "@types/react": "^19.0.0",
-    "@vitest/coverage-v8": "^3.0.0",
+    "@vitest/coverage-v8": "^3.2.7",
     "jsdom": "^25.0.0",
     "payload": "^3.14.0",
     "react": "^19.0.0",
     "typescript": "^5.8.0",
-    "vitest": "^3.0.0"
+    "vitest": "^3.2.7"
   }
 }

packages/core-dsr/package.json

@@ -23,8 +23,8 @@
     "@repo/core-eslint": "workspace:*",
     "@repo/core-testing": "workspace:*",
     "@repo/core-typescript": "workspace:*",
-    "@vitest/coverage-v8": "^3.0.0",
+    "@vitest/coverage-v8": "^3.2.7",
     "typescript": "^5.8.0",
-    "vitest": "^3.0.0"
+    "vitest": "^3.2.7"
   }
 }

packages/core-eslint/package.json

@@ -16,13 +16,14 @@
     "@eslint/js": "^9.20.0",
     "@typescript-eslint/eslint-plugin": "^8.25.0",
     "@typescript-eslint/parser": "^8.25.0",
+    "@vitest/coverage-v8": "^3.2.7",
     "eslint": "^9.20.0",
     "eslint-config-prettier": "^10.1.0",
     "eslint-plugin-boundaries": "^4.2.2",
     "eslint-plugin-react-hooks": "^5.2.0",
     "eslint-plugin-turbo": "^2.4.0",
     "typescript-eslint": "^8.25.0",
-    "vitest": "^3.1.0"
+    "vitest": "^3.2.7"
   },
   "dependencies": {
     "globals": "^17.6.0"

packages/core-shared/package.json

@@ -69,7 +69,6 @@
     }
   },
   "devDependencies": {
-    "next": "^15.3.0",
     "@opentelemetry/context-async-hooks": "^1.28.0",
     "@repo/core-eslint": "workspace:*",
     "@repo/core-testing": "workspace:*",
@@ -77,9 +76,10 @@
     "@sentry/node": "^10.51.0",
     "@sentry/react": "^10.51.0",
     "@types/node": "^22.0.0",
-    "@vitest/coverage-v8": "^3.2.4",
+    "@vitest/coverage-v8": "^3.2.7",
     "inversify": "^6.2.0",
+    "next": "^15.3.0",
     "reflect-metadata": "^0.2.2",
-    "vitest": "^3.1.0"
+    "vitest": "^3.2.7"
   }
 }

packages/core-testing/package.json

@@ -25,16 +25,16 @@
     "test": "vitest run"
   },
   "dependencies": {
+    "@tanstack/react-query": "^5.59.0",
     "@testing-library/jest-dom": "^6.5.0",
-    "zod": "^3.23.0",
     "@testing-library/react": "^16.0.0",
     "@testing-library/user-event": "^14.5.0",
     "@trpc/client": "^11.0.0",
-    "@tanstack/react-query": "^5.59.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "superjson": "^2.2.0",
-    "vitest": "^3.0.0"
+    "vitest": "^3.2.7",
+    "zod": "^3.23.0"
   },
   "peerDependencies": {
     "@trpc/server": "^11.0.0",
@@ -54,6 +54,7 @@
     "@sentry/nextjs": "^10.51.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
+    "@vitest/coverage-v8": "^3.2.7",
     "jsdom": "^25.0.0",
     "typescript": "^5.8.0"
   }

packages/core-trpc/package.json

@@ -31,7 +31,8 @@
     "@testing-library/jest-dom": "^6.5.0",
     "@testing-library/react": "^16.0.0",
     "@types/react": "^19.0.0",
+    "@vitest/coverage-v8": "^3.2.7",
     "jsdom": "^25.0.0",
-    "vitest": "^3.0.0"
+    "vitest": "^3.2.7"
   }
 }

packages/core-typescript/package.json

@@ -15,7 +15,7 @@
     "test": "vitest run"
   },
   "devDependencies": {
-    "@vitest/coverage-v8": "^3.2.4",
+    "@vitest/coverage-v8": "^3.2.7",
-    "vitest": "^3.1.0"
+    "vitest": "^3.2.7"
   }
 }

packages/core-ui/package.json

@@ -30,9 +30,9 @@
     "@testing-library/user-event": "^14.5.0",
     "@types/jest-axe": "^3.5.9",
     "@types/react": "^19.0.0",
-    "@vitest/coverage-v8": "^3.0.0",
+    "@vitest/coverage-v8": "^3.2.7",
     "jest-axe": "^10.0.0",
     "jsdom": "^25.0.0",
-    "vitest": "^3.0.0"
+    "vitest": "^3.2.7"
   }
 }

packages/marketing-pages/package.json

@@ -40,7 +40,7 @@
     "@repo/core-typescript": "workspace:*",
     "@types/node": "^22.0.0",
     "@types/react": "^19.0.0",
-    "@vitest/coverage-v8": "^3.2.4",
+    "@vitest/coverage-v8": "^3.2.7",
-    "vitest": "^3.1.0"
+    "vitest": "^3.2.7"
   }
 }

packages/media/package.json

@@ -30,7 +30,7 @@
     "@repo/core-testing": "workspace:*",
     "@repo/core-typescript": "workspace:*",
     "@types/node": "^22.0.0",
-    "@vitest/coverage-v8": "^3.2.4",
+    "@vitest/coverage-v8": "^3.2.7",
-    "vitest": "^3.1.0"
+    "vitest": "^3.2.7"
   }
 }

packages/navigation/package.json

@@ -35,7 +35,7 @@
     "@repo/core-typescript": "workspace:*",
     "@types/node": "^22.0.0",
     "@types/react": "^19.0.0",
-    "@vitest/coverage-v8": "^3.2.4",
+    "@vitest/coverage-v8": "^3.2.7",
-    "vitest": "^3.1.0"
+    "vitest": "^3.2.7"
   }
 }

turbo/generators/package.json

@@ -14,7 +14,8 @@
   "devDependencies": {
     "@repo/core-eslint": "workspace:*",
     "@repo/core-typescript": "workspace:*",
+    "@vitest/coverage-v8": "^3.2.7",
     "typescript": "^5.8.0",
-    "vitest": "^3.1.0"
+    "vitest": "^3.2.7"
   }
 }