fix(deps): complete Vitest 4 security migration

packages/browser-sdk/package.json

@@ -50,7 +50,7 @@
     "@reflag/tsconfig": "0.0.2",
     "@types/js-cookie": "^3.0.6",
     "@types/node": "^22.12.0",
-    "@vitest/coverage-v8": "^2.0.4",
+    "@vitest/coverage-v8": "4.1.11",
     "c8": "~10.1.3",
     "http-server": "^14.1.1",
     "jsdom": "^24.1.0",
@@ -63,7 +63,7 @@
     "vite": "^6.4.2",
     "vite-plugin-dts": "^4.0.0-beta.1",
     "vite-plugin-static-copy": "^2.3.2",
-    "vitest": "^3.2.6"
+    "vitest": "^4.1.11"
   },
   "packageManager": "yarn@4.1.1"
 }

packages/browser-sdk/test/sse.test.ts

@@ -13,14 +13,29 @@ function createSSEChannel(
   return new AblySSEChannel(channels, sseHost, callback, testLogger);
 }
 
+function mockEventSource(methods: {
+  addEventListener: (event: string, callback: (event: Event) => void) => void;
+  close?: () => void;
+}) {
+  vi.mocked(window.EventSource).mockImplementation(
+    class {
+      constructor() {
+        Object.assign(this, methods);
+      }
+    } as unknown as typeof EventSource,
+  );
+}
+
 Object.defineProperty(window, "EventSource", {
-  value: vi.fn().mockImplementation(() => {
-    // ignore
-  }),
+  value: vi.fn(class {}),
   writable: true,
 });
 
 describe("connection handling", () => {
+  beforeEach(() => {
+    mockEventSource({ addEventListener: vi.fn(), close: vi.fn() });
+  });
+
   afterEach(() => {
     vi.clearAllMocks();
   });
@@ -29,9 +44,7 @@ describe("connection handling", () => {
     const sse = createSSEChannel();
     const addEventListener = vi.fn();
 
-    vi.mocked(window.EventSource).mockReturnValue({
-      addEventListener,
-    } as any);
+    mockEventSource({ addEventListener });
 
     await sse.connect();
 
@@ -43,9 +56,7 @@ describe("connection handling", () => {
     const sse = createSSEChannel(vi.fn(), ["channel-a", "channel-b"]);
     const addEventListener = vi.fn();
 
-    vi.mocked(window.EventSource).mockReturnValue({
-      addEventListener,
-    } as any);
+    mockEventSource({ addEventListener });
 
     await sse.connect();
 
@@ -66,9 +77,7 @@ describe("connection handling", () => {
     );
     const addEventListener = vi.fn();
 
-    vi.mocked(window.EventSource).mockReturnValue({
-      addEventListener,
-    } as any);
+    mockEventSource({ addEventListener });
 
     await sse.connect();
 
@@ -143,9 +152,7 @@ describe("connection handling", () => {
       }
     };
 
-    vi.mocked(window.EventSource).mockReturnValue({
-      addEventListener,
-    } as any);
+    mockEventSource({ addEventListener });
 
     await sse.connect();
 
@@ -175,9 +182,7 @@ describe("connection handling", () => {
       }
     };
 
-    vi.mocked(window.EventSource).mockReturnValue({
-      addEventListener,
-    } as any);
+    mockEventSource({ addEventListener });
 
     await sse.connect();
 
@@ -194,10 +199,7 @@ describe("connection handling", () => {
     const addEventListener = vi.fn();
     const close = vi.fn();
 
-    vi.mocked(window.EventSource).mockReturnValue({
-      addEventListener,
-      close,
-    } as any);
+    mockEventSource({ addEventListener, close });
 
     const sse = createSSEChannel();
 
@@ -216,12 +218,12 @@ describe("connection handling", () => {
     const close = vi.fn();
     let errorCallback: ((e: Event) => void) | undefined;
 
-    vi.mocked(window.EventSource).mockReturnValue({
+    mockEventSource({
       addEventListener: (event: string, cb: (e: Event) => void) => {
         if (event === "error") errorCallback = cb;
       },
       close,
-    } as any);
+    });
 
     const sse = createSSEChannel();
     await sse.connect();

packages/browser-sdk/test/usage.test.ts

@@ -37,6 +37,9 @@ const clientNotInitializedError = {
 };
 
 vi.mock("../src/sse");
+// These tests cover SDK usage, not toolbar rendering. Avoid scheduling Preact
+// renders that can outlive the test's browser environment.
+vi.mock("../src/toolbar", () => ({ showToolbarToggle: vi.fn() }));
 vi.mock("../src/feedback/promptStorage", () => {
   return {
     markPromptMessageCompleted: vi.fn(),

packages/cli/package.json

@@ -63,7 +63,7 @@
     "@types/slug": "^5.0.9",
     "shx": "^0.3.4",
     "typescript": "^5.5.4",
-    "vitest": "^3.0.8"
+    "vitest": "^4.1.11"
   },
   "engines": {
     "node": ">=18.0.0"

packages/flag-evaluation/package.json

@@ -34,6 +34,6 @@
     "@types/node": "^22.12.0",
     "ts-node": "^10.9.2",
     "typescript": "^5.7.3",
-    "vitest": "^3.2.6"
+    "vitest": "^4.1.11"
   }
 }

packages/management-sdk/package.json

@@ -33,8 +33,8 @@
     "@openapitools/openapi-generator-cli": "^2.13.5",
     "@reflag/tsconfig": "~0.0.2",
     "@types/node": "^22.12.0",
-    "@vitest/coverage-v8": "~1.6.0",
+    "@vitest/coverage-v8": "4.1.11",
     "typescript": "^5.7.3",
-    "vitest": "~1.6.0"
+    "vitest": "~4.1.11"
   }
 }

packages/node-sdk/examples/express/package.json

@@ -18,7 +18,7 @@
     "@types/express": "^4.17.21",
     "@types/supertest": "^6.0.2",
     "supertest": "^7.0.0",
-    "vitest": "^3.2.6"
+    "vitest": "^4.1.11"
   },
   "packageManager": "yarn@4.10.3"
 }

packages/node-sdk/package.json

@@ -40,13 +40,13 @@
     "@babel/core": "~7.29.6",
     "@reflag/tsconfig": "~0.0.2",
     "@types/node": "^22.12.0",
-    "@vitest/coverage-v8": "~1.6.0",
+    "@vitest/coverage-v8": "4.1.11",
     "c8": "~10.1.0",
     "flush-promises": "~1.0.2",
     "ts-node": "~10.9.2",
     "typescript": "^5.7.3",
     "vite": "~6.4.2",
     "vite-plugin-dts": "~3.9.1",
-    "vitest": "~1.6.0"
+    "vitest": "~4.1.11"
   }
 }

packages/openfeature-browser-provider/package.json

@@ -47,7 +47,7 @@
     "typescript": "^5.7.3",
     "vite": "^6.4.2",
     "vite-plugin-dts": "^4.0.0-beta.1",
-    "vitest": "^3.2.6"
+    "vitest": "^4.1.11"
   },
   "peerDependencies": {
     "@openfeature/web-sdk": ">=1.3"

packages/openfeature-browser-provider/src/index.test.ts

@@ -1,5 +1,5 @@
 import { Client, OpenFeature } from "@openfeature/web-sdk";
-import { beforeEach, describe, expect, it, Mock, vi } from "vitest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
 
 import { ReflagClient } from "@reflag/browser-sdk";
 
@@ -30,8 +30,14 @@ describe("ReflagBrowserSDKProvider", () => {
     stop: vi.fn(),
   };
 
-  const mockReflagClient = ReflagClient as Mock;
-  mockReflagClient.mockReturnValue(reflagClientMock);
+  const mockReflagClient = vi.mocked(ReflagClient);
+  mockReflagClient.mockImplementation(
+    class {
+      constructor() {
+        return reflagClientMock;
+      }
+    } as unknown as typeof ReflagClient,
+  );
 
   beforeEach(async () => {
     await OpenFeature.clearProviders();

packages/openfeature-node-provider/package.json

@@ -49,7 +49,7 @@
     "typescript": "^5.7.3",
     "vite": "~6.4.2",
     "vite-plugin-dts": "~3.9.1",
-    "vitest": "~1.6.0"
+    "vitest": "~4.1.11"
   },
   "peerDependencies": {
     "@openfeature/server-sdk": ">=1.16.1"

packages/openfeature-node-provider/src/index.test.ts

@@ -45,8 +45,14 @@ beforeEach(() => {
 describe("ReflagNodeProvider", () => {
   let provider: ReflagNodeProvider;
 
-  const mockReflagClient = ReflagClient as Mock;
-  mockReflagClient.mockReturnValue(reflagClientMock);
+  const mockReflagClient = vi.mocked(ReflagClient);
+  mockReflagClient.mockImplementation(
+    class {
+      constructor() {
+        return reflagClientMock;
+      }
+    } as unknown as typeof ReflagClient,
+  );
 
   let mockTranslatorFn: Mock;
 

packages/react-sdk/package.json

@@ -61,7 +61,7 @@
     "vite": "^6.4.2",
     "vite-plugin-dts": "^4.0.0-beta.1",
     "vite-plugin-static-copy": "^2.3.2",
-    "vitest": "^3.2.6",
+    "vitest": "^4.1.11",
     "webpack": "^5.104.1",
     "webpack-cli": "^5.1.4"
   },

packages/vue-sdk/package.json

@@ -54,7 +54,7 @@
     "typescript": "^5.7.3",
     "vite": "^6.4.2",
     "vite-plugin-dts": "^4.5.4",
-    "vitest": "^3.2.6",
+    "vitest": "^4.1.11",
     "vue": "^3.5.16"
   },
   "peerDependencies": {