fix(deps): bump vitest to 4.1.11

[tobyhede]

Summary

Upgrades Vitest from 3.2.7 to 4.1.11 to fix CVE-2026-84373 (Dependabot #209). This is a major version bump, so a few test and config changes were needed.

Package	From	To
vitest (catalog repo)	3.2.7	4.1.11
@vitest/coverage-v8 (catalog repo, lockstep)	3.2.7	4.1.11
@vitest/mocker (+ expect/runner/snapshot/spy/utils/pretty-format)	3.2.7	4.1.11

Lockfile side effects are limited to vitest's own dependency tree: chai 5 -> 6, tinyrainbow 2 -> 3, std-env 3 -> 4, and so on. vite-node and the v3-only helpers are removed. vitest 4.1.11 was published 2026-08-18, so it's outside the minimumReleaseAge window.

Vitest 4 migration fixes

• Constructor mocks: Vitest 4 can't call an arrow-function mock implementation with new. The pg Client mocks (installer, eql repair, eql validate-command, init build-flow, db client-wrap) and the PostHog mock (telemetry-lifecycle) now use function expressions. Each has a biome-ignore lint/complexity/useArrowFunction so biome check --write can't turn them back into arrows.
• restoreAllMocks no longer resets vi.fn() state: it now only reverts vi.spyOn spies. database-url.test.ts and auth/region.test.ts depended on the old behaviour to clear module-mock calls between tests, so they now call vi.resetAllMocks() first.
• poolOptions removed: the CLI live project used poolOptions.forks.singleFork to run live suites one at a time. It now uses fileParallelism: false. packages/bench already set fileParallelism: false, so its poolOptions block is simply dropped. scripts/__tests__/cli-live-postgres-ci.test.mjs now checks for fileParallelism: false.

Verification (local, pnpm 10.33.2)

• pnpm build (all packages): passes
• turbo typecheck: 16/16 tasks pass
• turbo test --filter './packages/**' --force:
  • all packages pass except @cipherstash/stack, where 10 files fail to load because the native protect-ffi binding isn't built locally (Cannot find module .../protect-ffi-darwin-arm64/index.node)
  • The same 10 files fail identically on vitest 3.2.7 (checked against main), so this isn't a regression. The other 64 files pass (1033 tests).
  • stash CLI: 1495 passed, 47 skipped
  • stack-prisma 364, stack-supabase 574, stack-drizzle 371, wizard 366, protect-ffi 107, migrate 43, nextjs 25 and eql 5 tests all pass
• pnpm test:scripts: 912/912 pass
• e2e (vitest run): 48 passed, 16 skipped, including supply-chain.e2e.test.ts, which checks vitest and coverage-v8 stay in lockstep
• Biome on the changed files: no new diagnostics compared with main

Not run locally (they need Postgres or credentials, so CI covers them): CLI live project, bench, protect-ffi integration-tests, and examples/prisma.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 82c2867

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[auxesis]

Thanks @tobyhede!