chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Bumped vitest from ^3.2.4 to ^4.1.0 in both the root and mcp-worker workspaces to resolve the CRITICAL arbitrary file read/execute advisory (GHSA-5xrq-8626-4rwp, patched in 4.1.0). Resolves to 4.1.8 in the lockfile.
• Added mcp-worker/vitest.config.ts so the worker workspace no longer inherits the root vitest.config.ts under vitest 4's config discovery.
• Updated the ably mock in mcp-worker/src/ably.test.ts to use a constructable function instead of an arrow function, which vitest 4 requires for new-able mocks.

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#241	vitest	CRITICAL	Bumped to ^4.1.0 in package.json
#240	vitest	CRITICAL	Bumped to ^4.1.0 (yarn.lock)
#239	vitest	CRITICAL	Bumped to ^4.1.0 in mcp-worker/package.json

Verification

• yarn build passes
• Root vitest suite: 44 files, 189 tests pass
• mcp-worker vitest suite: 4 tests pass
• yarn format:check passes

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	devcycle-mcp-server	8d45c69	Jun 02 2026, 01:40 PM

[Copilot]

Pull request overview

This PR resolves Dependabot CRITICAL security alerts by upgrading vitest to the patched ^4.1.0 across the monorepo, updating the lockfile accordingly, and adjusting mcp-worker test configuration/mocks to remain compatible with Vitest 4’s behavior.

Changes:

• Bump vitest from ^3.2.4 to ^4.1.0 in root and mcp-worker workspaces (lockfile resolves to 4.1.8).
• Add a dedicated mcp-worker/vitest.config.ts to prevent inheriting the root Vitest config under Vitest 4 config discovery.
• Update the ably mock in mcp-worker/src/ably.test.ts to use a constructable implementation for new-able mocking.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
yarn.lock	Updates dependency graph for Vitest 4.x (and related transitive deps) to resolve security advisory.
package.json	Bumps root vitest devDependency to ^4.1.0.
mcp-worker/package.json	Bumps worker vitest devDependency to ^4.1.0.
mcp-worker/vitest.config.ts	Introduces worker-local Vitest config to avoid root config inheritance.
mcp-worker/src/ably.test.ts	Adjusts Ably mock to be constructable under Vitest 4.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.