chore(deps-dev): bump vitest from 4.1.10 to 4.1.11

[dependabot]

Bumps vitest from 4.1.10 to 4.1.11.

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

Commits

• 9bd8d46 chore: release v4.1.11 (#10995)
• 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

supply-chain-guard Scan Report

WARNING: Findings were detected.

Canonical JSON report: 3 reportable finding(s).

## 🛡️ supply-chain-guard Scan Report

| Property | Value |
|----------|-------|
| Target | `.` |
| Type | directory |
| Time | 2026-08-24T04:40:50.220Z |
| Duration | 802ms |
| **Risk Score** | **6/100** (LOW) |

### Summary

Scanned 67 of 72 files.

🔵 3 low

### Findings

#### 🔵 [LOW] Action "homeofe/supply-chain-guard@v5" uses a version tag instead of a commit SHA. Tags can be force-pushed to point to different commits.

- **Rule:** `GHA_TAG_NOT_SHA`
- **File:** `.github/workflows/supply-chain-guard.yml:27`
- **Match:** `homeofe/supply-chain-guard@v5`
- **Recommendation:** Consider pinning this action to a full commit SHA for maximum security. Tags can be moved to point to malicious code.

#### 🔵 [LOW] Action "homeofe/supply-chain-guard@v5" is from third-party owner "homeofe". Third-party actions can be compromised.

- **Rule:** `GHA_THIRD_PARTY_ACTION`
- **File:** `.github/workflows/supply-chain-guard.yml:27`
- **Match:** `homeofe/supply-chain-guard@v5`
- **Recommendation:** Pin "homeofe/supply-chain-guard@v5" to a specific commit SHA and audit the action source code before use.

#### 🔵 [LOW] Build workflow found but no signed provenance or attestation detected (SLSA Level 1). Artifacts cannot be cryptographically verified.

- **Rule:** `SLSA_NO_PROVENANCE`
- **Recommendation:** Add 'slsa-framework/slsa-github-generator' or 'actions/attest-build-provenance' to your release workflow to reach SLSA Level 2. Consider cosign for container signing.

### Recommendations

- Review the listed findings and assess whether they represent legitimate functionality or potential threats.

---
*Generated by [supply-chain-guard](https://github.com/homeofe/supply-chain-guard)*