fix(deps): use Vitest 5 consistently in the workspace

[wybaby168]

Summary

• Align the workspace Vitest override with the root and thumbnail declarations at 5.0.1. The original update declared 5.0.1 but installed and tested 4.1.11.
• Regenerate the frozen lockfile and verify the actual installed Vitest version in both consumers.
• Include the independently validated security dependency consistency repair from fix(deps): align security pins with the installed dependency graph #337 so the update does not retain the older DOMPurify override.

Related issue

N/A: dependency cohort continuation of #317; no separate product issue.

Change classification

• User-visible UI or rendering change
• Non-visual change
• File-format or renderer behavior
• Public API, package, Worker, WASM, or deployment-path change

Verification

Check	Result
pnpm install --frozen-lockfile --ignore-scripts and installed version inspection	Pass; root and thumbnail both use Vitest 5.0.1
node --test .github/scripts/dependency-cohort.test.mjs	Pass; 9 checks, including root declarations and physically installed root/thumbnail runners
pnpm build, pnpm type-check, pnpm test	Pass
pnpm exec vitest run --reporter=dot	Pass; 30 files, 258 tests, 1 existing skip
pnpm verify:github-governance, pnpm docs:build	Pass
Complete additional Public CI commands, including native browser and packed consumers	Pass; actual Angular 22 development and production /ui/ Worker paths included
pnpm audit --registry=https://registry.npmjs.org --audit-level low	Pass; existing approved Vue 2 EOL exception unchanged
bash .github/scripts/run-gitleaks.sh	Pass; 970 commits, no leaks

The first local RTF browser run failed while launching Firefox into protected macOS application data. The rerun used the workflow's explicit FILE_VIEWER_RTF_BROWSERS=chromium setting and passed. The failed attempt remains in local evidence; it is not counted as successful Firefox verification.

The final regression-only commit reran build, types, root standard tests, all Vitest tests, governance, official audit and frozen installation. Product source, dependency closure and runtime build inputs are unchanged from the complete Public CI baseline at 8aab24070c62fcdafef0ee7f17ac5bfaacc9bb49; its additional native-browser and cold-consumer proofs are retained.

Sample / fixture evidence

• apps/viewer-demo/public/example/ppt.pptx: actual browser slideshow, worker and cold packed-consumer gates passed.
• Existing native DOC/DOCX, IFC and PDF fixtures used by the complete Public CI commands also passed. Fixture contents were not changed.

Visual evidence

• N/A: non-visual dependency consistency change.

Risk and compatibility

• Affected packages/formats: root and thumbnail test toolchain; safety dependency repair matches fix(deps): align security pins with the installed dependency graph #337.
• Compatibility or migration risk: Vitest 5 is now actually installed. Node 24.20.0 and pnpm 11.0.9 were used for the full local rerun. No test failures were suppressed.
• Rollback: revert the cohort commit and its lockfile together. Review the independent security repair separately before reverting it.

Checklist

• I added or updated focused automated coverage, or explained why it is not needed.
• I updated user-facing documentation or release notes when behavior or API changed, or marked them not applicable.
• I verified offline/private-deployment paths when changing Worker, WASM, fonts, vendor assets, or URLs.
• I did not commit secrets, customer files, private samples, generated caches, or unrelated changes.

Independent verification update — 2026-10-07

Pre-integration head: eb074fa39039d1837da0db605da846e26924dcba.

• Added the same narrowly scoped Sharp 0.35.5 closure/installed-runtime assertion reviewed in PR337; Next remains 16.3.6 and root/thumbnail still physically resolve Vitest 5.0.1.
• This exact candidate passed complete independent Linux build/type/documentation checks on 2026-10-06. On 2026-10-07 unchanged bytes passed frozen consistency, dependency cohort, governance, official audit and the complete 30-file root Vitest suite again: 258 tests passed, one optional-fixture skip. The pinned toolchain is Node 24.20.0/pnpm 11.0.9, with NODE_PATH cleared and an owned HOME.
• Workspace audit has zero nonignored advisories with the pre-existing Vue 2 low exception retained. Default downstream consumer security boundaries remain separate.
• Fresh exact-head Public CI and Security completed successfully on 2026-10-07. All runtime/build/browser/packed-consumer gates in Public CI ran. These hosted results supplement the independent cloud shell checks; the cloud shell's own browser gates remain blocked by its execution prerequisites.
• Fresh packed-consumer installs still report 42 affected-package entries in the legacy Vue CLI/React fixture and 4 in Angular tooling (2 high, 2 critical). Functional CI is not a clean consumer-security claim. A separate focused fixture repair is being validated; no merge or npm publication has occurred.

Security-branch integration — 2026-10-07

Current head: 20eca912cd0abb71c8c83808152a8ab317b92169; parents are eb074fa39039d1837da0db605da846e26924dcba and reviewed PR337 head 55f4392e02fc77d9a82830194cfd7930fb8bd95f.

• Resolved the three overlapping cohort/workspace/lock conflicts after base/ours/theirs review. The resulting tree is exactly a233474e7e9da30b2d3354ce1f823d8d0bf43b2f, identical to the prior PR339 source tree. All nine workspace-security changes, 236 lockfile-security changes, Sharp/DOMPurify assertions and the actual Vitest5 cohort are preserved. This adds the reviewed security ancestry without replacing either fix.
• Fresh independent cloud frozen install, full build/type-check, root Vitest (258 passed, one existing skip), thumbnail16, cohort10, governance, docs, Rust, licenses, audit and19 supplemental Node gates passed. A supplemental rebuild initially overlapped component bundling; that failed attempt and affected provisional passes were retained, then all affected gates passed serial reruns.
• The local full-history Gitleaks attempt is BLOCKED/unverified: this partial clone required promised blobs and GitHub retrieval returned CONNECT403. No denied-route retry was used. The new exact head's hosted full-history scan passed:999 commits, approximately219.55MB, no leaks. The new head's complete Public CI and Security workflow completed successfully. All runtime gates ran; only failure-evidence upload was skipped. Local missing-browser gates remain separately blocked.
• No default-branch mutation, force push, npm release or compatibility-floor change. Existing consumer-security limitations remain as documented above; PR342 contains the separately scoped fixture policy repair.

[wybaby168]

Closing as covered by main fa4035f9f133079978ebf33d86606c2dbf00e6ea. Reviewed head: 20eca912cd0abb71c8c83808152a8ab317b92169.

All 13 changed paths are covered, including the inherited DOMPurify/security overrides, Next-to-Sharp lock edge, runtime guards and DICOM attribution changes from #337.

Main implements this PR's Vitest cohort requirement with exact 5.0.3 declarations in the root and thumbnail manifests, plus the same workspace override and frozen root/thumbnail importers. Both original cohort guards remain verbatim: one checks declarations, and the other resolves the physically installed Vitest runtime separately from the root and thumbnail directories.

Both guards passed in the existing main Core CI; the inherited DOMPurify and Next/Sharp guards passed there too, and the main dependency audit verified the current DICOM ledger and notices. The implementation covers the intended consistent runner and security behavior, so the older 5.0.1 cohort need not be merged.