[Angnuo (angnuoli)]

Summary

• Replace stale Dependabot Build(deps): bump @vitest/mocker and vitest in /desktop/renderer #270 on current main (ecbae592a053f24f0c8b92a6dbdde2ece3f25dcb).
• Raise the renderer Vitest manifest minimum to ^4.1.12 and update its eight aligned Vitest packages from 4.1.6 to 4.1.12.
• Include the published fixes for GHSA-82fw-gwwq-j7x9 and GHSA-qxg6-89mg-rqv8.
• Keep the existing [email protected] resolved URL, Vite 6.4.4, [email protected], [email protected], and every non-Vitest package entry unchanged. Unlike the old PR, do not remove the jschardet URL or update unrelated transitive packages.
• Leave desktop/main-process Vitest 4.1.5 and its lockfile unchanged. Only two renderer dependency files change.

Validation

• Normal npm ci in desktop, including its renderer postinstall: passed.
• Separate normal npm ci in desktop/renderer: passed. Neither command uses --ignore-scripts; existing npm install-script approval policy is unchanged.
• Exact SHA-256 manifest/lock hashes remain unchanged after both installs.
• All eight downloaded tarballs match the expected SHA-512 lock integrity. Their metadata and all 221 published files match the installed packages.
• Structural lock comparison confirms only the root Vitest range and the eight approved package entries changed. Published mock redirect allowlist and string serialization hardening are present.
• Full renderer tests before and after the update: 55 files, 827 passed, 2 skipped.
• Desktop Node regression suite: 18 passed.
• npm run build in desktop (TypeScript plus renderer production build): passed using Vite 6.4.4.
• Renderer lint: no errors, 83 existing warnings; findings exactly match the fresh baseline.
• Desktop lint: the same 2 existing errors and 57 warnings as the baseline (no-control-regex in chat-attachments.ts, unused readJsonObject in openclaw-upgrade-recovery.ts). No unrelated lint changes.
• Lockfile-only npm audit: the two Vitest-related moderate findings disappear (7 findings before, 5 after); the five unrelated high findings are unchanged and are not addressed by this scoped PR.
• git diff --check: passed.

Limitations

• Full Electron-driven desktop tests and an installer smoke test are not claimed: the current npm install-script policy does not install the Electron runtime. The policy was not weakened to make validation pass.
• Production build reports annotation/chunk-size warnings; build succeeds.
• Original developer checkout and its two pre-existing local changes are untouched.

Merge

• Close superseded Build(deps): bump @vitest/mocker and vitest in /desktop/renderer #270 and manually squash merge this replacement after checking its exact head, base, and repository rules. Do not use auto-merge, admin overrides, or required-check bypasses.